tenant_id appears on every top-level entity. Isolation is a schema property here, so an accidental cross-tenant join is a query that fails rather than a leak that succeeds.
group_membership carries expires_at and a source. Access with no expiry and no provenance is the mechanism by which entitlement creep happens; making both mandatory columns makes the creep visible.
rbac_role_assignment records is_pim_eligible separately from an active grant, so 'who could become privileged' and 'who is privileged right now' are two different queries with two different answers.
The join that matters
employee_id from Workday is the only correlation key between HR and the directory. Everything downstream depends on it being present and stable across a rehire.
access_package is the grant unit for humans and group membership is its effect, which is why reviews target packages rather than groups: reviewing a group asks the wrong question.
federated_credential stores issuer, subject and audience. Those three fields are the whole security boundary of a CI/CD federation, so they are modelled explicitly rather than left inside an opaque configuration blob.
Deliberate omissions
Sign-in and audit events are absent. They are append-only telemetry with a different owner, a different retention and a different store — view 11 places them.
Consent grants and OAuth permission grants are not modelled here; they are governed operationally through the admin consent workflow (view 27, row 3).
Device and its compliance state belong to Intune's model. This platform reads the signal and does not restate the schema.
