Security
Identity, Scope, and Assignment
How the session decision combines person, role responsibility, resource scope, duration, and readiness signals.
This page defines the decision contract for a resource session. Identity and SSO owns panel sign-in, while Roles and responsibilities owns role names.
Decision inputs
| Input | Question answered |
|---|---|
| Person | Who is requesting the session? |
| Workspace | Do the person and resource share the same operating scope? |
| Role responsibility | Can the person perform this action? |
| Resource assignment | Is this person assigned to this resource? |
| Duration | Is the assignment currently valid? |
| Resource readiness | Can the resource carry the session? |
| Session policy | Which rules apply to this work surface? |
The decision uses the current value of each input. Inventory visibility, a past session, or network reachability alone does not authorize a new session.
Decision outcomes
- Open: the session can start for the specific person-resource relationship and current policy.
- Closed: a missing or conflicting input returns a visible state to the person.
- Re-evaluate: a duration, assignment, readiness, or policy change requires a new decision.
Removing an assignment closes new launches. Ending active work is a separate operation covered by Revocation and evidence.
Review result
A decision record shows person, resource, assignment, decision time, and outcome in one context. Resource readiness and Agent trust defines the readiness signals.