Vord

Enhancement Proposal

Proposal: Self-service account management

CIAM at millions of users cannot route every profile edit through an admin; users must self-serve. This specs the self-service surface on the existing directory (ADR-0011), session (ADR-0016), revocation (ADR-0005), and event (ADR-0022) seams — no new architecture. One piece, data erasure, depends on the open privacy ADR (§12.8) and is deliberately scoped to the request/flow here, not the erasure mechanism.

Motivation

End-users expect to manage their own account; workforce users expect to manage their MFA and sessions. None of it exists today, and at CIAM scale admin-only management does not work.

Design

A self-service surface (hosted, proposal 0007; via OIDC-authenticated APIs):

  • Profile view/edit over the directory (ADR-0011, within its schema versioning).
  • Sessions: list active sessions and sign out everywhere (ADR-0016 + revocation, ADR-0005).
  • Connected applications / consent: see which clients have access and revoke them.
  • MFA factors: enroll/remove passkeys, TOTP, recovery codes (ADR-0020).
  • Consent & preferences: marketing/communication preferences and consent records (a versioned directory extension, ADR-0011).
  • Data export (DSAR / portability): the principal's data from the directory + event stream, in a portable format.
  • Data deletion: a deletion request is recorded here; the erasure mechanism (crypto-shredding vs the immutable event log) is the open privacy ADR (§12.8) — this proposal provides the flow, not the mechanism.

All actions are events (ADR-0022) and tenant-isolated (ADR-0012).

Alternatives considered

  • Admin-only account management — rejected for CIAM (doesn't scale to millions).

Graduation criteria

A user can edit profile, list/revoke sessions and connected apps, manage MFA factors, set consent/preferences, and request a data export; deletion requests are recorded and routed to the erasure mechanism once the privacy ADR lands.

Backward compatibility

Flows on existing seams; consent records are a versioned directory extension (ADR-0011). The erasure mechanism is deferred to the privacy ADR — not this proposal.

Open questions

  • Consent-receipt format (GDPR) and export format/scope.
  • The handoff from a deletion request to the crypto-shredding mechanism (privacy ADR).