Invite the operator, choose the role, and bind their identity.
Four outcomes by the time you click Continue.
Operator invited
The operator joins your tenant under the role you choose.
Identity provider bound
Sign-in federates through your tenant's identity provider.
Signing key bound
The operator becomes a cryptographic principal; every action proves who authorized it.
Role assigned
The operator's RBAC scope is set before the first action.
Target time from invite to first signed action: under 5 minutes.