Initialize identity module

docs/IDENTITY_MODEL.md

@@ -0,0 +1,27 @@
+# Identity Model
+
+The identity model answers who the platform subject is, independent of how they
+authenticate and independent of what they may do.
+
+## Layers
+
+- Identity: a person, service, or other subject known to GovOPlaN.
+- Account link: a reference from that identity to one platform account.
+- Primary account: the account used as the default display/explainability
+  anchor when multiple accounts exist.
+
+## Boundary With Access
+
+Access owns authorization. Identity only tells access which identity is behind
+an account. Access can then evaluate roles, rights, delegation, and policy.
+
+## Boundary With Organizations
+
+Organization functions and function assignments live in
+`govoplan-organizations`. Those assignments may reference identity and account
+IDs, but identity does not own organizational structure.
+
+## Boundary With IDM
+
+`govoplan-idm` imports, previews, reconciles, and applies external identity
+facts. Once accepted, normalized identity records belong here.