Oh god, I have stumbled into acronym land. SCIM — System for Cross-domain Identity Management. And I think I do need to dig into it more, as I try to atproto -> OIDC -> users and groups -> gating mixed resources.