What it means
It connects authoritative sources, identity proofing, identifiers, credentials, federation, policy decision points, privileged access, lifecycle events, and evidence.
Why it matters
Identity is a control plane for modern systems. Fragmented architecture creates orphan access, inconsistent assurance, excessive privilege, and weak accountability.
Practical focus
- Define identity types and authoritative sources
- Choose assurance appropriate to the transaction and risk
- Separate authentication, authorization, and governance decisions
- Design lifecycle, recovery, federation, and audit together
Common mistakes
- Designing only for workforce users
- Treating SSO as complete identity governance
- Ignoring non-human identities
- Allowing local exceptions to bypass lifecycle controls
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: