A hierarchical namespace organizes identifiers into levels beneath a root or parent node. The name itself supports discovery when the root is known, while each node can control names beneath it without creating collisions. section 2.4.3
Hierarchical naming creates useful structure but introduces governance risks:
- It can make identities easy to locate through business units, regions, or departments. section 2.4.3
- It can encourage policies to treat organizational paths as permanent facts, even when reorganizations, mergers, or domain changes make them stale. section 2.4.3
- Poor delegation or ambiguous ownership can leave names tied to assumptions that no longer describe the identified entity. section 2.4.3
ACME employee directory
ACME could organize employees in LDAP beneath paths for business units, regions, or departments. The structure simplifies discovery, but policies depending on those paths may become incorrect after a reorganization or merger. section 2.4.3
