govoplan-identity/docs/IDENTITY_MODEL.md

Identity Model

The identity model answers who the platform subject is, independent of how they authenticate and independent of what they may do.

Layers

• Identity: a person, service, or other subject known to GovOPlaN.
• Account link: a reference from that identity to one platform account.
• Primary account: the account used as the default display/explainability anchor when multiple accounts exist.

Boundary With Access

Access owns authorization. Identity only tells access which identity is behind an account. Access can then evaluate roles, rights, delegation, and policy.

Boundary With Organizations

Organization functions and function assignments live in govoplan-organizations. Those assignments may reference identity and account IDs, but identity does not own organizational structure.

Boundary With IDM

govoplan-idm imports, previews, reconciles, and applies external identity facts. Once accepted, normalized identity records belong here.