> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines.md).

# Operational Guidelines

### Table of Contents

* [Overview](#overview)
  * [Operational Model](#operational-model)
* [User Directory Management](/operational-guidelines/user-directory-management.md)
  * [User Enrollment in Authentik](/operational-guidelines/user-directory-management/user-enrolment-in-authentik.md)
    * [Create Invitation](/operational-guidelines/user-directory-management/user-enrolment-in-authentik/create-an-invitation.md)
  * [User Group Management](/operational-guidelines/user-directory-management/user-group-management.md)
    * [Create Admin User Group](/operational-guidelines/user-directory-management/user-group-management/create-admin-user-group.md)
    * [Modify User Group](/operational-guidelines/user-directory-management/user-group-management/assign-user-to-group.md)
    * [Delete User Group](/operational-guidelines/user-directory-management/user-group-management/delete-user-group.md)
  * [Modify User Claim Values](/operational-guidelines/user-directory-management/modify-user-claim-values.md)
  * [Updating User Password](/operational-guidelines/user-directory-management/updating-user-password.md)
  * [User Deactivation](/operational-guidelines/user-directory-management/user-deactivation.md)
  * [User Removal](/operational-guidelines/user-directory-management/user-removal.md)

***

This section depicts operational procedures for user directory administration and federated authentication in the Ocean Enterprise User Management deployment.

The supplied Authentik configuration uses:

* Data Space Operator Authentik as the central identity provider and identity broker;
* Data Space Participant Authentik as the Participant identity provider;
* invitation-based local user enrollment;
* a custom recovery flow for password updates;
* OE-specific user attributes and OAuth scope mappings;
* OIDC federation between Participant and Operator Authentik instances;
* JIT creation of a local shadow user on the Data Space Operator for federated identities.

The repository provisions the required Authentik flows, stages, mappings and providers. Routine lifecycle operations such as creating groups, changing group membership, deactivating a user or deleting a user are performed through the Authentik administration interface and are not automated by repository scripts.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.oceanenterprise.io/operational-guidelines.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.