Optional: live Role Engine adapter
Everything else on this site runs on prepared data. This page is the exception: it points IdentityFlow at a real provider.
It is optional, it is preview only, and skipping it costs you nothing. Nothing in the tutorial depends on it.
Gate G13 — preview-only. Run it only if the preflight below passes. If it doesn’t, carry on with the prepared data — that is the expected outcome, not a fallback you should apologise for.
You need four things: a non-production endpoint, credentials from whoever owns
that environment, the provider ID siam, and five minutes to run the preflight.
The preflight checks that identity lookup works, that assignment resolution works, that webhook authentication works, and that redaction actually redacts. Do all four before showing anything to a room — the fourth is the one that embarrasses you in public.
Status: live-role-engine: preview-only. A failed preflight sends the group
back to the prepared path and changes nothing about the exercises that are
already working.
The Role Engine sits behind the same provider hook and resolver interfaces as anything else. Workflows select principals and sources; they never call the provider.
That is the whole reason this swap is possible without touching workflow code — and it’s worth pointing out to the room when it happens.
Record the provider’s response version and its acknowledgement for any assignment you request.
Keep only safe metadata: provider ID, source version, event ID, resulting step state, timing. No credentials, no full provider payloads, ever.
If you can’t repeat the live preflight reliably, go back to the prepared data and continue. Be clear when you do: what you then show is the prepared path, not a live result. Presenting it as live is how a demo turns into a commitment nobody agreed to.