Identity
Who a user is, how they prove it, and what a session is allowed to do.
For whoever answers the question "who did this, and was that person allowed to?" — a security officer, an auditor, or the operator who has to enrol people and machines.
After reading it you can trust an issuer, enrol a person, read what a proof of identity is worth, and take one back.
Before you start: nothing installed. The last page is the one to read first if your job is to find the gap rather than to build the chain.
Every act this product records names an actor, and an actor is always a person or a program acting for a person — there is no third kind. Before either can act, two things have to be true, and each one is a deliberate act by a human being: somebody has to have trusted the server that issues proofs of identity, and somebody has to have enrolled the person a proof names. Only then does a proof mean anything, and what it means is narrow: it says who signed in, which one service it may be spent at, and for how long. It never says what that person is allowed to do.
This section tells that story in the order a reader meets it, and it closes with what identity does not establish — because most of the expensive mistakes on this subject come from reading a proof of identity as a grant of authority.
| Page | What it answers |
|---|---|
| What an actor is | Who can act at all, what has to be true before they can, and what an actor's name in the record is worth. |
| How a person signs in | The sign-in surface, the five acts of an account's life, what a refusal means, and what is counted for billing. |
| What a token carries, and how long it lives | What a program is given, the four lifetimes, the approval a person presses, and how a person takes it back. |
| Trusting an issuer | The act performed by hand on the machine holding the root key, the four values it turns on, and the mistakes that surface months later. |
| A seat's credential to its AI provider | The second thing the word seat means, why that credential dies, and the one failure it is most often confused with. |
| What identity does not establish | The limits of everything above, in one place, because each of them is a mistake somebody has already made. |
⚠ The word seat carries two meanings in this product, and both are in this section. On the authorization server a seat is one person's account — the thing you invite, list and revoke. On a machine that runs work, a seat is a named worker identity with its own profile directory on that host. The first five pages below mean the first sense unless they say otherwise; A seat's credential to its AI provider is the one page about the second, and it opens by saying so.
What this section does not cover
⚠ Identity is not authorization, and this section is only the first half. What an actor is allowed to DO lives in Actors and roles and in the permission classes described under Configuration. ⚠ The authorization server itself is not delivered by any release artifact — see Central servers before you plan a deployment around it.