Provider activated.

Missing or invalid JWT.

Tenant mismatch, missing scope, or the caller is acting under a support-access impersonation session (impersonation-operation-forbidden). The last is a DISTINCT cause and not an authorization failure — the operator holds admin.tenant.idp.override and is inside the tenant boundary. Enabling turns a declared provider into a LIVE authentication path that outlives the consent window; declare and enable are denied together, because denying only one leaves the other as the reachable half. It binds on SaaS deployments only (PRD §148). Branch on type, not on the status.

Not found.

No passing self-test.