# What is built

A feature not built yet is `toolchain.not_built_yet` where it is written.

| Feature | Status |
|---|---|
| Everything else on this page | Built. |
| `sign_in:`'s `providers:` and `oauth_provider:`, and `on_first_sign_in:` for provider and external-token sign-in | Not built yet. An external token's subject that no user has is `sign_in_refused` (403). |
| Scope declarations and policy's scope restrictions | Not built yet. As [Policy](policy.md) specifies, an external method narrows scopes only when it declares the scopes it reads; undeclared provider scope or profile claims never replace application authority. |
| A setting loosened past its limit | Not built yet: waits on [acceptances](acceptances.md). |
| OAuth grants: `OAuthGrant` credentials, the connecting and disconnecting routes and `on_behalf_of:` ([Integrations](external-services.md)) | Not built yet. `Driver.oidc` for Google and Microsoft sign-in comes with providers. |