Vord

Architecture Decision Record

0030. Identity governance (IGA) model

Context

Workforce buyers (Okta / Entra territory) expect identity governance: access requests + approvals, periodic access certification / review, entitlement management, separation-of-duties (SoD), and just-in-time privileged access. This is a large subsystem; the decision here is the model and how it fits, not every feature — so that IGA does not become a parallel stack (rule 4).

Decision

  1. IGA is built on existing primitives, not a second system. Access is Forseti relations (ADR-0006); requests / approvals / reviews are workflows over the event stream (ADR-0022) and the admin API (ADR-0021); entitlements are relation/role definitions; SoD is a Forseti policy constraint (mutually-exclusive relations); JIT privileged access is a time-boxed relation grant — a grant with an expiry. Because the grant lives in the Forseti relation store, its read-your-writes fence is the composite token's Forseti component (ADR-0026 — not the Wyrd fence of ADR-0004), and its expiry is a relation-store deletion, not a token-status-list entry: tokens already minted stay valid to their short TTL, and the next authorization check simply no longer finds the relation. Grant expiry is reserved in the Authorizer seam (ADR-0006) so the engine pick at M3 must support it natively.

  2. Access certification is a scheduled review workflow: a reviewer attests to a principal's entitlements; un-attested access is flagged and revoked. It is a projection + workflow over the relation graph and the event stream, not a new store.

  3. Audit-grade by construction (ADR-0022): every grant, request, approval, expiry, and review is an event — the audit trail governance buyers require falls out of the event stream.

  4. It is a post-v1 layer. This ADR records that IGA fits (Forseti + events + admin) so nothing in the core blocks it; the feature build is a Step-3+ concern, with detailed capabilities (the request portal, the certification campaigns, the SoD rule catalog) as later proposals.

Consequences

  • Governance is a layer on the differentiator (relations + events), not a parallel authorization system — the rule-4 discipline that keeps the core from sprawling.
  • SoD, JIT-privileged-access, and certification reduce to relation constraints + time-boxed grants + review workflows — no new mechanism, just compositions of ADR-0006 / ADR-0026 / ADR-0022.
  • Because access and its history are already relations and events, "who has access to what, and why, and who approved it" is answerable without bolting on a governance database.
  • Sequenced post-v1; the model is fixed now so the workforce governance story is credible and the later proposals have a frame.