Identity Foundation¶

Status: Implemented

Overview¶

The Identity Foundation establishes the minimum identity model required by the Nivron platform.

It introduces organizations and users as first-class platform entities, forming the architectural basis for authentication, authorization, tenant isolation and future Identity and Access Management (IAM) capabilities.

The current implementation intentionally focuses on a stable foundation that can evolve without breaking existing identities.

Objectives¶

Objective	Description
Multi-Organization Support	Allow multiple organizations to coexist within the platform.
Tenant Isolation	Ensure organizational data remains isolated.
Stable Identifiers	Use UUID v7 as the public identifier model.
IAM Readiness	Prepare the platform for RBAC, permissions and authentication providers.
Domain Independence	Keep identity concerns separate from business modules.

Current Domain Model¶

Entity	Purpose	Status
`core.organizations`	Represents a tenant within the platform.	Implemented
`identity.users`	Represents a platform user associated with one organization.	Implemented

Entity Relationship¶

erDiagram
    ORGANIZATIONS ||--o{ USERS : contains

    ORGANIZATIONS {
        uuid uuid
        string slug
        string name
        string status
    }

    USERS {
        uuid uuid
        string username
        bigint organization_id
        string status
    }

Each user belongs to exactly one organization in the current implementation.

Architectural Principles¶

Organization First¶

Every business operation is evaluated within an organizational context. Organizations are the primary isolation boundary for the platform.

Stable External Identifiers¶

Public references use UUID v7 instead of sequential database identifiers to provide stable, globally unique identifiers.

Identity Independence¶

Identity capabilities are implemented independently from business modules, allowing application domains to evolve without redefining authentication or organizational models.

Incremental Evolution¶

The identity model is intentionally minimal and is expected to evolve with roles, permissions, groups, service accounts and external identity providers while preserving existing entities.

Planned Evolution¶

Capability	Status
Organizations	Implemented
Users	Implemented
Roles	Planned
Permissions	Planned
Groups	Planned
Service Accounts	Planned
API Tokens	Planned
SSO Providers	Planned

Future capabilities extend the existing model rather than replacing it.