generated: '2026-07-15' method: generated source: openapi/amazon-iam-identity-center-identitystore-openapi-original.yml, openapi/amazon-iam-identity-center-sso-admin-openapi-original.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 56 by_action_class: acting: 56 by_consequence: write: 41 physical: 11 safety-critical: 4 human_in_the_loop_required: 4 operations: - path: /#X-Amz-Target=AWSIdentityStore.CreateGroup method: post operationId: CreateGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.CreateGroupMembership method: post operationId: CreateGroupMembership x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.CreateUser method: post operationId: CreateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DeleteGroup method: post operationId: DeleteGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DeleteGroupMembership method: post operationId: DeleteGroupMembership x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DeleteUser method: post operationId: DeleteUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DescribeGroup method: post operationId: DescribeGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DescribeGroupMembership method: post operationId: DescribeGroupMembership x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.DescribeUser method: post operationId: DescribeUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.GetGroupId method: post operationId: GetGroupId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.GetGroupMembershipId method: post operationId: GetGroupMembershipId x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.GetUserId method: post operationId: GetUserId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.IsMemberInGroups method: post operationId: IsMemberInGroups x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.ListGroupMemberships method: post operationId: ListGroupMemberships x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.ListGroupMembershipsForMember method: post operationId: ListGroupMembershipsForMember x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.ListGroups method: post operationId: ListGroups x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.ListUsers method: post operationId: ListUsers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.UpdateGroup method: post operationId: UpdateGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=AWSIdentityStore.UpdateUser method: post operationId: UpdateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.AttachCustomerManagedPolicyReferenceToPermissionSet method: post operationId: AttachCustomerManagedPolicyReferenceToPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.AttachManagedPolicyToPermissionSet method: post operationId: AttachManagedPolicyToPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.CreateAccountAssignment method: post operationId: CreateAccountAssignment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.CreateInstanceAccessControlAttributeConfiguration method: post operationId: CreateInstanceAccessControlAttributeConfiguration x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /#X-Amz-Target=SWBExternalService.CreatePermissionSet method: post operationId: CreatePermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DeleteAccountAssignment method: post operationId: DeleteAccountAssignment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DeleteInlinePolicyFromPermissionSet method: post operationId: DeleteInlinePolicyFromPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DeleteInstanceAccessControlAttributeConfiguration method: post operationId: DeleteInstanceAccessControlAttributeConfiguration x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /#X-Amz-Target=SWBExternalService.DeletePermissionSet method: post operationId: DeletePermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DeletePermissionsBoundaryFromPermissionSet method: post operationId: DeletePermissionsBoundaryFromPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DescribeAccountAssignmentCreationStatus method: post operationId: DescribeAccountAssignmentCreationStatus x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DescribeAccountAssignmentDeletionStatus method: post operationId: DescribeAccountAssignmentDeletionStatus x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DescribeInstanceAccessControlAttributeConfiguration method: post operationId: DescribeInstanceAccessControlAttributeConfiguration x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /#X-Amz-Target=SWBExternalService.DescribePermissionSet method: post operationId: DescribePermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DescribePermissionSetProvisioningStatus method: post operationId: DescribePermissionSetProvisioningStatus x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DetachCustomerManagedPolicyReferenceFromPermissionSet method: post operationId: DetachCustomerManagedPolicyReferenceFromPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.DetachManagedPolicyFromPermissionSet method: post operationId: DetachManagedPolicyFromPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.GetInlinePolicyForPermissionSet method: post operationId: GetInlinePolicyForPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.GetPermissionsBoundaryForPermissionSet method: post operationId: GetPermissionsBoundaryForPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListAccountAssignmentCreationStatus method: post operationId: ListAccountAssignmentCreationStatus x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListAccountAssignmentDeletionStatus method: post operationId: ListAccountAssignmentDeletionStatus x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListAccountAssignments method: post operationId: ListAccountAssignments x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListAccountsForProvisionedPermissionSet method: post operationId: ListAccountsForProvisionedPermissionSet x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListCustomerManagedPolicyReferencesInPermissionSet method: post operationId: ListCustomerManagedPolicyReferencesInPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListInstances method: post operationId: ListInstances x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListManagedPoliciesInPermissionSet method: post operationId: ListManagedPoliciesInPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListPermissionSetProvisioningStatus method: post operationId: ListPermissionSetProvisioningStatus x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListPermissionSets method: post operationId: ListPermissionSets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListPermissionSetsProvisionedToAccount method: post operationId: ListPermissionSetsProvisionedToAccount x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ListTagsForResource method: post operationId: ListTagsForResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.ProvisionPermissionSet method: post operationId: ProvisionPermissionSet x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.PutInlinePolicyToPermissionSet method: post operationId: PutInlinePolicyToPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.PutPermissionsBoundaryToPermissionSet method: post operationId: PutPermissionsBoundaryToPermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.TagResource method: post operationId: TagResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.UntagResource method: post operationId: UntagResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /#X-Amz-Target=SWBExternalService.UpdateInstanceAccessControlAttributeConfiguration method: post operationId: UpdateInstanceAccessControlAttributeConfiguration x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /#X-Amz-Target=SWBExternalService.UpdatePermissionSet method: post operationId: UpdatePermissionSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required