security-identity-accesslisted

# Security Identity Access Use this companion only with `security`. If `security` is not applicable, do not apply this overlay. ## Composition Contract `security` remains primary and owns investigation authority, attacker and trust boundary analysis, evidence outcomes, severity and confidence, remediation, validation, and report shape. This companion owns identity-specific state and transition modeling, authentication and session invariants, recovery and federation risks, tenant authorization, and routing to selectively needed identity detail. Matching backend and language skills still own ordinary implementation mechanics. ## Model The Identity Boundary Map the repository's actual objects and names. Do not invent states merely to fit this model. | Object | State or binding to establish | |---|---| | principal or account | lifecycle state and usable identifiers | | authenticator or factor | pending, bound, active, replaced, lost, or revoked | | transaction or capability | purpose, subject, initiating context, expiry, and unused or consumed state when one-time | | session or token | principal, authentication event, issue time, expiry, rotation, and revocation | | membership or grant | principal, tenant, role or capability, resource scope, and lifecycle state | | external identity | trusted issuer or security domain plus its stable subject identifier | For every security-relevant transition, establish as applicable: - who or what may initiate it - which authenticated,