A centralized namespace is maintained by one organization that ensures identifier uniqueness within its authority. It is easy to implement, but its names are not easily portable. section 2.4.3
Centralized namespaces shape identity and authorization in several ways:
- Provide stable identifiers for entities such as employees, supporting policies that require unambiguous and trustworthy names. section 2.4.3
- Create dependency on the issuing organization; portability becomes difficult when identities move between authorities. section 2.4.3
- Require careful lifecycle governance because reusing an identifier can redirect old policies, audit records, or entitlements to a different person. section 2.4.3
Employee numbers at ACME
An HR system assigns every employee a unique employee number and never reuses it. Reusing a departed employee’s number could cause an old entitlement or audit record to be associated with the wrong employee. section 2.4.3
