@knowttl/mg-axi 0.1.0

package/docs/coverage.md

@@ -0,0 +1,1028 @@
+<!-- Generated by tools/generate-docs.mjs from src/catalogue.ts and inventory/operations.json. Do not hand-edit. -->
+
+# mg-axi coverage
+
+This is the supported Entra read surface, not full Entra coverage.
+Only the commands below have an implemented, tested leaf; every other
+operation remains scheduled, blocked, deprecated or excluded until its own slice ships.
+Inventory dispositions are discovery-time records from INV-01; the command
+list below is the implemented truth and never counts scheduled work as complete.
+
+## Counts
+
+- implemented read leaves: 192 (190 named Entra reads plus reviewed raw api get and doctor health check)
+- implemented write leaves: 5 (named gated mutations below)
+- local leaves: 6 (home, profile, login and setup views)
+- inventory named-command: 0
+- inventory reviewed-raw-read: 0
+- inventory scheduled: 8440
+- inventory intentionally-blocked: 3071
+- inventory deprecated: 870
+- inventory unavailable: 14
+- inventory excluded: 35056
+
+## Commands
+
+| Command | Operation | Inventory (v1.0) | Owning slice |
+|---|---|---|---|
+| `mg-axi entra user list` | `GET:/users` | scheduled | READ-01 |
+| `mg-axi entra user show` | `GET:/users/{user-id}` | scheduled | READ-01 |
+| `mg-axi entra user authentication-method list` | `GET:/users/{user-id}/authentication/methods` | scheduled | READ-04 |
+| `mg-axi entra registration list` | `GET:/reports/authenticationMethods/userRegistrationDetails` | scheduled | READ-04 |
+| `mg-axi entra group list` | `GET:/groups` | scheduled | READ-02 |
+| `mg-axi entra group show` | `GET:/groups/{group-id}` | scheduled | READ-02 |
+| `mg-axi entra group member list` | `GET:/groups/{group-id}/members` | scheduled | READ-02 |
+| `mg-axi entra group member-of list` | `GET:/groups/{group-id}/memberOf` | scheduled | READ-02 |
+| `mg-axi entra directory-role list` | `GET:/directoryRoles` | scheduled | READ-09 |
+| `mg-axi entra directory-role show` | `GET:/directoryRoles/{directoryRole-id}` | scheduled | READ-09 |
+| `mg-axi entra role-assignment list` | `GET:/roleManagement/directory/roleAssignments` | scheduled | READ-09 |
+| `mg-axi entra pim eligible list` | `GET:/roleManagement/directory/roleEligibilityScheduleInstances` | scheduled | READ-09 |
+| `mg-axi entra pim active list` | `GET:/roleManagement/directory/roleAssignmentScheduleInstances` | scheduled | READ-09 |
+| `mg-axi entra device list` | `GET:/devices` | scheduled | READ-10 |
+| `mg-axi entra device show` | `GET:/devices/{device-id}` | scheduled | READ-10 |
+| `mg-axi entra administrative-unit list` | `GET:/directory/administrativeUnits` | scheduled | READ-10 |
+| `mg-axi entra administrative-unit show` | `GET:/directory/administrativeUnits/{administrativeUnit-id}` | scheduled | READ-10 |
+| `mg-axi entra administrative-unit member list` | `GET:/directory/administrativeUnits/{administrativeUnit-id}/members` | scheduled | READ-10 |
+| `mg-axi entra organization list` | `GET:/organization` | scheduled | EXT-01 |
+| `mg-axi entra organization show` | `GET:/organization/{organization-id}` | scheduled | EXT-01 |
+| `mg-axi entra organization branding show` | `GET:/organization/{organization-id}/branding` | scheduled | EXT-01 |
+| `mg-axi entra organization branding-localization list` | `GET:/organization/{organization-id}/branding/localizations` | scheduled | EXT-01 |
+| `mg-axi entra organization branding-localization show` | `GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}` | scheduled | EXT-01 |
+| `mg-axi entra domain list` | `GET:/domains` | scheduled | EXT-01 |
+| `mg-axi entra domain show` | `GET:/domains/{domain-id}` | scheduled | EXT-01 |
+| `mg-axi entra domain verification-dns-record list` | `GET:/domains/{domain-id}/verificationDnsRecords` | scheduled | EXT-01 |
+| `mg-axi entra domain verification-dns-record show` | `GET:/domains/{domain-id}/verificationDnsRecords/{domainDnsRecord-id}` | scheduled | EXT-01 |
+| `mg-axi entra domain service-configuration-record list` | `GET:/domains/{domain-id}/serviceConfigurationRecords` | scheduled | EXT-01 |
+| `mg-axi entra domain service-configuration-record show` | `GET:/domains/{domain-id}/serviceConfigurationRecords/{domainDnsRecord-id}` | scheduled | EXT-01 |
+| `mg-axi entra domain-dns-record list` | `GET:/domainDnsRecords` | scheduled | EXT-01 |
+| `mg-axi entra domain-dns-record show` | `GET:/domainDnsRecords/{domainDnsRecord-id}` | scheduled | EXT-01 |
+| `mg-axi entra certificate-auth-pki list` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations` | scheduled | EXT-01 |
+| `mg-axi entra certificate-auth-pki show` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}` | scheduled | EXT-01 |
+| `mg-axi entra certificate-auth-pki count` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/$count` | scheduled | EXT-01 |
+| `mg-axi entra certificate-authority list` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities` | scheduled | EXT-01 |
+| `mg-axi entra certificate-authority show` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/{certificateAuthorityDetail-id}` | scheduled | EXT-01 |
+| `mg-axi entra certificate-authority count` | `GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/$count` | scheduled | EXT-01 |
+| `mg-axi entra subscription list` | `GET:/directory/subscriptions` | scheduled | EXT-01 |
+| `mg-axi entra subscription show` | `GET:/directory/subscriptions/{companySubscription-id}` | scheduled | EXT-01 |
+| `mg-axi entra subscription count` | `GET:/directory/subscriptions/$count` | scheduled | EXT-01 |
+| `mg-axi entra on-premises-synchronization list` | `GET:/directory/onPremisesSynchronization` | scheduled | EXT-01 |
+| `mg-axi entra on-premises-synchronization show` | `GET:/directory/onPremisesSynchronization/{onPremisesDirectorySynchronization-id}` | scheduled | EXT-01 |
+| `mg-axi entra agreement list` | `GET:/agreements` | scheduled | EXT-01 |
+| `mg-axi entra agreement show` | `GET:/agreements/{agreement-id}` | scheduled | EXT-01 |
+| `mg-axi entra agreement acceptance list` | `GET:/agreements/{agreement-id}/acceptances` | scheduled | EXT-01 |
+| `mg-axi entra agreement acceptance show` | `GET:/agreements/{agreement-id}/acceptances/{agreementAcceptance-id}` | scheduled | EXT-01 |
+| `mg-axi entra agreement-acceptance list` | `GET:/agreementAcceptances` | scheduled | EXT-01 |
+| `mg-axi entra agreement-acceptance show` | `GET:/agreementAcceptances/{agreementAcceptance-id}` | scheduled | EXT-01 |
+| `mg-axi entra directory-object list` | `GET:/directoryObjects` | scheduled | EXT-01 |
+| `mg-axi entra directory-object show` | `GET:/directoryObjects/{directoryObject-id}` | scheduled | EXT-01 |
+| `mg-axi entra directory-object count` | `GET:/directoryObjects/$count` | scheduled | EXT-01 |
+| `mg-axi entra contact list` | `GET:/contacts` | scheduled | EXT-01 |
+| `mg-axi entra contact show` | `GET:/contacts/{orgContact-id}` | scheduled | EXT-01 |
+| `mg-axi entra contact count` | `GET:/contacts/$count` | scheduled | EXT-01 |
+| `mg-axi entra contact show-manager` | `GET:/contacts/{orgContact-id}/manager` | scheduled | EXT-01 |
+| `mg-axi entra contact list-direct-reports` | `GET:/contacts/{orgContact-id}/directReports` | scheduled | EXT-01 |
+| `mg-axi entra contact show-direct-report` | `GET:/contacts/{orgContact-id}/directReports/{directoryObject-id}` | scheduled | EXT-01 |
+| `mg-axi entra contact count-direct-reports` | `GET:/contacts/{orgContact-id}/directReports/$count` | scheduled | EXT-01 |
+| `mg-axi entra contact list-member-of` | `GET:/contacts/{orgContact-id}/memberOf` | scheduled | EXT-01 |
+| `mg-axi entra contact show-member-of` | `GET:/contacts/{orgContact-id}/memberOf/{directoryObject-id}` | scheduled | EXT-01 |
+| `mg-axi entra contact count-member-of` | `GET:/contacts/{orgContact-id}/memberOf/$count` | scheduled | EXT-01 |
+| `mg-axi entra group-lifecycle-policy list` | `GET:/groupLifecyclePolicies` | scheduled | EXT-01 |
+| `mg-axi entra group-lifecycle-policy show` | `GET:/groupLifecyclePolicies/{groupLifecyclePolicy-id}` | scheduled | EXT-01 |
+| `mg-axi entra group-lifecycle-policy count` | `GET:/groupLifecyclePolicies/$count` | scheduled | EXT-01 |
+| `mg-axi entra group-setting-template list` | `GET:/groupSettingTemplates` | scheduled | EXT-01 |
+| `mg-axi entra group-setting-template show` | `GET:/groupSettingTemplates/{groupSettingTemplate-id}` | scheduled | EXT-01 |
+| `mg-axi entra group-setting-template count` | `GET:/groupSettingTemplates/$count` | scheduled | EXT-01 |
+| `mg-axi entra attribute-set list` | `GET:/directory/attributeSets` | scheduled | EXT-01 |
+| `mg-axi entra attribute-set show` | `GET:/directory/attributeSets/{attributeSet-id}` | scheduled | EXT-01 |
+| `mg-axi entra attribute-set count` | `GET:/directory/attributeSets/$count` | scheduled | EXT-01 |
+| `mg-axi entra custom-security-attribute-definition list` | `GET:/directory/customSecurityAttributeDefinitions` | scheduled | EXT-01 |
+| `mg-axi entra custom-security-attribute-definition show` | `GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}` | scheduled | EXT-01 |
+| `mg-axi entra custom-security-attribute-definition count` | `GET:/directory/customSecurityAttributeDefinitions/$count` | scheduled | EXT-01 |
+| `mg-axi entra allowed-value list` | `GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues` | scheduled | EXT-01 |
+| `mg-axi entra allowed-value show` | `GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/{allowedValue-id}` | scheduled | EXT-01 |
+| `mg-axi entra allowed-value count` | `GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/$count` | scheduled | EXT-01 |
+| `mg-axi entra contract list` | `GET:/contracts` | scheduled | EXT-04 |
+| `mg-axi entra contract show` | `GET:/contracts/{contract-id}` | scheduled | EXT-04 |
+| `mg-axi entra contract count` | `GET:/contracts/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer list` | `GET:/tenantRelationships/delegatedAdminCustomers` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer show` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship list` | `GET:/tenantRelationships/delegatedAdminRelationships` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship show` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship list-access-assignments` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship show-access-assignment` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/{delegatedAdminAccessAssignment-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship list-operations` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship show-operation` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/{delegatedAdminRelationshipOperation-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship list-requests` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship show-request` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/{delegatedAdminRelationshipRequest-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer list-service-management-details` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer show-service-management-detail` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/{delegatedAdminServiceManagementDetail-id}` | scheduled | EXT-04 |
+| `mg-axi entra multi-tenant-organization show` | `GET:/tenantRelationships/multiTenantOrganization` | scheduled | EXT-04 |
+| `mg-axi entra multi-tenant-organization join-request show` | `GET:/tenantRelationships/multiTenantOrganization/joinRequest` | scheduled | EXT-04 |
+| `mg-axi entra multi-tenant-organization tenant list` | `GET:/tenantRelationships/multiTenantOrganization/tenants` | scheduled | EXT-04 |
+| `mg-axi entra multi-tenant-organization tenant count` | `GET:/tenantRelationships/multiTenantOrganization/tenants/$count` | scheduled | EXT-04 |
+| `mg-axi entra tenant-information show` | `GET:/tenantRelationships/findTenantInformationByDomainName(domainName='{domainName}')` | scheduled | EXT-04 |
+| `mg-axi entra sign-in list` | `GET:/auditLogs/signIns` | scheduled | READ-05 |
+| `mg-axi entra sign-in show` | `GET:/auditLogs/signIns/{signIn-id}` | scheduled | READ-05 |
+| `mg-axi entra directory-audit list` | `GET:/auditLogs/directoryAudits` | scheduled | READ-05 |
+| `mg-axi entra directory-audit show` | `GET:/auditLogs/directoryAudits/{directoryAudit-id}` | scheduled | READ-05 |
+| `mg-axi entra application list` | `GET:/applications` | scheduled | READ-07 |
+| `mg-axi entra application show` | `GET:/applications/{application-id}` | scheduled | READ-07 |
+| `mg-axi entra service-principal list` | `GET:/servicePrincipals` | scheduled | READ-07 |
+| `mg-axi entra service-principal show` | `GET:/servicePrincipals/{servicePrincipal-id}` | scheduled | READ-07 |
+| `mg-axi entra application owner list` | `GET:/applications/{application-id}/owners` | scheduled | READ-07 |
+| `mg-axi entra service-principal owner list` | `GET:/servicePrincipals/{servicePrincipal-id}/owners` | scheduled | READ-07 |
+| `mg-axi entra service-principal oauth2-grant list` | `GET:/servicePrincipals/{servicePrincipal-id}/oauth2PermissionGrants` | scheduled | READ-07 |
+| `mg-axi entra service-principal app-role-assignment list` | `GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments` | scheduled | READ-08 |
+| `mg-axi entra risky-user list` | `GET:/identityProtection/riskyUsers` | scheduled | READ-06 |
+| `mg-axi entra risky-user show` | `GET:/identityProtection/riskyUsers/{riskyUser-id}` | scheduled | READ-06 |
+| `mg-axi entra risk-detection list` | `GET:/identityProtection/riskDetections` | scheduled | READ-06 |
+| `mg-axi entra risk-detection show` | `GET:/identityProtection/riskDetections/{riskDetection-id}` | scheduled | READ-06 |
+| `mg-axi entra conditional-access policy list` | `GET:/identity/conditionalAccess/policies` | scheduled | READ-03 |
+| `mg-axi entra conditional-access policy show` | `GET:/identity/conditionalAccess/policies/{conditionalAccessPolicy-id}` | scheduled | READ-03 |
+| `mg-axi entra conditional-access named-location list` | `GET:/identity/conditionalAccess/namedLocations` | scheduled | READ-03 |
+| `mg-axi entra conditional-access named-location show` | `GET:/identity/conditionalAccess/namedLocations/{namedLocation-id}` | scheduled | READ-03 |
+| `mg-axi entra identity-provider list` | `GET:/identity/identityProviders` | scheduled | EXT-03 |
+| `mg-axi entra identity-provider show` | `GET:/identity/identityProviders/{identityProviderBase-id}` | scheduled | EXT-03 |
+| `mg-axi entra identity-provider count` | `GET:/identity/identityProviders/$count` | scheduled | EXT-03 |
+| `mg-axi entra identity-provider available-types` | `GET:/identity/identityProviders/availableProviderTypes()` | scheduled | EXT-03 |
+| `mg-axi entra federation-configuration list` | `GET:/directory/federationConfigurations` | scheduled | EXT-01 |
+| `mg-axi entra federation-configuration show` | `GET:/directory/federationConfigurations/{identityProviderBase-id}` | scheduled | EXT-01 |
+| `mg-axi entra federation-configuration count` | `GET:/directory/federationConfigurations/$count` | scheduled | EXT-01 |
+| `mg-axi entra federation-configuration available-types` | `GET:/directory/federationConfigurations/availableProviderTypes()` | scheduled | EXT-01 |
+| `mg-axi entra deleted-user list` | `GET:/directory/deletedItems/graph.user` | scheduled | EXT-01 |
+| `mg-axi entra deleted-user count` | `GET:/directory/deletedItems/graph.user/$count` | scheduled | EXT-01 |
+| `mg-axi entra deleted-group list` | `GET:/directory/deletedItems/graph.group` | scheduled | EXT-01 |
+| `mg-axi entra deleted-group count` | `GET:/directory/deletedItems/graph.group/$count` | scheduled | EXT-01 |
+| `mg-axi entra deleted-application list` | `GET:/directory/deletedItems/graph.application` | scheduled | EXT-01 |
+| `mg-axi entra deleted-application count` | `GET:/directory/deletedItems/graph.application/$count` | scheduled | EXT-01 |
+| `mg-axi entra deleted-service-principal list` | `GET:/directory/deletedItems/graph.servicePrincipal` | scheduled | EXT-01 |
+| `mg-axi entra deleted-service-principal count` | `GET:/directory/deletedItems/graph.servicePrincipal/$count` | scheduled | EXT-01 |
+| `mg-axi entra deleted-administrative-unit list` | `GET:/directory/deletedItems/graph.administrativeUnit` | scheduled | EXT-01 |
+| `mg-axi entra deleted-administrative-unit count` | `GET:/directory/deletedItems/graph.administrativeUnit/$count` | scheduled | EXT-01 |
+| `mg-axi entra deleted-item show` | `GET:/directory/deletedItems/{directoryObject-id}` | scheduled | EXT-01 |
+| `mg-axi entra data-policy-operation list` | `GET:/dataPolicyOperations` | scheduled | EXT-03 |
+| `mg-axi entra data-policy-operation show` | `GET:/dataPolicyOperations/{dataPolicyOperation-id}` | scheduled | EXT-03 |
+| `mg-axi entra data-policy-operation count` | `GET:/dataPolicyOperations/$count` | scheduled | EXT-03 |
+| `mg-axi entra access-review definition list` | `GET:/identityGovernance/accessReviews/definitions` | scheduled | EXT-02 |
+| `mg-axi entra access-review definition show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}` | scheduled | EXT-02 |
+| `mg-axi entra access-review instance list` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances` | scheduled | EXT-02 |
+| `mg-axi entra access-review instance show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}` | scheduled | EXT-02 |
+| `mg-axi entra access-review decision list` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions` | scheduled | EXT-02 |
+| `mg-axi entra access-review decision show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled | EXT-02 |
+| `mg-axi entra access-review contacted-reviewer list` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers` | scheduled | EXT-02 |
+| `mg-axi entra access-review contacted-reviewer show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}` | scheduled | EXT-02 |
+| `mg-axi entra access-review stage list` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages` | scheduled | EXT-02 |
+| `mg-axi entra access-review stage show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement catalog list` | `GET:/identityGovernance/entitlementManagement/catalogs` | scheduled | EXT-02 |
+| `mg-axi entra entitlement catalog show` | `GET:/identityGovernance/entitlementManagement/catalogs/{accessPackageCatalog-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement catalog count` | `GET:/identityGovernance/entitlementManagement/catalogs/$count` | scheduled | EXT-02 |
+| `mg-axi entra entitlement access-package list` | `GET:/identityGovernance/entitlementManagement/accessPackages` | scheduled | EXT-02 |
+| `mg-axi entra entitlement access-package show` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement access-package count` | `GET:/identityGovernance/entitlementManagement/accessPackages/$count` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-policy list` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-policy show` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-policy count` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/$count` | scheduled | EXT-02 |
+| `mg-axi entra entitlement resource-role-scope list` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes` | scheduled | EXT-02 |
+| `mg-axi entra entitlement resource-role-scope show` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement resource-role-scope count` | `GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/$count` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment list` | `GET:/identityGovernance/entitlementManagement/assignments` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment show` | `GET:/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment count` | `GET:/identityGovernance/entitlementManagement/assignments/$count` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-request list` | `GET:/identityGovernance/entitlementManagement/assignmentRequests` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-request show` | `GET:/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}` | scheduled | EXT-02 |
+| `mg-axi entra entitlement assignment-request count` | `GET:/identityGovernance/entitlementManagement/assignmentRequests/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow list` | `GET:/identityGovernance/lifecycleWorkflows/workflows` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow-template list` | `GET:/identityGovernance/lifecycleWorkflows/workflowTemplates` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow-template show` | `GET:/identityGovernance/lifecycleWorkflows/workflowTemplates/{workflowTemplate-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle workflow-template count` | `GET:/identityGovernance/lifecycleWorkflows/workflowTemplates/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-definition list` | `GET:/identityGovernance/lifecycleWorkflows/taskDefinitions` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-definition show` | `GET:/identityGovernance/lifecycleWorkflows/taskDefinitions/{taskDefinition-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-definition count` | `GET:/identityGovernance/lifecycleWorkflows/taskDefinitions/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle settings show` | `GET:/identityGovernance/lifecycleWorkflows/settings` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle user-processing-result list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle user-processing-result show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults/{userProcessingResult-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle user-processing-result count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle subject-processing-result list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle subject-processing-result show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults/{subjectProcessingResult-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle subject-processing-result count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-report list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-report show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-report count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-report task show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/task` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle task-report task-definition show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/taskDefinition` | scheduled | EXT-02 |
+| `mg-axi api get` | reviewed raw reads (see src/api.ts) | reviewed-raw-read catalogue | API-01 |
+| `mg-axi doctor` | bounded `GET:/users` health check | uses the named user-list read | PACK-01 |
+
+## EXT-01 domain scope decisions
+
+Firstmate decision R1: approve narrowing this change to the eight v1.0 domain reads above.
+The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.
+Federation stays out because it can carry signing-certificate material.
+Firstmate decision R2: keep the write-family status section as the coverage fix added to scope (resolved-kept).
+Both firstmate decisions must also be stated in the PR body by the delivery phase.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/domainDnsRecords` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domainDnsRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `beta:GET:/domainDnsRecords/{domainDnsRecord-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `beta:GET:/domains/{domain-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains/{domain-id}/domainNameReferences` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `beta:GET:/domains/{domain-id}/domainNameReferences/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `beta:GET:/domains/{domain-id}/domainNameReferences/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `beta:GET:/domains/{domain-id}/federationConfiguration` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `beta:GET:/domains/{domain-id}/federationConfiguration/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `beta:GET:/domains/{domain-id}/federationConfiguration/{internalDomainFederation-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `beta:GET:/domains/{domain-id}/rootDomain` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `beta:GET:/domains/{domain-id}/serviceConfigurationRecords` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains/{domain-id}/serviceConfigurationRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `beta:GET:/domains/{domain-id}/serviceConfigurationRecords/{domainDnsRecord-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains/{domain-id}/sharedEmailDomainInvitations` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 shared-email domains subfamily: beta invitation relationships need a separate access and output review. |
+| `beta:GET:/domains/{domain-id}/sharedEmailDomainInvitations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 shared-email domains subfamily: beta invitation relationships need a separate access and output review. |
+| `beta:GET:/domains/{domain-id}/sharedEmailDomainInvitations/{sharedEmailDomainInvitation-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 shared-email domains subfamily: beta invitation relationships need a separate access and output review. |
+| `beta:GET:/domains/{domain-id}/verificationDnsRecords` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/domains/{domain-id}/verificationDnsRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `beta:GET:/domains/{domain-id}/verificationDnsRecords/{domainDnsRecord-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 beta domains subfamily: the eight approved reads cover v1.0 only; beta contracts need separate review. |
+| `v1.0:GET:/domainDnsRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `v1.0:GET:/domains/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `v1.0:GET:/domains/{domain-id}/domainNameReferences` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `v1.0:GET:/domains/{domain-id}/domainNameReferences/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `v1.0:GET:/domains/{domain-id}/domainNameReferences/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `v1.0:GET:/domains/{domain-id}/federationConfiguration` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `v1.0:GET:/domains/{domain-id}/federationConfiguration/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `v1.0:GET:/domains/{domain-id}/federationConfiguration/{internalDomainFederation-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain federation subfamily: federation configuration can carry signing-certificate material and needs a separate output review. |
+| `v1.0:GET:/domains/{domain-id}/rootDomain` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain relationships subfamily: directory-object references and root-domain navigation need their own query and projection review. |
+| `v1.0:GET:/domains/{domain-id}/serviceConfigurationRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+| `v1.0:GET:/domains/{domain-id}/verificationDnsRecords/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate R1 to a later EXT-01 domain counts subfamily: scalar counts need a separate query and response contract from the eight approved list/show reads. |
+
+## EXT-03 identity-provider scope decisions
+
+This change covers the four v1.0 workforce identity-provider reads above (list, show, count, available-types).
+The four beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily.
+Identity-provider reads support v1.0 only; beta needs its own review.
+Workforce context only; no external-customer (B2C/External ID tenant) support is claimed.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/identity/identityProviders` | scheduled (deferred) | EXT-03 | Deferred to a later EXT-03 beta identity-providers subfamily: Identity-provider reads support v1.0 only; beta needs its own review. |
+| `beta:GET:/identity/identityProviders/$count` | scheduled (deferred) | EXT-03 | Deferred to a later EXT-03 beta identity-providers subfamily: Identity-provider reads support v1.0 only; beta needs its own review. |
+| `beta:GET:/identity/identityProviders/availableProviderTypes()` | scheduled (deferred) | EXT-03 | Deferred to a later EXT-03 beta identity-providers subfamily: Identity-provider reads support v1.0 only; beta needs its own review. |
+| `beta:GET:/identity/identityProviders/{identityProviderBase-id}` | scheduled (deferred) | EXT-03 | Deferred to a later EXT-03 beta identity-providers subfamily: Identity-provider reads support v1.0 only; beta needs its own review. |
+
+## EXT-01 federation-configuration scope decisions
+
+This change covers the four v1.0 workforce directory federation-configuration reads above (federation-configuration list, show, count and available-types).
+The four beta operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.
+Federation-configuration reads support v1.0 only; beta needs its own review.
+signingCertificate carries the public token-signing key only and is omitted from default selects; no private key material exists on these resources and the domains navigation property needs its own review.
+Workforce context only; domain federationConfiguration sub-reads (/domains/{domain-id}/federationConfiguration) stay scheduled in the later domain federation subfamily.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/directory/federationConfigurations` | scheduled (deferred) | EXT-01 | Deferred by firstmate federation-configuration scope to a later EXT-01 federation-configuration beta subfamily: the four approved reads cover v1.0 only; beta federation configurations need separate review. |
+| `beta:GET:/directory/federationConfigurations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate federation-configuration scope to a later EXT-01 federation-configuration beta subfamily: the four approved reads cover v1.0 only; beta federation configurations need separate review. |
+| `beta:GET:/directory/federationConfigurations/availableProviderTypes()` | scheduled (deferred) | EXT-01 | Deferred by firstmate federation-configuration scope to a later EXT-01 federation-configuration beta subfamily: the four approved reads cover v1.0 only; beta federation configurations need separate review. |
+| `beta:GET:/directory/federationConfigurations/{identityProviderBase-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate federation-configuration scope to a later EXT-01 federation-configuration beta subfamily: the four approved reads cover v1.0 only; beta federation configurations need separate review. |
+
+## EXT-03 data-policy-operations scope decisions
+
+This change covers the three v1.0 workforce data-policy-operation reads above (data-policy-operation list, show and count).
+The three beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily; no new commands or raw access are approved.
+Data-policy-operation reads support v1.0 only; beta needs its own review.
+storageLocation always renders as the redaction marker; export submission (POST /users/{id}/exportPersonalData) belongs to no read slice.
+Workforce context only; no external-customer support is claimed.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/dataPolicyOperations` | scheduled (deferred) | EXT-03 | Deferred by firstmate data-policy-operations scope to a later EXT-03 data-policy-operations beta subfamily: the three approved reads cover v1.0 only; beta data-policy operations need separate review. |
+| `beta:GET:/dataPolicyOperations/$count` | scheduled (deferred) | EXT-03 | Deferred by firstmate data-policy-operations scope to a later EXT-03 data-policy-operations beta subfamily: the three approved reads cover v1.0 only; beta data-policy operations need separate review. |
+| `beta:GET:/dataPolicyOperations/{dataPolicyOperation-id}` | scheduled (deferred) | EXT-03 | Deferred by firstmate data-policy-operations scope to a later EXT-03 data-policy-operations beta subfamily: the three approved reads cover v1.0 only; beta data-policy operations need separate review. |
+
+## EXT-03 invitations scope decisions
+
+Firstmate decision (mg-ext-03b inbox 001): do not implement these reads and add no scope.
+The eight v1.0 invitation reads below carry an explicit reviewed unavailable disposition; no new commands or raw access are approved.
+The [v1.0 invitation resource documentation](https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md) lists Create only in its Methods table and provides no documented GET contract for these invitation reads.
+Workforce B2B context only; no invitation creation or any mutation is claimed here.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `v1.0:GET:/invitations` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/$count` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUser` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUser/serviceProvisioningErrors` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUser/serviceProvisioningErrors/$count` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUserSponsors` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUserSponsors/$count` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+| `v1.0:GET:/invitations/invitedUserSponsors/{directoryObject-id}` | unavailable | EXT-03 | Marked unavailable by firstmate EXT-03b decision: The v1.0 invitation resource Methods table documents Create only, with no documented GET contract for these invitation reads (https://github.com/microsoftgraph/microsoft-graph-docs-contrib/blob/main/api-reference/v1.0/resources/invitation.md). |
+
+## EXT-01 organization scope decisions
+
+The organization scope covers the five organization/branding/localization reads above; the remaining subfamilies need the separate contracts described below.
+The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.
+Stream image and CSS bytes stay out because they need a separate binary-output contract; beta-only settings, partner and theme contracts need separate review.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/organization/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/organization/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/organization/{organization-id}/branding/backgroundImage` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/bannerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/customCSS` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/favicon` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/headerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/backgroundImage` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/bannerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/customCSS` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/favicon` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/headerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/squareLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/squareLogoDark` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/squareLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/squareLogoDark` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:GET:/organization/{organization-id}/branding/themes/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/backgroundImage` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/bannerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/customCSS` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/favicon` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/headerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/squareLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/branding/themes/{organizationalBrandingTheme-id}/localizations/{organizationalBrandingThemeLocalization-locale}/squareLogoDark` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `beta:GET:/organization/{organization-id}/certificateBasedAuthConfiguration` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `beta:GET:/organization/{organization-id}/certificateBasedAuthConfiguration/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `beta:GET:/organization/{organization-id}/certificateBasedAuthConfiguration/{certificateBasedAuthConfiguration-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `beta:GET:/organization/{organization-id}/extensions` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `beta:GET:/organization/{organization-id}/extensions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `beta:GET:/organization/{organization-id}/extensions/{extension-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `beta:GET:/organization/{organization-id}/partnerInformation` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:GET:/organization/{organization-id}/settings` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 beta organization subfamily: the approved reads cover the shared routes on both versions; beta-only settings, partner and theme contracts need separate review. |
+| `beta:POST:/organization/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/getUserOwnedObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/{organization-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/{organization-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/{organization-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/organization/{organization-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:GET:/organization/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/organization/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/backgroundImage` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/bannerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/customCSS` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/favicon` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/headerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization counts subfamily: scalar counts and deltas need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/backgroundImage` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/bannerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/customCSS` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/favicon` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/headerLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/squareLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}/squareLogoDark` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/squareLogo` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/branding/squareLogoDark` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization branding-stream subfamily: binary image and CSS bytes need a separate output contract from the approved metadata reads. |
+| `v1.0:GET:/organization/{organization-id}/certificateBasedAuthConfiguration` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `v1.0:GET:/organization/{organization-id}/certificateBasedAuthConfiguration/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `v1.0:GET:/organization/{organization-id}/certificateBasedAuthConfiguration/{certificateBasedAuthConfiguration-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization certificate-auth subfamily: trusted-CA certificate material needs a separate redaction and output review. |
+| `v1.0:GET:/organization/{organization-id}/extensions` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `v1.0:GET:/organization/{organization-id}/extensions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `v1.0:GET:/organization/{organization-id}/extensions/{extension-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization extensions subfamily: open-extension payloads need their own query and projection review. |
+| `v1.0:POST:/organization/getAvailableExtensionProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/{organization-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/{organization-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/{organization-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/organization/{organization-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate organization scope to a later EXT-01 organization lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+
+## EXT-01 certificate-auth scope decisions
+
+This change covers the six v1.0 PKI and certificate-authority reads above (certificate-auth-pki and certificate-authority list, show and count).
+The three root /certificateBasedAuthConfiguration reads below carry an explicit reviewed unavailable disposition; no new commands or raw access are approved for them.
+The v1.0 certificateBasedAuthConfiguration resource Methods table documents List/Create/Get/Delete only on the org-scoped routes, which belong to the deferred organization certificate-auth subfamily.
+Certificate-authority entries carry public certificates only; the base64 certificate blob is omitted from default selects and needs an explicit --select naming it.
+Certificate-auth reads support v1.0 only; beta needs its own review.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `v1.0:GET:/certificateBasedAuthConfiguration` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01d decision: the v1.0 certificateBasedAuthConfiguration resource Methods table documents List/Create/Get/Delete only on the org-scoped /organization/{organization-id}/certificateBasedAuthConfiguration routes, with no documented GET contract for these root reads (https://learn.microsoft.com/en-us/graph/api/resources/certificatebasedauthconfiguration?view=graph-rest-1.0). |
+| `v1.0:GET:/certificateBasedAuthConfiguration/$count` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01d decision: the v1.0 certificateBasedAuthConfiguration resource Methods table documents List/Create/Get/Delete only on the org-scoped /organization/{organization-id}/certificateBasedAuthConfiguration routes, with no documented GET contract for these root reads (https://learn.microsoft.com/en-us/graph/api/resources/certificatebasedauthconfiguration?view=graph-rest-1.0). |
+| `v1.0:GET:/certificateBasedAuthConfiguration/{certificateBasedAuthConfiguration-id}` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01d decision: the v1.0 certificateBasedAuthConfiguration resource Methods table documents List/Create/Get/Delete only on the org-scoped /organization/{organization-id}/certificateBasedAuthConfiguration routes, with no documented GET contract for these root reads (https://learn.microsoft.com/en-us/graph/api/resources/certificatebasedauthconfiguration?view=graph-rest-1.0). |
+## EXT-01 directory-subscriptions scope decisions
+
+This change covers the three v1.0 commercial-subscription reads above (subscription list, show and count).
+The show leaf additionally serves the commerceSubscriptionId alternate-key lookup via --commerce-subscription-id, and the reviewed raw surface carries the matching function route; both bind the key only through the allowlisted session function-argument contract (validated, OData-quoted and encoded).
+Subscription reads support v1.0 only; beta needs its own review.
+
+## EXT-01 group lifecycle scope decisions
+
+This change covers the six v1.0 group lifecycle policy and group setting template reads above (list, show, count per family).
+The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.
+Beta policies and templates need their own review; delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup actions need their own request and projection review.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/groupLifecyclePolicies` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle beta subfamily: the six approved reads cover v1.0 only; beta policies and templates need separate review. |
+| `beta:GET:/groupLifecyclePolicies/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle beta subfamily: the six approved reads cover v1.0 only; beta policies and templates need separate review. |
+| `beta:GET:/groupLifecyclePolicies/{groupLifecyclePolicy-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle beta subfamily: the six approved reads cover v1.0 only; beta policies and templates need separate review. |
+| `v1.0:GET:/groupSettingTemplates/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle delta subfamily: delta-token sync needs its own paging and change-tracking contract beyond the approved list/show/count reads. |
+| `v1.0:POST:/groupSettingTemplates/getAvailableExtensionProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/{groupSettingTemplate-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/{groupSettingTemplate-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/{groupSettingTemplate-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/groupSettingTemplates/{groupSettingTemplate-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate group-lifecycle scope to a later EXT-01 group-lifecycle lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+
+## EXT-01 custom-security-attributes scope decisions
+
+This change covers the nine v1.0 attribute-set, custom-security-attribute-definition and allowed-value reads above (list, show, count per family).
+The nine beta operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.
+Beta attribute sets, definitions and allowed values need their own review; definition $expand (inline allowedValues) is not reviewed here and stays on the dedicated allowed-value list/show reads.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/directory/attributeSets` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/attributeSets/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/attributeSets/{attributeSet-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+| `beta:GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/{allowedValue-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate custom-security-attributes scope to a later EXT-01 custom-security-attributes beta subfamily: the nine approved reads cover v1.0 only; beta attribute sets, definitions and allowed values need separate review. |
+
+## EXT-01 on-premises-synchronization scope decisions
+
+This change covers the two v1.0 on-premises-synchronization reads above (on-premises-synchronization list and show).
+The $count scalar and the three beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.
+On-premises-synchronization reads support v1.0 only; beta needs its own review.
+Scalar counts need a separate query and response contract from the approved list/show reads.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/directory/onPremisesSynchronization` | scheduled (deferred) | EXT-01 | Deferred by firstmate on-premises-synchronization scope to a later EXT-01 on-premises-synchronization beta subfamily: the two approved reads cover v1.0 only; beta on-premises synchronization needs separate review. |
+| `beta:GET:/directory/onPremisesSynchronization/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate on-premises-synchronization scope to a later EXT-01 on-premises-synchronization beta subfamily: the two approved reads cover v1.0 only; beta on-premises synchronization needs separate review. |
+| `beta:GET:/directory/onPremisesSynchronization/{onPremisesDirectorySynchronization-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate on-premises-synchronization scope to a later EXT-01 on-premises-synchronization beta subfamily: the two approved reads cover v1.0 only; beta on-premises synchronization needs separate review. |
+| `v1.0:GET:/directory/onPremisesSynchronization/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate on-premises-synchronization scope to a later EXT-01 on-premises-synchronization counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+
+## EXT-01 terms-of-use scope decisions
+
+This change covers the six v1.0 agreement and agreement-acceptance reads above (agreement list/show, one agreement's acceptance list/show, and tenant-wide acceptance list/show).
+The acceptances $count scalar, the agreement file/localization/files/versions sub-reads and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.
+Terms-of-use reads support v1.0 only; beta needs its own review.
+Scalar counts need a separate query and response contract from the approved list/show reads; agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/agreementAcceptances` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreementAcceptances/{agreementAcceptance-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreements` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreements/{agreement-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreements/{agreement-id}/acceptances` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreements/{agreement-id}/acceptances/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/agreements/{agreement-id}/acceptances/{agreementAcceptance-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use beta subfamily: the six approved reads cover v1.0 only; beta agreements and acceptances need separate review. |
+| `beta:GET:/agreements/{agreement-id}/file` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions/{agreementFileVersion-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/files` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/files/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `beta:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `beta:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions/{agreementFileVersion-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/acceptances/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/agreements/{agreement-id}/file` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/agreements/{agreement-id}/file/localizations/{agreementFileLocalization-id}/versions/{agreementFileVersion-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/files` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/files/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+| `v1.0:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/agreements/{agreement-id}/files/{agreementFileLocalization-id}/versions/{agreementFileVersion-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate terms-of-use scope to a later EXT-01 terms-of-use file-content subfamily: agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed. |
+
+## EXT-01 directory-objects scope decisions
+
+This change covers the three v1.0 directory-object reads above (directory-object list, show and count).
+The delta sync, the POST lookup/validation actions and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.
+Directory-object reads support v1.0 only; beta needs its own review.
+Delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup and validation actions need their own request and projection review.
+Rows are polymorphic: only the base-type properties plus the @odata.type discriminator are projected, so subtype secrets or credentials can never appear.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/directoryObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects beta subfamily: the three approved reads cover v1.0 only; beta directory objects need separate review. |
+| `beta:GET:/directoryObjects/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects beta subfamily: the three approved reads cover v1.0 only; beta directory objects need separate review. |
+| `beta:GET:/directoryObjects/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects beta subfamily: the three approved reads cover v1.0 only; beta directory objects need separate review. |
+| `beta:GET:/directoryObjects/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects beta subfamily: the three approved reads cover v1.0 only; beta directory objects need separate review. |
+| `beta:POST:/directoryObjects/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/getUserOwnedObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/{directoryObject-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/{directoryObject-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/{directoryObject-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directoryObjects/{directoryObject-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:GET:/directoryObjects/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects delta subfamily: delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads. |
+| `v1.0:POST:/directoryObjects/getAvailableExtensionProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/{directoryObject-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/{directoryObject-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/{directoryObject-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directoryObjects/{directoryObject-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate directory-objects scope to a later EXT-01 directory-objects lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+
+## EXT-01 deleted-items scope decisions
+
+This change covers the eleven v1.0 deleted directory-item reads above (deleted-user, deleted-group, deleted-application, deleted-service-principal and deleted-administrative-unit list and count, plus deleted-item show).
+The rows below remain scheduled with an explicit deferred disposition; no new commands or raw access are approved for them.
+Deleted-item reads support v1.0 only; beta needs its own review.
+Untyped list/count commands do not exist because upstream requires the OData cast as part of the list URI.
+Device casts carry no documented v1.0 permission contract: the list/get pages name the supported types and device is not among them.
+Typed-cast singles are covered by the approved untyped show, which returns the same object for every type; the cast suffix only asserts the expected type.
+The POST lookup and validation actions need their own request and projection review; restore and permanent delete are mutations and stay out entirely.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/directory/deletedItems` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.administrativeUnit/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.application` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.application/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.device` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.device/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.group/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.servicePrincipal` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.servicePrincipal/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.user` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/graph.user/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.application` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.device` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.servicePrincipal` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:GET:/directory/deletedItems/{directoryObject-id}/graph.user` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items beta subfamily: the eleven approved reads cover v1.0 only; beta deleted items need separate review. |
+| `beta:POST:/directory/deletedItems/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directory/deletedItems/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directory/deletedItems/{directoryObject-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directory/deletedItems/{directoryObject-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directory/deletedItems/{directoryObject-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/directory/deletedItems/{directoryObject-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:GET:/directory/deletedItems` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: upstream requires the OData cast as part of the list URI and states calling GET /directory/deletedItems without a type is not supported, so no untyped list or count command is approved (https://learn.microsoft.com/en-us/graph/api/directory-deleteditems-list?view=graph-rest-1.0). |
+| `v1.0:GET:/directory/deletedItems/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: upstream requires the OData cast as part of the list URI and states calling GET /directory/deletedItems without a type is not supported, so no untyped list or count command is approved (https://learn.microsoft.com/en-us/graph/api/directory-deleteditems-list?view=graph-rest-1.0). |
+| `v1.0:GET:/directory/deletedItems/graph.device` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: the v1.0 deletedItems list/get pages name the supported types and document per-type least-privilege permissions, and device is not among them, so no device cast command is approved (https://learn.microsoft.com/en-us/graph/api/directory-deleteditems-list?view=graph-rest-1.0). |
+| `v1.0:GET:/directory/deletedItems/graph.device/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: the v1.0 deletedItems list/get pages name the supported types and document per-type least-privilege permissions, and device is not among them, so no device cast command is approved (https://learn.microsoft.com/en-us/graph/api/directory-deleteditems-list?view=graph-rest-1.0). |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: covered by the approved deleted-item show, which reads the untyped get returning the same object for every type; the cast suffix only asserts the expected type and no separate reviewed route is approved. |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.application` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: covered by the approved deleted-item show, which reads the untyped get returning the same object for every type; the cast suffix only asserts the expected type and no separate reviewed route is approved. |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.device` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: the v1.0 deletedItems list/get pages name the supported types and document per-type least-privilege permissions, and device is not among them, so no device cast command is approved (https://learn.microsoft.com/en-us/graph/api/directory-deleteditems-list?view=graph-rest-1.0). |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: covered by the approved deleted-item show, which reads the untyped get returning the same object for every type; the cast suffix only asserts the expected type and no separate reviewed route is approved. |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.servicePrincipal` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: covered by the approved deleted-item show, which reads the untyped get returning the same object for every type; the cast suffix only asserts the expected type and no separate reviewed route is approved. |
+| `v1.0:GET:/directory/deletedItems/{directoryObject-id}/graph.user` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope: covered by the approved deleted-item show, which reads the untyped get returning the same object for every type; the cast suffix only asserts the expected type and no separate reviewed route is approved. |
+| `v1.0:POST:/directory/deletedItems/getAvailableExtensionProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/{directoryObject-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/{directoryObject-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/{directoryObject-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/directory/deletedItems/{directoryObject-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate deleted-items scope to a later EXT-01 deleted-items lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+
+## EXT-01 contacts scope decisions
+
+This change covers the three v1.0 top-level contact reads above (contact list, show and count), the ten v1.0 manager/directReports navigation reads above (show-manager, list/show/count-direct-reports with user/contact casts), and the eighteen v1.0 memberOf/transitiveMemberOf navigation reads above (list/show/count-member-of with transitive and group/administrativeUnit casts).
+The delta sync, the POST lookup actions and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.
+Contact reads support v1.0 only; beta needs its own review.
+Delta-token sync needs its own change-tracking contract beyond the approved reads; the POST lookup actions need their own request and projection review.
+Contacts are personal data: top-level default rows carry id, displayName, mail and companyName only; navigation rows carry the @odata.type discriminator plus id and displayName only, and identifying fields need an explicit --select.
+The three error/sync navigation reads below are unavailable by firstmate mg-ext-01m decision: no operation-level permission documentation exists for them, so no read-scope contract can be established.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/contacts` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/graph.orgContact` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/graph.orgContact/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/graph.user` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/graph.user/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/{directoryObject-id}/graph.orgContact` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/directReports/{directoryObject-id}/graph.user` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/manager` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/graph.administrativeUnit/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/graph.group/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/{directoryObject-id}/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/memberOf/{directoryObject-id}/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/onPremisesSyncBehavior` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/serviceProvisioningErrors` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/serviceProvisioningErrors/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/graph.administrativeUnit/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/graph.group/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/{directoryObject-id}/graph.administrativeUnit` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveMemberOf/{directoryObject-id}/graph.group` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveReports` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveReports/$count` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:GET:/contacts/{orgContact-id}/transitiveReports/{directoryObject-id}` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts beta subfamily: the three approved reads cover v1.0 only; beta contacts need separate review. |
+| `beta:POST:/contacts/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/getUserOwnedObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/{orgContact-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/{orgContact-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/{orgContact-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `beta:POST:/contacts/{orgContact-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:GET:/contacts/delta()` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts delta subfamily: delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads. |
+| `v1.0:POST:/contacts/getAvailableExtensionProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/getByIds` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/validateProperties` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/{orgContact-id}/checkMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/{orgContact-id}/checkMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/{orgContact-id}/getMemberGroups` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:POST:/contacts/{orgContact-id}/getMemberObjects` | scheduled (deferred) | EXT-01 | Deferred by firstmate contacts scope to a later EXT-01 contacts lookup-actions subfamily: the POST lookup and validation actions need their own request and projection review. |
+| `v1.0:GET:/contacts/{orgContact-id}/onPremisesSyncBehavior` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01m decision: no operation-level permission documentation exists for these reads (the guessed operation pages return 404 and onPremisesSyncBehavior is absent from the orgContact resource page), so no read-scope contract can be established (https://learn.microsoft.com/en-us/graph/api/resources/orgcontact?view=graph-rest-1.0). |
+| `v1.0:GET:/contacts/{orgContact-id}/serviceProvisioningErrors` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01m decision: no operation-level permission documentation exists for these reads (the guessed operation pages return 404 and onPremisesSyncBehavior is absent from the orgContact resource page), so no read-scope contract can be established (https://learn.microsoft.com/en-us/graph/api/resources/orgcontact?view=graph-rest-1.0). |
+| `v1.0:GET:/contacts/{orgContact-id}/serviceProvisioningErrors/$count` | unavailable | EXT-01 | Marked unavailable by firstmate mg-ext-01m decision: no operation-level permission documentation exists for these reads (the guessed operation pages return 404 and onPremisesSyncBehavior is absent from the orgContact resource page), so no read-scope contract can be established (https://learn.microsoft.com/en-us/graph/api/resources/orgcontact?view=graph-rest-1.0). |
+
+## EXT-04 partner contracts scope decisions
+
+Firstmate scope: approve narrowing this change to the three v1.0 partner-contract reads above (list, show, count).
+The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.
+Beta contracts need their own review; delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/contracts` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 beta contracts subfamily: the three approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/contracts/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 beta contracts subfamily: the three approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:GET:/contracts/delta()` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts delta subfamily: delta-token sync needs its own paging and change-tracking contract beyond the approved list/show/count reads. |
+| `beta:GET:/contracts/{contract-id}` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 beta contracts subfamily: the three approved reads cover v1.0 only; beta contracts need separate review. |
+| `beta:POST:/contracts/getByIds` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/getUserOwnedObjects` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/validateProperties` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/{contract-id}/checkMemberGroups` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/{contract-id}/checkMemberObjects` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/{contract-id}/getMemberGroups` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `beta:POST:/contracts/{contract-id}/getMemberObjects` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:GET:/contracts/delta()` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts delta subfamily: delta-token sync needs its own paging and change-tracking contract beyond the approved list/show/count reads. |
+| `v1.0:POST:/contracts/getAvailableExtensionProperties` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/getByIds` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/validateProperties` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/{contract-id}/checkMemberGroups` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/{contract-id}/checkMemberObjects` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/{contract-id}/getMemberGroups` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+| `v1.0:POST:/contracts/{contract-id}/getMemberObjects` | scheduled (deferred) | EXT-04 | Deferred by firstmate contracts scope to a later EXT-04 contracts lookup-actions subfamily: membership-check and lookup POST actions need their own request and projection review. |
+
+## EXT-04 delegated-admin scope decisions
+
+Firstmate scope: approve narrowing this change to the twelve v1.0 delegated-admin reads above (customer list/show, relationship list/show, access-assignment list/show, operation list/show, request list/show and service-management-detail list/show).
+The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.
+Scalar counts need a separate query and response contract from the approved list/show reads; the tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `v1.0:GET:/tenantRelationships` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin root subfamily: the tenantRelationship container singleton needs its own projection review beyond the approved customer and relationship list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminCustomers/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
+
+## EXT-04 multi-tenant-organization scope decisions
+
+Firstmate scope: approve narrowing this change to the four v1.0 multi-tenant-organization reads above (organization show, join-request show, tenant list/count).
+The single-member read below remains scheduled with an explicit deferred disposition: its documented least privilege is the write scope MultiTenantOrganization.ReadWrite.All in both delegated and application modes, so no named command or raw access is approved for it until its own least-privilege review lands.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `v1.0:GET:/tenantRelationships/multiTenantOrganization/tenants/{multiTenantOrganizationMember-id}` | scheduled (deferred) | EXT-04 | Deferred by firstmate multi-tenant-organization scope to a later EXT-04 multi-tenant-organization subfamily: documented least privilege is the write scope MultiTenantOrganization.ReadWrite.All in both delegated and application modes, so no named command or raw access is approved for the single-member read. |
+
+## EXT-04 tenant-lookup scope decisions
+
+Firstmate scope: approve the mg-ext-04e function-argument contract with the three v1.0 reads it unblocks (tenant-information show by domain name or tenant ID, subscription show by commerce subscription ID).
+The shared session binds parenthesised function arguments only for these three allowlisted catalogue operations, each with its exact function/key name and parameter name; every other path keeps the refusal. Values arrive only as explicit CLI flags, are validated per type (DNS name, tenant GUID, commerce identifier), OData-quoted with single quotes doubled, then percent-encoded past the RFC3986 unreserved set; control characters, separators, reserved characters and overlong values fail before credentials. The reviewed raw surface carries the same three routes with the same binding.
+Tenant-information lookups need CrossTenantInformation.ReadBasic.All with no Entra role; the commerce lookup needs Organization.Read.All plus a supported subscription role. Personal Microsoft accounts are not supported for any of the three. Tenant-information reads support v1.0 only; beta needs its own review.
+
+## EXT-02 access-review scope decisions
+
+The access-review scope covers the ten reads above (definition, instance, decision, contacted-reviewer and stage list/show reads).
+The legacy accessReviews and unified alias reads below are split into the EXT-02c follow-up to limit this piece's size; beta-only operations stay deferred ("beta needs its own review").
+The history reads below are blocked: their documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri.
+No new commands or raw access are approved for any row below.
+
+| Inventory operation | Disposition | Deferral reason |
+|---|---|---|
+| `beta:GET:/accessReviewDecisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviewDecisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviewDecisions/{accessReviewDecision-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/decisions/{accessReviewDecision-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/decisions/{accessReviewDecision-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/myDecisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/myDecisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/myDecisions/{accessReviewDecision-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/reviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/reviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/instances/{accessReview-id1}/reviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/myDecisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/myDecisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/myDecisions/{accessReviewDecision-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/reviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/reviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/accessReviews/{accessReview-id}/reviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions/$count` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances/$count` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances/{accessReviewHistoryInstance-id}` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `beta:GET:/identityGovernance/accessReviews/unified` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/decisions/{accessReviewInstanceDecisionItem-id1}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `beta:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/instance/definition` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions/$count` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances/$count` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/historyDefinitions/{accessReviewHistoryDefinition-id}/instances/{accessReviewHistoryInstance-id}` | intentionally-blocked: EXT-02c | Blocked: documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri; recording or emitting that URL needs its own redaction and output review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/filterByCurrentUser(on='{on}')` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/$count` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+| `v1.0:GET:/identityGovernance/accessReviews/unified/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}/decisions/{accessReviewInstanceDecisionItem-id}/insights/{governanceInsight-id}` | scheduled: EXT-02c | Split into EXT-02c to limit this piece's size: legacy accessReviews and unified alias reads need their own query, access and projection review; beta contracts need separate review. |
+
+## EXT-02 entitlement-management scope decisions
+
+The entitlement-management scope covers the eighteen reads above (catalog, access-package, assignment-policy and resource-role-scope list/show/count reads plus assignment and assignment-request list/show/count reads).
+Approval and subject reads carry personal data and stay scheduled for later parts with no new commands or raw access approved; so do assignment and request navigation sub-reads (assignment target/accessPackage/assignmentPolicy, request accessPackage/assignment/requestor), the top-level assignment-policy and resource-role-scope lists, catalog navigation reads (accessPackages, resources, resourceScopes, resourceRoles, customWorkflowExtensions), package navigation reads (catalog, incompatible sets), policy navigation reads (questions, custom-extension stages), role/scope link expansion, filterByCurrentUser and additionalAccess functions (parenthesised function segments need their own session-guard binding review), and every beta operation below. Raw $expand review is a separate change: the named assignment and request reads flatten one fixed documented expansion in code, and no user-supplied $expand exists on any route.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages/$count` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackageResourceRoleScopes` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackageResourceRoleScopes/$count` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+| `beta:GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackageResourceRoleScopes/{accessPackageResourceRoleScope-id}` | scheduled (deferred) | EXT-02 | Deferred by firstmate entitlement-management scope to a later EXT-02 entitlement-management beta subfamily: the approved v1.0 reads cover v1.0 only; beta catalogs, access packages, assignment policies and resource-role scopes need separate review. |
+
+## EXT-02 lifecycle-workflows scope decisions
+
+This change covers the twenty-four v1.0 lifecycle-workflows first-, second- and third-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, plus task-report list/show/count reads with the task and taskDefinition singles).
+Run-nested and third-level processing results, taskProcessingResults sub-reads, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six top-level summary functions, which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.
+No new commands or raw access are approved for any lifecycle-workflows row outside the twenty-four above.
+
+## Named writes
+
+Each write below runs the WRITE-00 mutation coordinator: hand-enabled profile, immutable scope, preview, explicit `--execute`, typed target confirmation for disruptive effects, durable journal intent/outcome and no replay. Inventory dispositions stay discovery-time records until a metadata refresh reviews them; the implemented review lives beside each command.
+
+| Command | Operation | Owning slice |
+|---|---|---|
+| `mg-axi entra user update` | `PATCH:/users/{user-id}` | WRITE-02 |
+| `mg-axi entra user revoke-sessions` | `POST:/users/{user-id}/revokeSignInSessions` | WRITE-03 |
+| `mg-axi entra group member add` | `POST:/groups/{group-id}/members/$ref` | WRITE-01 |
+| `mg-axi entra risky-user dismiss` | `POST:/identityProtection/riskyUsers/dismiss` | WRITE-05 |
+| `mg-axi entra conditional-access policy update` | `PATCH:/identity/conditionalAccess/policies/{conditionalAccessPolicy-id}` | WRITE-04 |
+
+Shipped initial writes: WRITE-01 (`mg-axi entra group member add`), WRITE-02 (`mg-axi entra user update`), WRITE-03 (`mg-axi entra user revoke-sessions`), WRITE-04 (`mg-axi entra conditional-access policy update`), WRITE-05 (`mg-axi entra risky-user dismiss`).
+Pending initial writes: none.
+Extended families (EXT-01 through EXT-04) and the full-Entra audit (FULL-01, COMPLETE-01) own the remaining
+scheduled rows; see docs/build-plan.md for their dispatch.