# Identity destination boundary review — 2026-09-05

Authority: accepted CUST-ADR-006 decision 4 and R1/R2/R4; implementation review by
Codex under CFED-WP-0001-T05. No accepted owner assignment is changed.

| Overlap | Evidence | Resolution |
| --- | --- | --- |
| Delegation Relationship / Delegation | Donor: bounded authority grant. Organization §10.18: bounded responsibility or authority grant/transfer, with scope and revocation attributes. | Consolidate into identity's ledger-assigned Delegation Relationship, preserving broader incumbent semantics and the Delegation compatibility name. Organization imports at its old section anchor. Actor/Responsibility/Authority remain organization-owned. |
| Identifier | Information Space §11.37 defines a generic stable artifact/entity reference. ADR decision 4 assigns Identifier to identity. | Identity owns the general definition; Information Space retains an import and its artifact-specific recommendations. |
| Profile | Identity describes an actor/account; Observability §11.36 describes runtime performance. | Distinct qualified concepts; add disambiguation rather than transfer performance-profile ownership. |
| Relationship | Identity actor-linking assertion versus Core RelationshipDefinition and general graph mechanisms. | Scope the identity taxonomy explicitly; no universal relationship ownership claim. |
| Assurance Level | Proofing/authentication/federation confidence versus governance assurance cases. | Keep dimensions separate and retain the R2 distinction. |
| Credential | Identity proof material versus Access Control CredentialReference and Security misuse/exposure analysis. | Identity owns Credential; retain the narrower references and security analysis upstream. |

G4 review: the identity owned_concepts list contains none of Actor, Person, Agent,
Organization, Group, Role, Membership, Subject, Principal, Relationship Tuple,
ResourceScope, CredentialReference, Responsibility, Authority or Ownership.
Organization no longer defines Delegation; its retained anchor imports the single
identity definition. Thus the previously recorded delegation publication
prerequisite is resolved by executing accepted ownership, without an ADR amendment.

## Reciprocal model imports

Identity imports Actor/Authority from Organization and Subject/Principal from
Access Control. Organization imports Delegation Relationship from identity;
Access Control imports identity records and credentials. Access Control also already imports Organization. These five document
edges form one reciprocal component; their concept ownership remains disjoint.
Information Space imports Identifier but identity does not depend on that model.

The artifact graph and raw consistency_cycles metric retain this component.
validation/model-import-reviews.yaml admits only its exact five `uses` edges,
with this rationale. Added internal edges, new component members, non-import
edge types or any additional cycle fail the ordinary zero-cycle check. This is
an explicit bounded exception to document-level acyclicity, not permission for
circular concept definitions. INFO-WP-0021 owns the validation change and tests.