Hi, We're looking to tighten access controls on our Descope console and had a couple of questions: 1. SSO for console login — Is it possible to configure SSO (Google Workspace) for Descope console users (Descopers), and can roles be scoped per-project through SSO group mapping? 2. Programmatic role management — Is there an API to assign/revoke Descoper roles (specifically Project Developer) programmatically? We're looking to implement JIT access where a developer gets temporary Developer permissions on a specific project for a defined time window. 3. SSO blast radius — If we enable SSO for console access, does it have any effect on tenants or the general authentication flows configured within our projects, or is it strictly isolated to console login? 4. JIT option in SSO setup — While exploring the SSO configuration at the company level, I noticed a JIT configuration option but couldn't find any documentation on it. Could you explain what it does and whether it's relevant for managing Descoper access? Thanks!

1. Yes you can configure SSO for the Descope console and can fully control project assignment and roles via group mapping: https://docs.descope.com/management/company-settings#descoper-roles

ok thank you!