slug: amazon-workmail provider: Amazon WorkMail generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 17 edges: - tag: '#X Amz Target=WorkMailService.GetAccessControlEffect' spec_file: amazon-workmail-x-amz-target-workmailservice-getaccesscontroleffect-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GetAccessControlEffect ... schemas AccessControlRuleEffect, AccessControlRuleAction, ImpersonationRoleId, IpAddress reason: Evaluates whether access control rules allow or deny a given access attempt — access policy evaluation, squarely Identity & Access Management. - tag: '#X Amz Target=WorkMailService.CreateImpersonationRole' spec_file: amazon-workmail-x-amz-target-workmailservice-createimpersonationrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: CreateImpersonationRole — schemas AccessEffect, ImpersonationRuleList, TargetUsers, ImpersonationRoleType reason: Defines roles and rules granting one principal access to act as other users' mailboxes, with allow/deny effects — this is access-rights administration (delegated/privileged access), i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.DeleteAccessControlRule' spec_file: amazon-workmail-x-amz-target-workmailservice-deleteaccesscontrolrule-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: DeleteAccessControlRule — schemas AccessControlRuleName, DeleteAccessControlRuleRequest reason: Manages access control rules governing who/what can access the mail service; plainly access policy administration under Identity & Access Management. - tag: '#X Amz Target=WorkMailService.GetImpersonationRole' spec_file: amazon-workmail-x-amz-target-workmailservice-getimpersonationrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GetImpersonationRole ... schemas ImpersonationRoleType, ImpersonationRuleList, TargetUsers, AccessEffect reason: Retrieves an impersonation role and its rules governing which users may be impersonated — privileged access/role definition, i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.GetImpersonationRoleEffect' spec_file: amazon-workmail-x-amz-target-workmailservice-getimpersonationroleeffect-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GetImpersonationRoleEffect ... schemas AccessEffect, ImpersonationMatchedRule, EntityIdentifier reason: Evaluates the effect of impersonation rules for a target entity — runtime access decision on privileged access, mapped to Identity & Access Management. - tag: '#X Amz Target=WorkMailService.ListAccessControlRules' spec_file: amazon-workmail-x-amz-target-workmailservice-listaccesscontrolrules-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: 'ListAccessControlRules ... schemas: AccessControlRule, AccessControlRuleEffect, IpRangeList, UserIdList, ImpersonationRoleIdList' reason: Lists access control rules (effects, IP ranges, user lists, actions) governing who may access the mail service — plainly access management administration under Identity & Access Management. - tag: '#X Amz Target=WorkMailService.ListImpersonationRoles' spec_file: amazon-workmail-x-amz-target-workmailservice-listimpersonationroles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: 'ListImpersonationRoles ... schemas: ImpersonationRole, ImpersonationRoleType, ImpersonationRoleName' reason: Impersonation roles grant one principal delegated access to other users' mailboxes — privileged access/role administration, i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.PutAccessControlRule' spec_file: amazon-workmail-x-amz-target-workmailservice-putaccesscontrolrule-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: 'PutAccessControlRule ... schemas: AccessControlRuleEffect, IpRangeList, UserIdList, ImpersonationRoleIdList' reason: Creating access control rules with allow/deny effects over users, IP ranges and impersonation roles is plainly access management for the mail service. - tag: '#X Amz Target=WorkMailService.DeleteImpersonationRole' spec_file: amazon-workmail-x-amz-target-workmailservice-deleteimpersonationrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: DeleteImpersonationRole — schemas ImpersonationRoleId, DeleteImpersonationRoleRequest reason: Revokes a role granting impersonated access to users' mailboxes — lifecycle of privileged access rights, i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.AssumeImpersonationRole' spec_file: amazon-workmail-x-amz-target-workmailservice-assumeimpersonationrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Amazon WorkMail Assume Impersonation Role", schemas ImpersonationRoleId, ImpersonationToken, ExpiresIn' reason: Assuming a role to obtain a token for delegated access is identity and access management. - tag: '#X Amz Target=WorkMailService.CreateMobileDeviceAccessRule' spec_file: amazon-workmail-x-amz-target-workmailservice-createmobiledeviceaccessrule-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: CreateMobileDeviceAccessRule — schemas MobileDeviceAccessRuleEffect, DeviceType, DeviceOperatingSystem, DeviceUserAgent reason: Creates allow/deny rules controlling which mobile devices may access mailboxes — an access control policy surface, mapping to identity and access management rather than any line-of-business capability. - tag: '#X Amz Target=WorkMailService.DisassociateDelegateFromResource' spec_file: amazon-workmail-x-amz-target-workmailservice-disassociatedelegatefromresource-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: DisassociateDelegateFromResource Amazon WorkMail Disassociate Delegate from Resource reason: Removes a delegate's rights over a mailbox resource — granting/revoking access rights, i.e. access administration. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.DisassociateMemberFromGroup' spec_file: amazon-workmail-x-amz-target-workmailservice-disassociatememberfromgroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: DisassociateMemberFromGroup Amazon WorkMail Disassociate Member from Group; DirectoryServiceAuthenticationFailedException reason: Directory group membership maintenance (member removed from group) against the corporate directory — classic identity/group access administration, not HR membership. - tag: '#X Amz Target=WorkMailService.ListMailboxPermissions' spec_file: amazon-workmail-x-amz-target-workmailservice-listmailboxpermissions-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'ListMailboxPermissions ... schemas: Permission, PermissionType, PermissionValues, MemberType' reason: Lists the permissions granted to members on a mailbox (full access, send-as, etc.) — permission/entitlement administration on an IT resource, mapped to Identity & Access Management. - tag: '#X Amz Target=WorkMailService.PutMailboxPermissions' spec_file: amazon-workmail-x-amz-target-workmailservice-putmailboxpermissions-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'PutMailboxPermissions ... schemas: PermissionValues, PermissionType' reason: Granting permission types on mailboxes to other identities is access-rights administration, i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.ResetPassword' spec_file: amazon-workmail-x-amz-target-workmailservice-resetpassword-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: ResetPassword Amazon WorkMail Reset Password; schemas Password, InvalidPasswordException, DirectoryServiceAuthenticationFailedException reason: Resets a user's credential in the directory-backed mail service — a credential/identity administration operation, i.e. Identity & Access Management. - tag: '#X Amz Target=WorkMailService.UpdateImpersonationRole' spec_file: amazon-workmail-x-amz-target-workmailservice-updateimpersonationrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: UpdateImpersonationRole; schemas AccessEffect, ImpersonationRule, TargetUsers, ImpersonationRoleType reason: Defines roles and rules granting one identity access to other users' mailboxes with allow/deny effects — access rights administration, i.e. Identity & Access Management.