starter.wiki搜索⌘KEN

决策地图

身份与访问：从登录到组织权限的决策地图

覆盖认证、授权、企业 SSO、组织模型和用户生命周期，重点是明确身份边界由谁拥有。

Recommendation

新 SaaS 通常从托管认证开始；企业 SSO 和目录同步只在明确销售需求出现后接入。

先区分验证身份、管理用户和执行权限；这三件事不应被同一个产品名混为一谈。

打开起始决策

范围

用这条边界避免在错误层级解决相邻问题。

包含

  • Application authentication and authenticator requirements
  • Account and profile lifecycle management
  • Authorization policy and enforcement ownership
  • Enterprise federation and provisioning
  • B2B tenant, organization, and membership modeling
  • Wallet-address authentication when wallet control is the identity primitive

不包含

  • Real-world identity proofing and regulated verification, which belong to Security
  • Payment fraud and transaction-risk decisions
  • Generic secrets, audit-log, and application-security controls
  • Social login, passwordless, MFA, roles, and permissions as independent top-level Tasks
1234

重要工具

这些工具代表此决策领域内不同路线；请先打开相关任务页面，再将任何工具视作默认。

决策顺序

先完成基础归属判断，再增加专门能力。

  1. What is an account, which system owns its lifecycle, and how will users authenticate?

    Define account records, creation, recovery, suspension, deletion, authenticators, and sessions without treating account administration as a synonym for login.

    User Management Authentication

  2. What may an authenticated subject do to which resources?

    Model subjects, resources, actions, policies, and enforcement points independently of authentication.

    Authorization

  3. Does the product need organizations, memberships, invitations, active tenant context, and tenant isolation?

    For B2B products, decide the tenant and membership model and whether the application or an identity platform owns it.

    B2B Organizations & Multi-Tenancy

  4. Will customer or workforce identity providers control sign-in or provisioning?

    Evaluate federation and user or group provisioning separately; a deployment may require either or both.

    Single Sign-On User Management

  5. Is proof of wallet-address control part of the product identity model?

    Use Wallet Login only for wallet-native identity and require a signed, domain-bound, nonce-protected ceremony.

    Wallet Login Authentication

579

决策分组

每个任务都对应一个独立的用户决策，而非产品功能标签。

Access control

Keep permission evaluation and enforcement independent from the ceremony that established identity.

Wallet-based identity

Wallet Login is relevant only when signed wallet control is itself an application identity primitive.

7810

常见混淆

这些边界避免相邻任务被压缩成一个泛泛的候选清单。

Treating sign-in and permissions as one identity problem.
Authentication establishes identity or authenticator control; Authorization evaluates permitted actions on resources.
Assuming enterprise SSO automatically manages the full user and group lifecycle.
Federation conveys authenticated identity assertions; provisioning manages User and Group resources.
Using generic user management to represent organizations and tenant isolation.
User Management owns accounts; B2B Organizations & Multi-Tenancy owns tenant, membership, and active-context modeling.
Treating proof of wallet-address control as verified personhood.
Wallet Login proves control of an address through a signing ceremony; Identity Verification evaluates real-world identity evidence.
2356

暂缓引入

不要在产品真正需要之前引入专门系统。

No customer or workforce requirement establishes federation, directory integration, or enterprise provisioning.

Enterprise federation adds protocol, tenant-mapping, and operational requirements that ordinary application authentication does not need.

The product has no business tenants, memberships, invitation lifecycle, or tenant-isolation requirement.

A tenant and membership layer should not be introduced for a flat account model.

Wallet-address control is not part of the product identity or transaction model.

Wallet login introduces chain, signing, nonce, replay, and account-linking decisions that conventional identity does not require.

3510

Starter Stack

查看这些决策如何出现在完整应用起始方案中。

官方资源

支撑此分类边界的标准与一手文档。

来源

此决策地图使用的主张级参考资料。

  1. 1
    Digital Identity Guidelines: SP 800-63-4

    NIST · Accessed Official

  2. 2
  3. 3
    SP 800-63C: Federation and Assertions

    NIST · Accessed Official

  4. 4
    SP 800-63A: Identity Proofing and Enrollment

    NIST · Accessed Official

  5. 5
  6. 6
    Role Based Access Control project and publications

    NIST · Accessed Official

  7. 7
    Organizations overview

    Clerk · Accessed Official

  8. 8
    Configure organization settings

    Clerk · Accessed Official

  9. 9
    Multi-tenant architecture

    Clerk · Accessed Official

  10. 10
    ERC-4361: Sign-In with Ethereum

    Ethereum Improvement Proposals · Accessed Official