# Identity Model

The identity model answers who the platform subject is, independent of how they
authenticate and independent of what they may do.

## Layers

- Identity: a person, service, or other subject known to GovOPlaN.
- Account link: a reference from that identity to one platform account.
- Primary account: the account used as the default display/explainability
  anchor when multiple accounts exist.

## Boundary With Access

Access owns authorization. Identity only tells access which identity is behind
an account. Access can then evaluate roles, rights, delegation, and policy.

## Boundary With Organizations

Organization functions live in `govoplan-organizations`.
Identity-to-function assignments live in `govoplan-idm`. Those assignments may
reference identity and account IDs, but identity does not own organizational
structure or assignment workflows.

## Boundary With IDM

`govoplan-idm` imports, previews, reconciles, and applies external identity
facts. Once accepted, normalized identity records belong here.

## Access Projection Migration

`govoplan-access` now prefers `identity.directory` when it needs to resolve the
identity behind an account or render identity labels in semantic access views.
If the identity module is not installed, Access falls back to the legacy
`access_identities` and `access_identity_account_links` projection tables.

Rollout plan:

- keep the Access projection tables readable until existing installations have
  a backfill path;
- backfill `identity_identities` and `identity_account_links` from the Access
  projection where Identity is newly installed on an existing deployment;
- keep Access writes that still create local accounts able to maintain the
  projection during the compatibility window;
- once deployments use `identity.directory` consistently, retire direct Access
  identity reads and leave the projection tables as migration-only data until a
  release-level retirement plan removes them.

The close-out condition is that Access works with canonical Identity installed
and still works without it through the projection fallback.