Document identity projection migration

docs/IDENTITY_MODEL.md

@@ -17,11 +17,34 @@ an account. Access can then evaluate roles, rights, delegation, and policy.
 
 ## Boundary With Organizations
 
-Organization functions and function assignments live in
-`govoplan-organizations`. Those assignments may reference identity and account
-IDs, but identity does not own organizational structure.
+Organization functions live in `govoplan-organizations`.
+Identity-to-function assignments live in `govoplan-idm`. Those assignments may
+reference identity and account IDs, but identity does not own organizational
+structure or assignment workflows.
 
 ## Boundary With IDM
 
 `govoplan-idm` imports, previews, reconciles, and applies external identity
 facts. Once accepted, normalized identity records belong here.
+
+## Access Projection Migration
+
+`govoplan-access` now prefers `identity.directory` when it needs to resolve the
+identity behind an account or render identity labels in semantic access views.
+If the identity module is not installed, Access falls back to the legacy
+`access_identities` and `access_identity_account_links` projection tables.
+
+Rollout plan:
+
+- keep the Access projection tables readable until existing installations have
+  a backfill path;
+- backfill `identity_identities` and `identity_account_links` from the Access
+  projection where Identity is newly installed on an existing deployment;
+- keep Access writes that still create local accounts able to maintain the
+  projection during the compatibility window;
+- once deployments use `identity.directory` consistently, retire direct Access
+  identity reads and leave the projection tables as migration-only data until a
+  release-level retirement plan removes them.
+
+The close-out condition is that Access works with canonical Identity installed
+and still works without it through the projection fallback.