Account onboarding

A tenant reaches Switchboard in two moves, and neither deploys an app.

1. The account is invited. On the switchboard app's Access tab, an operator invites the tenant's account and assigns it the Switchboard Application — the same gesture any app uses to grant any account access. Identity is Frontegg end to end; the person who accepts the invite is the tenant's first admin.

2. An AWS account is connected. Connecting an account provisions access, not infrastructure: the connection registers the account, and aws-bootstrap CI reconciles the catalog — the GitHub OIDC deploy roles, the SwitchboardAccess role Switchboard assumes, permission boundaries, artifact buckets. Switchboard reads the connection stack's outputs back on verify (provider ARN, exec roles, artifact buckets, the CodeBuild project). Git remains the authority; Switchboard never edits IAM policies directly.

Only after both does anything run: the tenant creates an environment on the connection and installs from the marketplace.

Connections are console territory — the GraphQL API behind this gateway, not the REST surface in the API reference.