info-tech-canon/infospace/models/identity/boundary-review.md

Identity destination boundary review — 2026-09-05

Authority: accepted CUST-ADR-006 decision 4 and R1/R2/R4; implementation review by Codex under CFED-WP-0001-T05. No accepted owner assignment is changed.

Overlap	Evidence	Resolution
Delegation Relationship / Delegation	Donor: bounded authority grant. Organization §10.18: bounded responsibility or authority grant/transfer, with scope and revocation attributes.	Consolidate into identity's ledger-assigned Delegation Relationship, preserving broader incumbent semantics and the Delegation compatibility name. Organization imports at its old section anchor. Actor/Responsibility/Authority remain organization-owned.
Identifier	Information Space §11.37 defines a generic stable artifact/entity reference. ADR decision 4 assigns Identifier to identity.	Identity owns the general definition; Information Space retains an import and its artifact-specific recommendations.
Profile	Identity describes an actor/account; Observability §11.36 describes runtime performance.	Distinct qualified concepts; add disambiguation rather than transfer performance-profile ownership.
Relationship	Identity actor-linking assertion versus Core RelationshipDefinition and general graph mechanisms.	Scope the identity taxonomy explicitly; no universal relationship ownership claim.
Assurance Level	Proofing/authentication/federation confidence versus governance assurance cases.	Keep dimensions separate and retain the R2 distinction.
Credential	Identity proof material versus Access Control CredentialReference and Security misuse/exposure analysis.	Identity owns Credential; retain the narrower references and security analysis upstream.

G4 review: the identity owned_concepts list contains none of Actor, Person, Agent, Organization, Group, Role, Membership, Subject, Principal, Relationship Tuple, ResourceScope, CredentialReference, Responsibility, Authority or Ownership. Organization no longer defines Delegation; its retained anchor imports the single identity definition. Thus the previously recorded delegation publication prerequisite is resolved by executing accepted ownership, without an ADR amendment.

Reciprocal model imports

Identity imports Actor/Authority from Organization and Subject/Principal from Access Control. Organization imports Delegation Relationship from identity; Access Control imports identity records and credentials. Access Control also already imports Organization. These five document edges form one reciprocal component; their concept ownership remains disjoint. Information Space imports Identifier but identity does not depend on that model.

The artifact graph and raw consistency_cycles metric retain this component. validation/model-import-reviews.yaml admits only its exact five uses edges, with this rationale. Added internal edges, new component members, non-import edge types or any additional cycle fail the ordinary zero-cycle check. This is an explicit bounded exception to document-level acyclicity, not permission for circular concept definitions. INFO-WP-0021 owns the validation change and tests.