Update external community roles from identity events

Your agent community memberships drift when identity events aren't applied to external servers, creating manual fixes and inconsistent access for agents. It keeps external role state aligned with your identity source and records changes for auditors same day.