{"slug":"development/contracts/identity","title":"Identity & One Access","section":"development","sectionLabel":"Development","status":"unclassified","type":"document","path":"development/contracts/identity.md","bytes":926,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"<!-- DOCUMENT CLASS: DEVELOPMENT | SOURCE: 25_IDENTITY_ONE_ACCESS.md -->\n\n# Identity & One Access\n\n## Purpose\n\nOne Access is the identity entry layer for the IntegrateWise ecosystem.\n\n## Identity hierarchy\n\n```text\nPrincipal\n→ Tenant\n→ Organization\n→ User\n→ Role\n→ Permission\n→ Authority\n```\n\n## Identity types\n\n```text\nHuman User\nService Identity\nAgent Identity\nExternal Agent Identity\nSystem Identity\n```\n\n## Authentication\n\nAuthentication establishes who/what is acting.\n\n## Authorization\n\nAuthorization establishes what that principal may see/do.\n\n## Provider auth\n\nProvider OAuth/API credentials are separate from IntegrateWise identity.\n\n## Boundary\n\n```text\nIdentity\n≠\nProvider Credential\n≠\nAuthority\n≠\nCapability\n```\n\n## Required properties\n\n- tenant isolation;\n- scoped sessions;\n- auditable principals;\n- token expiry;\n- least privilege;\n- service identity separation;\n- agent identity separation.\n"}