> ## Documentation Index
> Fetch the complete documentation index at: https://docs.integratewise.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# 12 · Identity & Authority View

> IW One Auth — organizational identity, user identity, AI identity, agent identity, roles, authority, tenancy, permissions, approvals, and delegation.

## Identity Answers Who Is Acting

Every action in SpineWorkspace is **identity-bound**. No anonymous Work, no ambient capability access.

```text theme={null}
IW One Auth
   ├── Organizational identity (tenant)
   ├── User identity (human)
   ├── Twin identity (twin:{userId})
   ├── Agent identity (agent:{agentId})
   └── Roles → Authority → Permissions → Approvals → Delegation
```

<Callout type="info">
  **Tenancy is the isolation boundary.** Business Context Spine, projections, capabilities, and memory are all tenant-scoped. Cross-tenant access is a governance decision, not a default.
</Callout>

## Identity Types

| Identity                  | Example           | Scoped to                | Memory it carries                      |
| ------------------------- | ----------------- | ------------------------ | -------------------------------------- |
| **Organization / Tenant** | `tenant:{orgId}`  | Organization             | Organizational Memory (THE memory)     |
| **User**                  | `user:{userId}`   | Tenant + roles           | Personal Contextual Memory (serves BC) |
| **Twin**                  | `twin:{userId}`   | Same tenant as its human | AI Continuity Memory (serves BC)       |
| **Spine Agent**           | `agent:{agentId}` | Tenant + Work + role     | Agent Continuity (serves BC)           |

Twin identity derives from its human. Agent identity derives from the Work and the organizational role it represents.

## Authority vs Permission vs Approval

* **Authority** — what this identity may do in this Business Context (derived from role + policy + Work context).
* **Permission** — the enforceable gate that checks authority at capability resolution time.
* **Approval** — a human or delegated authorization that satisfies a governance policy for a specific plan.
* **Delegation** — scoped, auditable grant of authority (e.g., "approve renewals under \$X in this Work").

```text theme={null}
Identity → Authority (who/what may act)
   → Capability (what can be done)
     → Policy (under what constraints)
       → Approval (who said yes, with what evidence)
         → Authorization (governance verdict → Hermes may execute)
```

## Tenancy & Isolation

* One Spine per tenant. One projection per participant per Work.
* No capability or memory leaks across tenants. The operational sandbox is per-tenant and per-Work-context.
* Delegation never crosses tenant boundary without explicit governed action.

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Governance & Authority" icon="shield-check" href="/platform/governance-authority-view">
    Policy → plan → approval → authorization — the verdict Hermes obeys.
  </Card>

  <Card title="Ecosystem & Integration" icon="plug" href="/platform/ecosystem-integration-view">
    How each identity connects to ecosystems via One Auth scopes.
  </Card>

  <Card title="Security & Governance" icon="lock" href="/implementation/security-governance">
    Secrets, audit, provenance, isolation, fail-closed behavior.
  </Card>
</CardGroup>