| IdentityPrincipal | principal_id, type[human|service|agent|device], organization_id, authoritative_sources[], state |
| PersonIdentity | person_id, hr_ref, employment_type, manager_id, start/end dates, privacy_class |
| ExternalIdentity | external_id, issuer, partner_org, verification_level, linked_principals[] |
| Entitlement | entitlement_id, application_id, permission_scope, role_ref, sensitivity, owner |
| Grant | grant_id, subject_id, resource_id, scope, approver, starts_at, expires_at, source |
| IdentityRelationship | source, target, relation_type, valid_from, valid_to, provenance, confidence |
| AuthenticationEvent | event_id, principal_id, device_id, method, AAL_context, risk, outcome, timestamp |
| Session | session_id, principal, RP, device, token_family, issued_at, revoked_at, risk |
| Authenticator | authenticator_id, principal, type, enrollment_time, assurance, revoked_at |
| PrivilegedSession | session_id, target, approval_id, recorder_ref, command_log_ref, end_reason |
| NHI/ServiceAccount | service_id, principal_id, workload, owner, scopes[], secret_ref, expires_at |
| AgentDelegation | agent_id, human_subject, task_ref, delegated_actions[], grant_expiry, human_approval |
| DigitalCredential | credential_id, issuer, subject_ref, schema, proof_ref, status_ref, issued/expires |
| IdentityRiskCase | case_id, trigger, evidence[], principals[], impact, policy_decisions[], resolution |
| PolicyDecision | decision_id, subject, resource, action, context, policy_version, decision, reason |
| AuditArtifact | artifact_id, producer, object_hash, privacy_class, retention, access_scope |
