Identity is what allows a digital system to recognize, remember, and relate to a person, organization, device, service, or other entity. It can be understood as a bundle of attributes or as an underlying entity represented through those attributes. In practice, the useful question is which entity a system recognizes and what relationship that recognition supports. section 2.0 section 2.1
Identity systems manage relationships rather than merely storing accounts or enabling login. Employee, customer, partner, device, service, and agent relationships may require different identity systems, expectations, and authorities. Their quality directly affects security, personalization, privacy, and access control. section 2.1 section 2.8
A useful identity system provides:
- Integrity: recognizing the same entity consistently across interactions. section 2.3.2
- Lifespan: managing account creation, use, and deletion. section 2.3.2
- Utility: making entity information available to systems that need it for access decisions and other interactions. section 2.3.2
Recognition at a café
A barista recognizes a regular customer through memory, repeated interaction, and trust. A self-service kiosk instead recognizes an account through an identifier and stored attributes. The contrast shows why digital identity is more than a username: it represents how a system recognizes and relates to an entity. section 2.0
Identity as authorization input
Authorization policies depend on reliable information about principals, subjects, relationships, attributes, and context. Stolen vendor credentials in the Target breach caused the system to recognize an attacker as a trusted third party, demonstrating that weak identity can defeat otherwise sound access policies. section 2.3.2 section 2.8
Figure 3.1 Relationships among key identity concepts used in authentication and authorization. A principal (an actor such as a user or service) controls an identifier that uniquely identifies an account. The account stores attributes about a subject, which might be the principal itself or another entity the principal manages.
Use the relationship diagram to distinguish a principal, identifier, account, subject, and the attributes associated with an entity. section 3.1
