SCIM × AI

SCIM can provide the identity-lifecycle substrate for removing access when people join, move, or leave. The update must not silently promote SCIM's user/group provisioning model into a standard for agent assets, tool permissions, prompts, or model entitlements.

identity / governance / Enterprise AI Core / interoperability / security / implementation / organization overlay

What do SCIM 2.0 core schema and protocol actually standardize for cross-domain identity lifecycle, what security boundary do they leave to deployers, and what is only a proposal when mapped to AI agents?

[S1] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Core Schema | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Erik Wahlstroem, Chuck Mortimore | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7643.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7643 | SUPPORTING_LOCATOR: abstract lines 15-28 for common user schema/extension model; introduction and resource model lines 168-190; schema/attribute model lines 301-314; security/privacy sections listed at lines 114-117 | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: support for SCIM resource/schema scope; limit for AI-agent extrapolation. [S2] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Protocol | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Morteza Ansari, Erik Wahlstroem, Chuck Mortimore | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7644.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7644 | SUPPORTING_LOCATOR: introduction lines 136-145 for HTTP provisioning/management of Users, Groups, custom resources/extensions; authentication/authorization lines 206-239; client-to-access-control mapping lines 286-305; privacy lines 4213-4216 | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: support for protocol/lifecycle facts; limit for authorization model. [S3] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements | AUTHOR_ORG: IETF / RFC Editor | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7642.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7642 | SUPPORTING_LOCATOR: SCIM suite overview and terminology; consulted as context for provisioning-domain and cross-domain roles | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: context; no agent-specific claim closed.

• ESTABLISHED [S1+S2 support]: SCIM 2.0 is an HTTP-based application-level protocol and schema/extension suite for provisioning and managing identity data across domains. Core resources include Users and Groups, with custom resources/extensions possible.
• ESTABLISHED [S1 support]: The core schema is attribute-based and includes mutability, cardinality, returnability, and extensibility. This supports a machine-readable lifecycle contract, not an automatic policy decision about AI capabilities.
• ESTABLISHED [S2 support]: SCIM does not define a SCIM-specific authentication/authorization scheme. It relies on TLS and standard HTTP auth mechanisms, and the service provider must map the authenticated client to an access-control policy; the authorization model itself is out of scope.
• INFERENCE [S1+S2]: A company can propose a mapping from SCIM user/group state to agent accounts, tool grants, workspace membership, or service-account disablement, but that mapping is organization-specific and must be labeled PROPOSAL/INFERENCE until an explicit schema/profile and tested implementation exist.

The RFCs do not define AI agents, model access, prompt ownership, tool permissions, delegated authority, agent memory, or deletion of provider-side data. A SCIM DELETE/PATCH acknowledgement does not prove that cached tokens, sessions, queued jobs, embeddings, tool credentials, or downstream SaaS access were revoked. The RFC explicitly leaves authorization mapping to the service provider and warns about sensitive personal data/privacy. No current provider's SCIM endpoint was tested.

SCIM version and endpoint/resource schema; provider support for Users/Groups/custom extensions; tenant/organization plan; issuer/client authentication; TLS; authorization mapping; PATCH/DELETE semantics; deprovisioning latency; token/session revocation; group-to-role mapping; agent/tool/service-account inventory; downstream provider propagation; data retention and residency; audit API/log availability.

Evidence-only desk research. No SCIM endpoint was discovered, authenticated, modified, or deleted.

No SCIM conformance, deprovisioning-latency, revocation-propagation, or agent-asset inventory benchmark was run.

SCIM resources can contain personally identifying and sensitive data; minimize attributes and protect transport/logs. Audit must join source change, effective identity, target agent/tool asset, policy decision, revocation timestamp, and downstream confirmation. Cost/operability includes connector polling/webhooks, retries, reconciliation, orphan detection, and manual exception handling; not measured.

「SCIM 2.0（RFC 7643/7644）は、Users／Groups等のidentity resourceをHTTPでプロビジョニング・管理する標準である。AIでは、人員異動をAgentやtool accessへ反映する設計の基盤になり得るが、agent資産・権限・token・memoryの無効化までをSCIMが保証するわけではない。」

Future update Work should pin RFC 7643/7644 and each provider's resource schema, then build a non-destructive TEST_PROFILE for join/move/leave, group change, PATCH/DELETE, stale-token, queued-job, orphan-agent, rollback, audit readback, and downstream revocation. Keep SCIM Core, organization overlay, provider mapping, and proposed agent extension separate.

standardized SCIM profile for agent resources; current RFC errata/extension landscape; provider custom schemas; revocation SLA; token/session propagation; service-account and tool-secret handling; memory/data deletion; audit completeness; tenant/region/plan gates.

Do not say SCIM natively manages agents, models, prompts, tools, or authorization. Do not equate a successful SCIM request with immediate downstream access revocation or data deletion. UNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED

---