<!-- TIER:1 -- Managing End Users An end user is a person's access record for MCP servers only : they sign in to the account's MCP servers through Celigo OAuth (routed to the company's identity provider where one is set up) and get no workspace access. What each one may call is the union of their grants -- direct, through groups, through roles, and through capability sets. Concerns when managing end users: - Records -- invite, accept, revoke; identity-provider provisioning (JIT, SCIM); suspending - Grants -- capability strings per MCP server, on a person, a group, or a role - Groups and roles…