OIM KB Update — Run 2026-04-27 (6)

Focus: clarify “service categories” + product metadata vs. entitlement IT Shop flags, with concrete live DB + shipped-script evidence.

No sandbox mutations were performed in this run (SELECT-only DB work + WinRM file inspection).

What changed in understanding (new findings)

“Service categories” map cleanly to dbo.AccProductGroup:
AccProduct.UID_AccProductGroup is nullable (optional categorization).
AccProductGroup.FullPath is the hierarchical category path (e.g. Active Directory Groups\\Security Groups).
dbo.AccProduct has no IsForITShop / IsITShopOnly flags in this sandbox schema:
The product-level visibility flag is AccProduct.IsToHideFromITShop (default 0 in shipped table definitions).
Requestability is governed by entitlement-type flags (IsForITShop / IsITShopOnly) and by placement (BaseTree PR nodes + BaseTreeHas<type> assignment tables).
Evidence hygiene: the sandbox evidence note had a few stale column names (e.g. DisplayName, UID_BaseTree) from earlier mental models; these have been corrected to match the actual OneIM schema.

Evidence notes updated

Live DB evidence (fixed SQL + added outputs): projects/identity-management/oim-kb-update/sandbox-db/2026-04-27-itshop-availability-db-evidence.md
Sandbox host evidence (added shipped-schema hints for IsToHideFromITShop + AccProductGroup collection): projects/identity-management/oim-kb-update/sandbox-host/2026-04-27-itshop-file-hints.md
Knowledge base note (clarified service categories + product hide flag): projects/identity-management/knowledge-base/oim-it-shop-structure-and-availability.md

Next questions / experiments

1. Verify how IsToHideFromITShop affects portal visibility for a PR node that already exists (does it hide the PR node, or only affect product search/category pages?).

2. Identify whether AccProductGroup is ever required (supported-path) for automatic shelf assignment / publishing, or whether it is purely grouping/metadata.