Enterprise Identity and Authority Pattern

A Reference Architecture for Trusted Enterprise Participation

Category: Enterprise Implementation Patterns

Status: Reference Architecture Version 1.0

Author: Arqua

Classification: Public

Last Updated: July 2026

Architectural question: How does Enterprise Intelligence identify participants and determine whether they have legitimate authority to participate?

Executive summary

Enterprise Intelligence depends upon trusted participation.

Before any product, service, person or AI can contribute to Runtime Context Assembly, Enterprise Coordination or Execution Admissibility, the enterprise must know:

• who or what is participating
• who owns them
• who they represent
• what authority they possess
• whether that authority is current
• under what purpose they may participate

Identity establishes participation.

Authority establishes legitimacy.

Enterprise Intelligence requires both.

This is not an Identity and Access Management paper. It is not an authentication paper. It is not a security paper. It defines how Enterprise Intelligence establishes identity, authority, participation, delegation, trust and operational legitimacy.

Purpose

The Enterprise Identity and Authority Pattern defines how Enterprise Intelligence resolves:

• enterprise identities
• identity relationships
• delegated authority
• ownership
• operational legitimacy
• participation
• trust

It supports:

• Runtime Context Assembly
• Enterprise Registry
• Enterprise Control Plane
• Enterprise Coordination
• Execution Admissibility
• Platform Realisations

Identity answers: Who or what is participating?

Authority answers: Under what constitutional legitimacy may they participate?

These are different architectural responsibilities.

Constitutional position

Identity and Authority Resolution are Constitutional Runtime Services coordinated by the Enterprise Control Plane.

This pattern defines how those services are realised.

Architectural principles

EIAP-1 — Stable participant identity

Every enterprise participant has a stable identity.

Stable identity allows participation to be traced, governed, related, revised and reconstructed across time.

EIAP-2 — Identity and authority are different concepts

Identity and authority are different concepts.

Knowing who or what is participating does not establish what that participant may legitimately do.

EIAP-3 — Authority changes independently

Authority may change without identity changing.

A participant may retain the same identity while authority changes because of time, policy, delegation, organisational responsibility, jurisdiction or operational state.

EIAP-4 — Authority is purpose-specific

Authority must be evaluated for purpose.

Authority is not a universal property. It must be interpreted in relation to the activity, business domain, policy frame, operational purpose and consequence boundary.

EIAP-5 — Explicit delegation

Delegation remains explicit.

Delegated authority must be traceable to the delegating source, scope, duration, conditions and revocation mechanism.

EIAP-6 — Technology-independent identity

Identity remains independent of technology platforms.

Identity products, directories, IAM services and platform-native identities may contribute to Enterprise Identity. They do not define Enterprise Identity.

EIAP-7 — Resolved runtime participation

Runtime participation requires resolved identity and authority.

A participant should not contribute to Runtime Context Assembly, Enterprise Coordination or Execution Admissibility unless both identity and authority are resolved for the relevant purpose.

EIAP-8 — Execution requires authority

Execution requires authority, not merely authentication.

Authentication may confirm a technical credential. It does not establish constitutional legitimacy for enterprise consequence.

Enterprise Participants

Enterprise Identity includes far more than users.

Enterprise participants include:

• People
• Business Domains
• Data Domains
• Applications
• Enterprise Products
• Runtime Services
• AI Agents
• Models
• Documents
• Assets
• Devices
• Digital Twins
• Customers
• Suppliers
• Organisations
• Policies
• Locations
• Events
• Work Orders
• Operational Activities

Anything capable of participating within Enterprise Intelligence requires an enterprise identity.

Participation may occur through publication, discovery, context assembly, semantic interpretation, authority resolution, coordination, execution, evidence production or outcome capture.

Enterprise Authority

Authority includes:

• Ownership
• Publication Authority
• Custodianship
• Operational Authority
• Execution Authority
• Delegated Authority
• Semantic Authority
• Approval Authority
• Policy Authority
• Regulatory Authority
• Business Authority

Authority is contextual.

The same participant may possess different authority depending upon:

• operational purpose
• business domain
• time
• jurisdiction
• delegation
• policy
• operational state

Authority must therefore be resolved at runtime against the relevant purpose, operating condition and consequence boundary. Static membership, directory presence or platform permission is not sufficient to establish constitutional legitimacy.

Identity Resolution

Identity Resolution determines:

Who is participating?

It resolves:

• canonical identity
• aliases
• federation
• lifecycle
• participant relationships
• ownership

Identity Resolution establishes trusted participation.

It does not determine authority.

Identity Resolution ensures that a participant can be recognised, related, traced and governed across enterprise products, platforms, registries, graph projections, runtime services and operational contexts.

Authority Resolution

Authority Resolution determines:

May this participant legitimately perform this activity?

Authority Resolution evaluates:

• delegated authority
• organisational responsibility
• operational authority
• temporal validity
• policy
• jurisdiction
• purpose

Authority Resolution supplies Runtime Context Assembly and Execution Admissibility.

Authority Resolution determines whether a resolved identity has the constitutional legitimacy required to participate in a specific operational purpose, coordination activity or execution boundary.

Runtime Context Assembly

Runtime Context Assembly consumes resolved identities and authority.

It does not resolve identity independently.

Identity Resolution and Authority Resolution occur as Constitutional Runtime Services coordinated by the Enterprise Control Plane.

Runtime Context Assembly uses resolved identity and authority to determine which participants, products, services, policies, graph relationships, events and execution capabilities may form part of Qualified Operational Understanding.

Enterprise Control Plane

The Enterprise Control Plane coordinates:

Identity Resolution
↓
Authority Resolution
↓
Runtime Context Assembly
↓
Context Qualification
↓
Execution Admissibility

Identity and Authority become runtime services rather than static directory lookups.

The Enterprise Control Plane ensures that identity and authority are resolved before operational understanding is qualified and before consequence becomes admissible.

Relationship to SCIA Runtime

SCIA Runtime consumes:

• Resolved Identity
• Resolved Authority
• Qualified Operational Understanding
• Current Operational State
• Evidence
• Policy

SCIA Runtime does not discover identities.

It evaluates admissibility using identities and authority already resolved by the Enterprise Control Plane.

SCIA Runtime determines whether proposed execution may proceed at the operational commit boundary. It depends upon resolved identity and authority, but it does not replace the services that establish them.

Platform Contributions

Microsoft

Entra contributes enterprise identity.

It does not become Enterprise Identity.

AWS

IAM contributes runtime identity.

It does not become Enterprise Identity.

Databricks

Unity Catalog contributes governed identities for data, models and agents.

It does not become Enterprise Identity.

SAP

Business Partner contributes enterprise identities.

It does not become Enterprise Identity.

ServiceNow

CSDM contributes operational service identities.

It does not become Enterprise Identity.

Technology platforms contribute identity services, directories, credentials, principals, catalogues, account structures and operational records. Enterprise Identity and Authority remain constitutional enterprise responsibilities that coordinate across those platform contributions.

Architecture diagram

Enterprise Participants
People
Products
Applications
Agents
Services
Assets
Documents
Events
        │
        ▼
Identity Resolution
        │
        ▼
Authority Resolution
        │
        ▼
Runtime Context Assembly
        │
        ▼
Qualified Operational Understanding
        │
        ▼
Execution Admissibility
        │
        ▼
Operational Execution

Identity establishes participation.

Authority establishes legitimacy.

Execution evaluates consequence.

The progression ensures that operational execution occurs through trusted enterprise participants rather than isolated technical identities.

Non-goals

This pattern does not:

• replace IAM
• replace authentication
• replace access control
• replace directory services
• replace Enterprise Registry
• replace Runtime Context Assembly
• replace Execution Admissibility

Technology platforms contribute identity services.

Enterprise Identity and Authority remain constitutional enterprise responsibilities.

Cross references

This pattern should be read with:

• Enterprise Registry Pattern
• Enterprise Knowledge Graph Pattern
• No access
• The Enterprise Control Plane
• Constitutional Runtime Services
• Execution Admissibility Pattern
• SCIA Runtime
• Enterprise Coordination
• Enterprise Intelligence Framework

These references define the registry, runtime, coordination and admissibility context in which trusted enterprise participation operates.

Pattern navigation

Source-Aligned Product Pattern
↓
Semantic Projection Pattern
↓
Enterprise Knowledge Graph Pattern
↓
Graph Projection and Interchange Pattern
↓
Enterprise Registry Pattern
↓
Enterprise Identity and Authority Pattern
↓
Enterprise Streaming Pattern
↓
Runtime Context Pattern

Validation

Before publishing, verify:

• Identity and Authority are consistently described as separate concepts.
• Authority is contextual rather than static.
• Identity Resolution and Authority Resolution are presented as Constitutional Runtime Services.
• SCIA Runtime consumes resolved authority rather than discovering it.
• Runtime Context Assembly consumes resolved identities.
• Platform identity products are described as contributors rather than replacements.
• The paper consistently reinforces the progression:

Enterprise Participants
↓
Identity Resolution
↓
Authority Resolution
↓
Runtime Context Assembly
↓
Qualified Operational Understanding
↓
Execution Admissibility
↓
Operational Execution

Boundary statement

This page is an Enterprise Implementation Pattern. It is not a Constitutional Architecture paper.

It does not define IAM, authentication, access control, directory services or security platforms as the architecture.

It does not modify the authority of Enterprise Registry, Runtime Context Assembly, Enterprise Coordination, Enterprise Control Plane, Execution Admissibility or SCIA Runtime.

It does not assert that identity technology provides legal compliance, regulatory assurance, operational assurance or automated decision authority.

Human and organisational accountability remains with the institution applying the pattern.

Conclusion

Enterprise Intelligence depends upon trusted participation.

Enterprise Identity establishes who participates.

Enterprise Authority establishes whether participation is legitimate.

Together they enable Runtime Context Assembly, Enterprise Coordination and Execution Admissibility to operate using trusted enterprise participants rather than isolated technical identities.

The Enterprise Identity and Authority Pattern therefore provides one of the foundational implementation patterns required for Enterprise Intelligence while remaining independent of identity technology platforms.