Know who or what is acting, and what authority actually applies.
Digital identity connects authoritative subject records, authentication state, entitlements, delegated authority, policy and access decisions while keeping expiry, revocation, exceptions and evidence visible.
Approve payment PAY-5521
Denied · entitlement expiredSeven requests. Five checks. One honest decision each.
Denied, review, expired, revoked, stale and unknown are first-class outcomes, never hidden behind “authorized”.
Start with your question
Every identity problem is really one of these eight questions. Pick yours and jump straight to the answer.
Which system is authoritative for this person, service or external actor?
What does the responsible system currently say about authentication?
What role, permission or resource entitlement applies?
How can bounded authority be granted and revoked?
Why is access allowed, denied, review-required or step-up?
What changes when authority expires, is revoked or goes stale?
Who is an agent acting for, and with what authority?
How do apps consume approved identity and access state?
One authority chain. Seven links. Any link can break.
Each link is kept separate on purpose, because each one can fail, expire or be unknown on its own.
Subject
Who or what is acting?
Identity source
Which system owns identity truth?
Authentication
Has authentication been established?
Entitlement
What access is currently granted?
Delegation
Is the actor acting under delegation?
Policy & context
What policy and context apply?
Decision & evidence
What is the decision, and can it be explained?
Watch a single payment approval travel the chain
S-0991 tries to approve payment PAY-5521. Each step below shows what the responsible system knows, and where the request stops.
The identity points back to the system that owns it
A stable subject reference, its type, its authoritative source and owner, and how fresh that source is.
Identity subject
SPECIMEN · SYNTHETIC DATAAuthentication is a state, not a method we invent
No method names, assurance scores or device fingerprinting unless current documentation defines them.
The responsible system says so, with time and source.
No current authentication from the source.
A further step is required before deciding.
Authentication validity has passed.
A person must look before access proceeds.
Source unavailable or silent; never upgraded to authorized.
What access exists, where it came from, when it ends
Roles appear only where the source defines them. Exceptional access is explicit, scoped, time-bounded and reviewable.
Effective entitlements · S-1042
SPECIMEN · SYNTHETIC DATABorrowed authority, with an owner and an end date
Who delegated, to whom or what, for which scope, under which policy, for how long, and how it is revoked.
Delegated authority · DLG-208
SPECIMEN · SYNTHETIC DATAPolicy meets context, and the decision explains itself
Allow, deny, review-required, step-up-required or unknown, each with a safe reason and an owner who can resolve it.
Access decision · DEC-3310
SPECIMEN · SYNTHETIC DATAEvidence that proves why access was refused
Identity, authentication, entitlement, delegation, decision and lifecycle evidence, linked and timestamped.
Decision provenance · DEC-3310
SPECIMEN · SYNTHETIC DATA
Authority has seasons. Every one of them is visible.
Anything expired, revoked or stale fails closed. Reinforcement always needs fresh confirmation from the source.
No access before activation.
Source-backed current authority.
Downstream decisions refresh.
Dependent access blocked or reviewed.
Never treated as current.
Blocked; revocation evidence kept.
Meet the cast of subjects
Five kinds of actor, each handled at source-backed abstraction, and each with a clear note on what we will not assume.
Person
Subject reference, source, authentication, entitlement and delegation state.
Service / machine
Workload or system actor with an owner and scoped authority.
Organization
Tenant or legal-entity reference where the product needs it.
External actor / guest
External source, sponsor, scope, expiry and review route.
Agent / automation
Agent identity tied to a principal and delegated authority.
Make identity and authority clear before access is granted.
Talk with Zoiko Tech about the people, services, external actors or agents you need to identify; the systems that own identity and entitlement; the delegation and access decisions that matter; and the security, privacy and regulatory boundaries that must remain visible.
