Operators & access
My Access
My Access is the read-oriented experience for people in the workforce directory who are not operators (no Admin-class SCIM roles).
Operators still have My Access in the sidebar so they can verify their own expected memberships.
What workers see
- My org units — hierarchy leaf and multi-axis memberships (e.g. teams from SCIM Groups)
- My resources — expected memberships from resource links and pins
- Provider, resource name, role (member / owner), and which org unit (or pin) grants access
What they do not see
- Connections setup
- Resource link editor / dry-run admin tools
- Drift queues and dead-task ops
- Directory token / attribute map settings
Workers who open an admin URL are redirected to My Access.
How people get in
- IdP SCIM pushes the User (identity + optional
roles). - Active users without operator roles get a Camper platform membership as viewer.
- Users with
Admin(or Owner) become operators and see the full app. - Sign-in uses the same auth as operators (OTP / SSO / passkeys as configured).
- My Access matches the signed-in email to the directory identity and runs the same desired-state rules as the provisioning engine (no live connector calls).
Empty states
| Situation | What you see |
|---|---|
| Email not in directory | “Not in the directory yet” — SCIM has not provisioned this address |
| Identity with no org unit | Org units empty until attribute/group maps place the person |
| No resource links | Resources empty until operators attach links (or pins) |