<mxfile host="app.diagrams.net" agent="architecture-diagram" version="24.0.0">
  <diagram name="Identity &amp; Entitlement Data Model" id="09-identity-data-model">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1760" pageHeight="1160" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="n.tenant" value="&lt;b&gt;tenant&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;tenant_id  PK&lt;br&gt;kind  ENUM(CORP,CIAM,PARTNER)&lt;br&gt;home_domain&lt;br&gt;isolation_tier&lt;br&gt;data_residency&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="80" width="350" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.ident" value="&lt;b&gt;identity&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;object_id  PK&lt;br&gt;tenant_id  FK -&gt; tenant&lt;br&gt;upn&lt;br&gt;kind  ENUM(EMP,CTR,GUEST,CUST,BG)&lt;br&gt;hr_worker_id&lt;br&gt;account_enabled&lt;br&gt;last_sign_in_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="480" y="80" width="350" height="150" as="geometry" />
        </mxCell>
        <mxCell id="n.grp" value="&lt;b&gt;group&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;group_id  PK&lt;br&gt;tenant_id  FK -&gt; tenant&lt;br&gt;name  (app-env scoped)&lt;br&gt;source  ENUM(DYNAMIC,ASSIGNED,PIM)&lt;br&gt;owner_id  FK -&gt; identity&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="920" y="80" width="350" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.app" value="&lt;b&gt;application&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;app_id  PK&lt;br&gt;tenant_id  FK -&gt; tenant&lt;br&gt;display_name&lt;br&gt;sign_in_audience&lt;br&gt;owner_group_id  FK -&gt; group&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1360" y="80" width="350" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.wl" value="&lt;b&gt;workload_identity&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;principal_id  PK&lt;br&gt;tenant_id  FK -&gt; tenant&lt;br&gt;kind  ENUM(SYS_MI,USER_MI,SP)&lt;br&gt;app_id  FK -&gt; application&lt;br&gt;credential  ENUM(MI,FIC,SECRET)&lt;br&gt;owner_group_id&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="330" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.gm" value="&lt;b&gt;group_membership&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;group_id  FK -&gt; group&lt;br&gt;member_id  FK -&gt; identity&lt;br&gt;source  ENUM(HR,PACKAGE,PIM)&lt;br&gt;granted_at&lt;br&gt;expires_at  NULL = permanent&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="480" y="330" width="350" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.pkg" value="&lt;b&gt;access_package&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;package_id  PK&lt;br&gt;catalog_id&lt;br&gt;name&lt;br&gt;approver_group_id  FK -&gt; group&lt;br&gt;duration_days&lt;br&gt;review_cadence_days&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="920" y="330" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.arole" value="&lt;b&gt;app_role&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;role_id  PK&lt;br&gt;app_id  FK -&gt; application&lt;br&gt;value  (roles claim)&lt;br&gt;allowed_member_types&lt;br&gt;requires_admin_consent&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1360" y="330" width="350" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.fic" value="&lt;b&gt;federated_credential&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;fic_id  PK&lt;br&gt;principal_id  FK -&gt; workload_identity&lt;br&gt;issuer  (OIDC)&lt;br&gt;subject  (repo:env / ns:sa)&lt;br&gt;audience&lt;br&gt;created_by&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="580" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.rbac" value="&lt;b&gt;rbac_role_assignment&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;assignment_id  PK&lt;br&gt;principal_id  (group preferred)&lt;br&gt;role_definition_id&lt;br&gt;scope  (MG/sub/RG/resource)&lt;br&gt;condition  ABAC  NULL&lt;br&gt;is_pim_eligible&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="480" y="580" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.ent" value="&lt;b&gt;entitlement_assignment&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;assignment_id  PK&lt;br&gt;package_id  FK -&gt; access_package&lt;br&gt;identity_id  FK -&gt; identity&lt;br&gt;state  ENUM(PENDING,ACTIVE,EXPIRED)&lt;br&gt;justification&lt;br&gt;expires_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="920" y="580" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.pim" value="&lt;b&gt;pim_activation&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;activation_id  PK&lt;br&gt;assignment_id  FK -&gt; rbac_role_assignment&lt;br&gt;ticket_ref&lt;br&gt;approver_id  FK -&gt; identity&lt;br&gt;activated_at&lt;br&gt;expires_at  (max 8 h)&lt;br&gt;auth_strength_met&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="480" y="830" width="350" height="150" as="geometry" />
        </mxCell>
        <mxCell id="n.rev" value="&lt;b&gt;access_review_decision&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;review_id  PK&lt;br&gt;assignment_id  FK -&gt; entitlement_assignment&lt;br&gt;reviewer_id  FK -&gt; identity&lt;br&gt;decision  ENUM(APPROVE,DENY,NO_RESP)&lt;br&gt;decided_at&lt;br&gt;evidence_uri&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="920" y="830" width="350" height="130" as="geometry" />
        </mxCell>
        <mxCell id="_r1" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.tenant" target="n.ident">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r2" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.tenant" target="n.wl">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r3" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.ident" target="n.gm">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r4" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.grp" target="n.gm">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r5" value="grants  N : M" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.pkg" target="n.grp">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r6" value="grants  N : M" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.pkg" target="n.arole">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r7" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.pkg" target="n.ent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r8" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.app" target="n.arole">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r9" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.wl" target="n.fic">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r10" value="principal  N : 1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.gm" target="n.rbac">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r11" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.rbac" target="n.pim">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r12" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.ent" target="n.rev">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="title" value="Identity &amp; Entitlement Data Model" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=20;fontStyle=1;fontColor=#16202c;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1670" height="30" as="geometry" />
        </mxCell>
        <mxCell id="rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#c9d3de;" vertex="1" parent="1">
          <mxGeometry x="40" y="50" width="1670" height="10" as="geometry" />
        </mxCell>
        <mxCell id="note" value="Sign-in and audit events are deliberately absent: they are append-only telemetry with a different owner and retention, and view 11 places them. Everything drawn here is state that access decisions read." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=10;fontColor=#8a97a5;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="1090" width="1670" height="20" as="geometry" />
        </mxCell>
        <mxCell id="foot-rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#e3e9ef;" vertex="1" parent="1">
          <mxGeometry x="40" y="1110" width="1670" height="10" as="geometry" />
        </mxCell>
        <mxCell id="foot" value="v 1.0   ·   owner Data &amp; AI Global Practice   ·   date 2026-08" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=9;fontColor=#9aa7b4;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="1130" width="1670" height="10" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
