Skip to content

Identity and Access Architecture

Why this chapter matters

Identity and access answer two different questions: who or what is present, and what may it do. This chapter keeps authentication from becoming authority and gives both humans and AI readers a durable map of least privilege, revocation, and accountability.

Continue to Backup, Restoration, and Continuity Architecture to see how identity survives failure.

Defines implementation-neutral identity, authentication, authorisation, delegation, revocation, and review boundaries.

  • INFRA6-R001: Every identity SHALL have an owner, purpose, scope, lifecycle, authentication basis, and revocation condition.
  • INFRA6-R002: Access SHALL be least-privilege, purpose-bound, attributable, time-bounded where practicable, and independently reviewable.
  • INFRA6-R003: Delegation SHALL preserve grantor, delegate, scope, expiry, constraints, and revocation evidence.
  • INFRA6-R004: Authentication or access success SHALL not itself create authority, consent, or constitutional standing.
  • INFRA6-R005: Access design SHALL record grantor, delegate, purpose, scope, authentication basis, expiry, revocation, use, and review evidence.
  • INFRA6-R006: Recovery SHALL preserve identity uncertainty, separate proofing from access restoration, and require accountable review for exceptional paths.
  • INFRA6-R007: Access review SHALL test dormant, shared, excessive, transitive, emergency, and unexplained use against the current grant.
  • INFRA6-R008: An identity design SHALL NOT issue credentials or operate live authentication, authorisation, delegation, or revocation services.

This Draft excludes credentials, keys, and live identity services.

Lifecycle method

Identity design shall cover creation, proofing, authentication, delegation, use, suspension, revocation, recovery, and archival evidence. Access reviews shall compare actual use with intended purpose and shall investigate dormant, shared, excessive, or unexplained access.

Failure cases

Impersonation, replay, stale grants, privilege accumulation, shared accounts, recovery coercion, and revocation delay are material failures. Unknown identity or scope shall deny or contain access pending accountable review.

Operating model and evidence

Identity architecture separates subject identity, authentication evidence, authorisation, delegation, use, revocation, recovery, and archival evidence. Every grant has a purpose, scope, owner, effective interval, constraints, and review route. Authentication proves a property of a session or subject; it does not decide what the subject may do.

Reviewers compare intended grants with actual use and test recovery coercion, replay, privilege accumulation, shared accounts, stale grants, revocation delay, and emergency access. Exceptional access is narrow, attributable, time-bounded, and retrospectively reviewed. Uncertain identity or scope denies or contains access pending accountable review.

Interpretation cases

  • Conforming: Identity, grant, purpose, scope, use, delegation, revocation, recovery, and review are linked.
  • Prohibited: Authentication success creates authority or consent.
  • Boundary: Recovery restores only the smallest verified access scope.
  • Failure: Replay, stale grant, or revocation delay causes containment and evidence preservation.
  • Loophole: Emergency or delegated access becomes permanent through repeated renewal.
  • Misuse: Access records expose credentials or private identity beyond purpose.
  • Care-control: Protective access supports safety while preserving notice, agency, and review.

Design evidence

Identity review should trace proofing, authentication, grant, use, delegation, revocation, recovery, and archival events to an owner and purpose. Shared or unexplained access is a review finding even where no misuse is observed.