tegwick 372f671eef

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

Distribute frozen federation corpus by concept destination

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b

2026-09-06 00:44:37 +02:00

14 KiB

Raw Blame History

itc-access provenance reading index

Historical input only. Current canon and ADR-006 override superseded assertions.

research/CorpusIndex.md — d110cd1f6653.
research/README.md — 1ab93b1176ac.
research/ResearchSeed.md — 1e432ff04d17.
research/authentication-federation/nist-800-63-4.md — 8697b739399c.
research/authentication-federation/oidc-core-subject-identifiers.md — e1a0bf8a2754.
research/authentication-federation/saml-nameid-federation.md — 394457cf75d2.
research/authentication-federation/shared-signals-caep-risc.md — 7303fd449a83.
research/authorization-relationships/cedar-principal-action-resource-context.md — 1932a8632dd3.
research/authorization-relationships/cerbos-abac-derived-roles.md — c35f15042d45.
research/authorization-relationships/openfga-modeling.md — e2d03ddfa7be.
research/authorization-relationships/zanzibar-rebac.md — 1f736195ab4b.
research/identity-provisioning/keycloak-organizations.md — 09c43cdc9ecf.
research/identity-provisioning/ldap-rfc4519-inetorgperson-rfc2798.md — c3f3323a3f25.
research/identity-provisioning/ory-kratos-keto.md — 5cd12c38f8d3.
research/identity-provisioning/scim-rfc7643-rfc7644.md — c5c03952ac2f.
research/identity-provisioning/zitadel-organizations-projects.md — f4b1b6f4cce3.
scenarios/ScenarioTests.md — 400641667064.
terminology/TerminologyConflictMap.md — 06c8134a399a.
terminology/TerminologyInventory.md — 5d22816b0bfe.

Shared terminology and scenario fragments

S01. Single Person With One Local Account

Frozen source: scenarios/ScenarioTests.md lines 13–24; SHA-256 0040dd866009ad1199e89f89267e3aab86894859f6ae6d07f393e4f0b8cdb6f5. Historical wording; this is not a current model definition.

## S01. Single Person With One Local Account

Expected representation: one Natural Person, one Account in an application
Scope, one local Identifier, one Profile, and one Membership or access
relationship if the account belongs to a group.

Checks:

- The person is not identical to the account.
- The profile is not the credential.
- Authorization can project the account or subject into a Principal.

Conflict: User

Frozen source: terminology/TerminologyConflictMap.md lines 6–28; SHA-256 03cc685a840d47b36bf124aa8c1465216dfcb1c463f911dbe5e934b7fa81e3b6. Historical wording; this is not a current model definition.

## Conflict: User

Problem: `user` can mean a person, account, login credential holder,
application profile, authorization subject, or product-facing actor.

Source evidence:

- SCIM User = provisionable Identity Record (`scim-rfc7643-rfc7644.md`)
- Keycloak/ZITADEL User = Account with credentials (`keycloak-organizations.md`,
  `zitadel-organizations-projects.md`)
- OpenFGA `user:` tuple prefix = Authorization Principal id (`openfga-modeling.md`)
- OIDC End-User = implied Natural Person, not modeled (`oidc-core-subject-identifiers.md`)

Canonical stance: do not use `user` as a root concept.

Current mapping rule:

- Provisioning record (SCIM/LDAP) → Identity Record
- Login-enabled product record → Account
- Public/local display → Profile
- Access evaluation → Principal or Authenticated Subject
- Human being → Natural Person

Conflict: Identity

Frozen source: terminology/TerminologyConflictMap.md lines 29–43; SHA-256 acf3297ff3ac425a535639c97c8e9368833d0e4e78225679263bcd5ab6ecbbed. Historical wording; this is not a current model definition.

## Conflict: Identity

Problem: `identity` can mean selfhood, a directory record, an issuer-bound
subject, a set of claims, a DID, a credential, a profile, or an account.

Source evidence:

- Kratos Identity = traits + credentials (`ory-kratos-keto.md`)
- OIDC developers conflate `sub` with "identity" (`oidc-core-subject-identifiers.md`)
- DID is identifier, not identity record (`did-core.md`)
- VC credentialSubject = claims about subject (`vc-data-model-2.md`)

Canonical stance: avoid bare `identity`. Prefer Identity Record, Identifier,
Claim, Credential, Profile, Persona, or Synonymity Assertion.

Conflict: Subject, Principal, Actor

Frozen source: terminology/TerminologyConflictMap.md lines 60–79; SHA-256 5f7282450703c7ab38c6d6b044bf99731c274974dd8ece1785de74bdc1365feb. Historical wording; this is not a current model definition.

## Conflict: Subject, Principal, Actor

Problem: protocols, authorization engines, and social models overload these terms.

Source evidence:

- OIDC Subject = issuer-scoped identifier (`oidc-core-subject-identifiers.md`)
- SAML Principal = authenticated subject in assertion (`saml-nameid-federation.md`)
- Cedar Principal = typed entity in authorization request (`cedar-principal-action-resource-context.md`)
- Zanzibar/OpenFGA Subject = opaque authz participant (`zanzibar-rebac.md`)
- ActivityPub Actor = server-hosted social entity (`activitypub-actors-followers.md`)
- FOAF Agent = actionable entity, includes Person (`foaf-agent-person-group-onlineaccount.md`)
- GDPR Data Subject = natural person (`gdpr-pseudonymization.md`)

Canonical stance:

- Actor = conceptual participant
- Authenticated Subject = issuer/protocol view
- Authorization Principal = decision-engine projection

Conflict: Identifier, Credential, Claim

Frozen source: terminology/TerminologyConflictMap.md lines 150–162; SHA-256 ff9f6502a126229aa65ea20817e698285a74df128aa35ea286cf24f87462216e. Historical wording; this is not a current model definition.

## Conflict: Identifier, Credential, Claim

Problem: tokens and documents bundle all three.

Source evidence:

- OIDC ID Token contains sub (identifier) and claims (`oidc-core-subject-identifiers.md`)
- VC = signed claims with proof (`vc-data-model-2.md`)
- DID verification method = cryptographic credential (`did-core.md`)
- SAML AttributeStatement = claims; NameID = identifier (`saml-nameid-federation.md`)

Canonical stance: identifier refers; credential proves; claim states.

Conflict: Synonymity, Linking, Matching, Merge

Frozen source: terminology/TerminologyConflictMap.md lines 163–177; SHA-256 a714d30d2c1bedfcfe3020fa277c5a6226ec408eebd65efc33aadcba9b825ddf. Historical wording; this is not a current model definition.

## Conflict: Synonymity, Linking, Matching, Merge

Problem: systems collapse probabilistic matches, verified links, and destructive
merges into one feature.

Source evidence:

- Probabilistic matching → weak assertion (`deterministic-vs-probabilistic-matching.md`)
- OIDC iss+sub binding → strong scoped assertion (`oidc`, `synonymity-assertions` notes)
- Schema.org sameAs = weak web equivalence (`schema-org` note)
- GDPR cross-linking raises identifiability risk (`gdpr-pseudonymization.md`)
- MDM golden record merge = downstream anti-pattern (`deterministic` note)

Canonical stance: synonymity is scoped, evidenced, revocable assertion.

Conflict: Issuer

Frozen source: terminology/TerminologyConflictMap.md lines 191–203; SHA-256 e7ca901947a8931fb1c427fa217f22bac361c15aa6c57da67580d799676980a7. Historical wording; this is not a current model definition.

## Conflict: Issuer

Problem: issuer means OIDC OP, VC issuer, SAML IdP, or CSP.

Source evidence:

- OIDC iss claim defines subject namespace (`oidc-core-subject-identifiers.md`)
- VC issuer signs credential (`vc-data-model-2.md`)
- NIST CSP performs proofing (`nist-800-63-4.md`)

Canonical stance: Issuer = Scope authority + Trust Relationship; specify protocol
role when mapping.

subject

Frozen source: terminology/TerminologyInventory.md lines 25–25; SHA-256 904b2af8c84d271ad315098c387b00d51eef6463d3d4343c16469844f65f9cd5. Historical wording; this is not a current model definition.

| subject | Authenticated Subject | OIDC, SAML, SSF events | Protocol/security view after issuer identification. Not Actor or Principal. |

principal

Frozen source: terminology/TerminologyInventory.md lines 26–26; SHA-256 3ab8b5d536f3e1da3f172f95431751a51786291480592b7e2e784338466657ba. Historical wording; this is not a current model definition.

| principal | Authorization Principal | Cedar, Cerbos, Zanzibar, OpenFGA | Decision-engine participant. OpenFGA `user:` prefix is not a human user. |

pan / cvv / chd

Frozen source: terminology/TerminologyInventory.md lines 42–42; SHA-256 84eacf96d9ff1a172086a00c1ecf31e94f5b594ee4dce3559e8ccd2525ab6b9c. Historical wording; this is not a current model definition.

| pan / cvv / chd | Out of canon | PCI DSS | Downstream PCI vault only. |

representation

Frozen source: terminology/TerminologyInventory.md lines 102–102; SHA-256 1a93d64d4e3f608806754d3889b9655d0083e2f5ce92db14780c8513fbfff419. Historical wording; this is not a current model definition.

| representation | Representation Relationship | SCIM manager, DID controller | Acting on behalf of another. DID controller may differ from subject. |

pairwise subject

Frozen source: terminology/TerminologyInventory.md lines 115–115; SHA-256 508a529137ad7a0e7f1409063b306cad3bb1f8aa1c9c15f179c21ab657f46d33. Historical wording; this is not a current model definition.

| pairwise subject | Scoped Identifier | OIDC | RP-specific sub preventing global correlation. |

relationship tuple

Frozen source: terminology/TerminologyInventory.md lines 116–116; SHA-256 3cab1bbb2dfc5afd3dcde230e104ddd95e67ccddc46fb2bbcc38f99103a55f49. Historical wording; this is not a current model definition.

| relationship tuple | Relationship Tuple | Zanzibar, OpenFGA, Keto | Authz projection: subject#relation@object. |

policy

Frozen source: terminology/TerminologyInventory.md lines 117–117; SHA-256 13bcf330fb1989abf5ba4d7c673d2c3a646480236f81792abadb74afa660b983. Historical wording; this is not a current model definition.

| policy | Authorization Projection | Cedar, Cerbos | Rule artifact; downstream of canon model. |

holder

Frozen source: terminology/TerminologyInventory.md lines 128–128; SHA-256 1e57bb144bb8a072a4180be14a8a91f8126c4f958397a8fd62e12c63db8806b6. Historical wording; this is not a current model definition.

| holder | Actor (custody role) | VC, OpenID4VC | Party possessing VC; may differ from subject. |

data subject

Frozen source: terminology/TerminologyInventory.md lines 132–132; SHA-256 2aae43d6df259e4678d0a2d27fcf4efd546ecd99201d1a3e573cef845e78a822. Historical wording; this is not a current model definition.

| data subject | Natural Person | GDPR | Identifiable natural person for privacy regulation. |

tuple (authz)

Frozen source: terminology/TerminologyInventory.md lines 135–135; SHA-256 89a5e53a0468189c92022352aac36ccf34b62a8a34b49c13241eb5fa91aa830c. Historical wording; this is not a current model definition.

| tuple (authz) | Relationship Tuple | Zanzibar | Authorization fact, not social relationship. |

userset

Frozen source: terminology/TerminologyInventory.md lines 136–136; SHA-256 6ad9832f81b69b4e039e5bb2c0e8751894d408412f573668619adfa74cde2e8c. Historical wording; this is not a current model definition.

| userset | Authorization Principal (indirect) | Zanzibar, OpenFGA | Subject referenced via relation chain. |

contextual tuple

Frozen source: terminology/TerminologyInventory.md lines 138–138; SHA-256 5b1c5f8c2795fc54d61f319bd4c6238538588fa4026e779d0ed615e998133218. Historical wording; this is not a current model definition.

| contextual tuple | Delegation context | OpenFGA | Ephemeral authz fact at check time. |

14 KiB Raw Blame History Unescape Escape