{
  "format": "vercy-enterprise-profile-candidate/v1",
  "contourId": "EM-RSK-03",
  "name": "Enterprise Identity, Account and Authorization Binding",
  "decision": "PROFILE",
  "newRuntimeId": false,
  "candidateRevision": 3,
  "canonicalPublishable": false,
  "bases": [
    "WM-XCT-016",
    "WM-XCT-002",
    "WM-XCT-001",
    "WM-ACT-034",
    "WM-XCT-017"
  ],
  "constraintRules": [
    {
      "id": "EM-RSK-03.EP-01",
      "text": "WM-PER-002 duplicate retirement into WM-XCT-016 is conditional on registry-owner alias confirmation and creates no digital account."
    },
    {
      "id": "EM-RSK-03.EP-02",
      "text": "Person, identity register and WM-VRT-005 Digital Account remain separate identities joined by effective assurance-qualified bindings."
    },
    {
      "id": "EM-RSK-03.EP-03",
      "text": "WM-XCT-002 supplies consent and read/disclosure justification only and never becomes an operational IAM role, assignment or grant."
    },
    {
      "id": "EM-RSK-03.EP-04",
      "text": "WM-XCT-001 supplies holder/steward authority and scoped control mandates only and never hosts an IAM grant catalogue."
    },
    {
      "id": "EM-RSK-03.EP-05",
      "text": "WM-ACT-034 profiles Access Review activity over an account and explicit grant or assignment set, with retain, revoke, recertify or escalate outputs."
    },
    {
      "id": "EM-RSK-03.EP-06",
      "text": "A review output never changes access until a separate grant transition is effective and auditable."
    },
    {
      "id": "EM-RSK-03.EP-07",
      "text": "WM-XCT-004 and WM-XCT-007 are conceptual audit and enforcement neighbors only until complete specifications and approved relations exist."
    },
    {
      "id": "EM-RSK-03.EP-08",
      "text": "Account authenticator metadata is a component; WM-XCT-017 remains the issued credential or attestation master and secret storage remains external."
    },
    {
      "id": "EM-RSK-03.EP-09",
      "text": "No projection or credential-status record grants authorization by its existence."
    }
  ],
  "holds": [
    "The candidate cluster is not one proven aggregate type; registry allocation must resolve Domain/Role/Assignment/Grant root boundaries.",
    "No registry namespace or identifier is allocated and none may be guessed.",
    "WM-PER-002 duplicate retirement requires registry-owner alias confirmation.",
    "WM-VRT-005 and WM-XCT-004/007 lack usable complete specifications.",
    "WM-ACT-034 has no approved Access Review profile.",
    "Credential Metadata versus identity-register keyBinding versus WM-XCT-017 requires an approved semantic crosswalk.",
    "Approved relations, rights controls, package conversion and live conformance remain pending."
  ],
  "publicationStatement": "Research candidate cluster only; not canonically publishable, installable, allocated or verified.",
  "pendingNeighbours": [
    {
      "id": "WM-VRT-005",
      "reason": "Digital Account direction only; usable complete specification absent"
    },
    {
      "id": "WM-XCT-004",
      "reason": "audit neighbor only; usable complete specification absent"
    },
    {
      "id": "WM-XCT-007",
      "reason": "enforcement neighbor only; usable complete specification absent"
    }
  ],
  "components": {
    "DigitalAccountCredentialMetadata": {
      "owner": "Digital Account profile once WM-VRT-005 is complete",
      "required": [
        "type",
        "issuerRef",
        "status",
        "protectedReference"
      ],
      "optional": [
        "validFrom",
        "validTo",
        "assurance",
        "keyIdentifier",
        "bindingRef",
        "issuedCredentialRef"
      ],
      "prohibited": [
        "secretValue",
        "privateKey",
        "password",
        "reversibleDigest"
      ],
      "externalSecretAuthority": "authenticator or secret-store system"
    }
  }
}