Identity & Access Control

The Identity & Access Control subsystem maintains interconnected entities representing users, organizations, permissions, enterprise connections, machine access, and security activity.

The names vary between platforms, but the concepts recur. This section describes a representative model, divided into six subdomains.

Entity Map

flowchart TB
  identities["Identities & Sessions"] -->|"join"| organizations["Organizations & Memberships"]
  organizations -->|"assignments"| authorization["Roles & Permissions"]
  enterprise["Enterprise Connections"] -->|"sign-in and provisioning"| identities
  enterprise -->|"group mappings"| organizations
  machines["Machine Access"] -->|"scopes"| authorization
  identities -->|"authentication events"| audit["Audit & Security"]
  authorization -->|"access decisions"| audit
  machines -->|"credential activity"| audit

Subdomains

• Identities & Sessions: Users, external identities, credentials, authentication factors, and sessions.
• Organizations & Memberships: Organizations, memberships, teams, invitations, and verified domains.
• Roles & Permissions: Roles, permissions, role assignments, policies, resources, and relationships.
• Enterprise Connections: SSO connections, directory connections, provisioned users, and group mappings.
• Machine Access: Service accounts, API keys, OAuth clients, scoped tokens, and delegated grants.
• Audit & Security: Authentication events, audit events, risk signals, and access reviews.