Provider declared.

Invalid config.

Missing or invalid JWT.

Tenant mismatch, missing scope, or the caller is acting under a support-access impersonation session (impersonation-operation-forbidden). The last is a DISTINCT cause and not an authorization failure — the operator holds admin.tenant.idp.override and is inside the tenant boundary. Declaring a provider admits an operator-controlled authentication path into the tenant and accepts its client secret, which is strictly more durable than any single credential and outlives the consent window. It binds on SaaS deployments only (PRD §148). Branch on type, not on the status.

A provider of this kind already exists.