Namespace management specifies how names are structured, assigned, scoped, and resolved so identifiers remain stable, unambiguous, discoverable, and trustworthy. These properties directly affect authorization: unclear boundaries can cause policies to confuse employees, contractors, customers, and service accounts. section 2.4.3
Common namespace structures include:
- Centralized namespaces assign unique identifiers through one organization. They are easy to implement but can become nonportable and brittle when tied to one authority. section 2.4.3
- Hierarchical namespaces organize names beneath a known root. They support discovery and allow local control without creating collisions; DNS, X.509 certificates, and LDAP are examples. section 2.4.3
Employee identifiers
An HR system might assign every employee a unique employee number and never reuse it. Reusing a former employee’s number could attach old policies, audit records, or entitlements to a different person. section 2.4.3
