User Intel & Risk

Review tenant-scoped identity lifecycle, deterministic risk signals, alerts, session posture, and attributed interventions without exposing secret or regulated source evidence.

BUSINESS CASES

Where this module fits

exact-identity risk triage
account-takeover investigation
alert assignment and resolution
lifecycle intervention
non-trading capability suspension
reviewer-rating evidence

PRIMARY CONSUMERS

Who integrates it

risk analysts
support investigators
security administrators
review-assistance agents

PREREQUISITES

What must exist first

admin:identity:read for review or admin:identity:write for intervention
eligible tenant administrator role
fresh purpose-bound step-up, RFC 9421 signature, and stable idempotency key for interventions

RECOMMENDED WORKFLOW

Compose the module safely.

01
start with an exact managed-identity identifier or aggregate tenant posture
02
inspect control versions, evidence commitments, alerts, sessions, and prior events
03
obtain USER_RISK_INTERVENTION step-up and record one reasoned version-bound action
04
re-read the canonical record and reconcile retained evidence

AGENT INTEGRATION

Machine-use boundaries

Omitting the exact q identifier returns metrics but no user rows; never turn exact search into directory enumeration.
Signals are deterministic review inputs backed by commitments, not inferred protected attributes and not autonomous adverse-decision authority.
Tenant and actor are derived from the bearer session; do not send tenant_uuid or actor_ref.
Use the latest returned version, re-read after a 409, and reuse an idempotency key only for the same logical body.
TRADING capability changes are frozen. These operations never grant matching, market, payment, settlement, publisher, ingress, allowlist, or traffic authority.

Register only production-listed routes as executable tools, and re-fetch the deployed OpenAPI before generating or sending a request. Source-ready routes awaiting deployment are preparation references; planned contracts are non-executable.

MODULE CONTRACTS

Every mapped endpoint

Each operation states whether its request shape is authoritative in OpenAPI, reviewed as a planning profile, or intentionally left as an outline pending an owner schema.

GETSearch managed identities/api/v2/admin/usersSearch tenant-scoped identities and return lifecycle, deterministic risk, rating, and open-alert posture.›GETGet identity control record/api/v2/admin/users/{profile_uuid}Return one identity's lifecycle, capability controls, alerts, evidence signals, sessions, and audit events.›POSTApply identity intervention/api/v2/admin/users/{profile_uuid}/interventionsApply a version-bound lifecycle, capability, reviewer-rating, or alert decision with an attributed reason.›