CORE layer 01 of 10
Identity
Who or what is acting: humans, agents and service identities, known once and recognized in every context.
- CORE
- The shared operating layer. Ten layers: Identity, Organizations, People, Relationships, Knowledge, Workflows, Commerce, Finance, Communication, Data.
- Website (interface)
- Public sites and portals that read content and catalog data and submit forms through CORE. Uses the Identity, Knowledge, Commerce and Data layers. Example capabilities: page.get, catalog.list, form.submit.
- Applications (interface)
- Internal, mobile and dashboard apps: views into CORE with the signed-in identity's permissions. Uses the Identity, Organizations, People, Workflows and Data layers. Example capabilities: customer.get, workflow.start, approval.decide.
- Chat (interface)
- 2finity.chat and other conversational interfaces: language resolved to capabilities, with approval. Uses the Identity, Knowledge, Workflows, Finance and Communication layers. Example capabilities: site.content.update, invoice.create, permission.grant.
- Agents (interface)
- Actors with their own identity, an owner and scoped permissions; every action leaves an audit event. Uses the Identity, Knowledge, Workflows and Communication layers. Example capabilities: site.publish, deployment.rollback, workflow.start.
- People (participant)
- Humans in any context: professional, employee, customer or supplier, with one identity throughout. Uses the Identity, People, Relationships and Communication layers. Example capabilities: customer.get, permission.grant, message.send.
- Companies (participant)
- Organizations that own their data, run their workflows and decide who and what may act inside them. Uses the Organizations, People, Relationships, Commerce and Finance layers. Example capabilities: organization.get, invoice.create, order.update.
- Partners (participant)
- Other organizations connected by a relationship: suppliers, resellers and agencies see what it grants. Uses the Identity, Relationships, Commerce and Data layers. Example capabilities: catalog.product.get, order.update, permission.grant.
- Enterprise (participant)
- Large organizations running CORE in an isolated deployment with their own identity provider and policies. Uses the Identity, Organizations, Workflows, Finance and Data layers. Example capabilities: permission.grant, deployment.publish, workflow.start.
Scope
What it holds
Who or what is acting?
Every action in CORE starts with an identity. A person, an agent or a service authenticates once and carries that identity into every organization and role it is connected to. Identity holds credentials, sessions and the links to roles and permissions; it does not hold business data. 2finity Identity is the planned OIDC provider for this layer.
Model
Example entities
- Identity
- Credential
- Session
- Service identity
- Agent identity
- Permission grant
- Identity link
Contract
Capabilities
Every action on this layer is a named capability with a permission check and, where something changes, an event.
identity.currentReturn the acting identity for the current session or token.
Publicidentity.verifyNamed in the layer model; not yet described in the catalogue.
identity.linkNamed in the layer model; not yet described in the catalogue.
session.createNamed in the layer model; not yet described in the catalogue.
session.revokeNamed in the layer model; not yet described in the catalogue.
permission.grant→ permission.grantedGrant an identity a role or capability on a resource inside an organization.
Privileged role or approvalpermission.revokeNamed in the layer model; not yet described in the catalogue.
permission.checkAnswer whether an actor may invoke a capability on a resource.
Member of the organization
Connections
Relationships
The layers Identity reads from and writes to most often.
- 02
Organizations
Inside which boundary?
Companies, teams, departments and business units: the boundaries inside which people, data and permissions live.
- 03
People
Who do we work with?
Customers, employees, professionals, suppliers and leads: the people an organization works with, as one record each.
- 04
Relationships
How are they connected?
Connections between people, organizations, roles and agents: who is a customer, employee, supplier, partner or owner of whom.
Consumers
How interfaces use it
The interfaces and participants on the CORE graph that read or write this layer, with the capabilities of this layer they name.
Website interface
Public sites and portals that read content and catalog data and submit forms through CORE.
Uses the layer; its featured capabilities belong to other layers.Applications interface
Internal, mobile and dashboard apps: views into CORE with the signed-in identity's permissions.
Uses the layer; its featured capabilities belong to other layers.Chat interface
2finity.chat and other conversational interfaces: language resolved to capabilities, with approval.
permission.grantAgents interface
Actors with their own identity, an owner and scoped permissions; every action leaves an audit event.
Uses the layer; its featured capabilities belong to other layers.People participant
Humans in any context: professional, employee, customer or supplier, with one identity throughout.
permission.grantPartners participant
Other organizations connected by a relationship: suppliers, resellers and agencies see what it grants.
permission.grantEnterprise participant
Large organizations running CORE in an isolated deployment with their own identity provider and policies.
permission.grant