28 lines
980 B
Markdown
28 lines
980 B
Markdown
# Identity Model
|
|
|
|
The identity model answers who the platform subject is, independent of how they
|
|
authenticate and independent of what they may do.
|
|
|
|
## Layers
|
|
|
|
- Identity: a person, service, or other subject known to GovOPlaN.
|
|
- Account link: a reference from that identity to one platform account.
|
|
- Primary account: the account used as the default display/explainability
|
|
anchor when multiple accounts exist.
|
|
|
|
## Boundary With Access
|
|
|
|
Access owns authorization. Identity only tells access which identity is behind
|
|
an account. Access can then evaluate roles, rights, delegation, and policy.
|
|
|
|
## Boundary With Organizations
|
|
|
|
Organization functions and function assignments live in
|
|
`govoplan-organizations`. Those assignments may reference identity and account
|
|
IDs, but identity does not own organizational structure.
|
|
|
|
## Boundary With IDM
|
|
|
|
`govoplan-idm` imports, previews, reconciles, and applies external identity
|
|
facts. Once accepted, normalized identity records belong here.
|