Discuss a subsystem

Identity & Access Control

Let users and organizations authenticate, manage identities, and enforce permissions.

Implement this subsystem

Identities & Sessions

These entities establish who an actor is, and how long that answer can be trusted.

Entities

User: A person with an account in the application.
External Identity: A link between a user and their account at an identity provider.
Credential: A secret or key used to authenticate, such as a password hash or passkey.
Authentication Factor: A method used to prove identity, such as a passkey or authenticator app.
Session: A period of authenticated access following a sign-in.

Model

Rendering diagram…

Diagram source

erDiagram
  USER ||--o{ EXTERNAL_IDENTITY : linked_to
  USER ||--o{ CREDENTIAL : proves_with
  USER ||--o{ AUTHENTICATION_FACTOR : enrolls
  USER ||--o{ SESSION : signs_in_as

Key Rules

A user is independent of how they sign in. One user can have several identities and factors, so sign-in methods can change without creating a new account.
Credentials are never stored in recoverable form. Passwords are hashed with a memory-hard function, and passkeys store only public keys.
Sessions can be revoked. Each session can be ended individually, and when credentials change.

Implementation

Implement this subsystem

Implementation starts with technical scoping. We review your existing architecture, agree on boundaries, interfaces, and acceptance criteria, and adapt this design to fit before committing to delivery milestones.

There is no off-the-shelf package or fixed price: scope, timeline, and cost follow from that alignment.

Implement this subsystem