# FixedAtCreation

An Organization differs from its resource in FIPS mode, which is fixed at creation; it is Ready=False, Error, and nothing is written.

## Meaning

An organization already holds the resource's slug and runs with a `fipsMode` other than
`spec.fipsMode`. FIPS mode cannot change after an organization is created, so the operator
writes none of the resource's settings and reports the difference. The message names both
values. `spec.fipsMode` is immutable on the resource too.

## Impact

The platform team's declared tenant settings (display name, FAPI mode, branding, second
factor, network zones) are not applied. The organization keeps serving its users as it is.

## Diagnosis

1. `kubectl describe organization <name>` for both values.
2. The organization's settings in the admin dashboard or admin API, and its
   `organization.created` audit record for who created it with which mode.

## Mitigation

- If the existing organization is right, delete the resource and apply it again with the
  matching `spec.fipsMode`. Deleting it removes nothing on the server, since it never
  adopted the organization.
- If the resource is right, use another slug; the existing organization is not converted.

## Escalation

Choosing a FIPS mode for a tenant is a compliance decision: escalate to the owner of the
identity platform before recreating either side.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.