Account
The customer-facing half of the estate's identity story: a magic-link and password login, signup with verification, and self-service profile, export and delete, kept deliberately separate from the workforce single sign-on that staff use. One product owns this surface so every other product integrates against one contract instead of rolling its own login page.
That contract is a single exchange: a product redirects here, gets an authorization code back, and trades it for a token through one documented endpoint — the same integration every consumer product uses, rather than a bespoke arrangement per product. The identity objects behind the surface are provisioned and audited by the estate's identity spine; this product never mints them itself.
It is deliberately defensive about the small things that make account systems leak information: every signup, password-reset and login attempt returns the same response whether or not the account exists, so the surface cannot be used to enumerate who has signed up, and every sensitive action writes to a hash-chained audit log rather than a plain table a later edit could quietly rewrite.
← back to the map