{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.wm-vrt-005","code":"wm-vrt-005-online-account","url":"https://ver.cy/models/wm-vrt-005-online-account/","name":"Online Account","alternateNames":[],"kind":"world-model","status":"todo","version":"unversioned","language":"en","classifiers":{"family":"World Models","category":"Information and virtual systems","entryKind":"standalone-mm","plane":"","domain":["INF.VRT.ACC"],"industry":["Cross-industry"],"navPath":"NAV.INF.VRT.ACC","tags":["online","account","inf.vrt.acc"],"facets":{}},"whatItIs":"An online account is a record within one service or virtual environment that lets a holder sign in, keep settings and data, and act under the service's terms. It belongs to that service and is distinct from the person behind it and from a federated digital identity that may be used to sign in to many services.","purpose":"An account within a service or virtual environment; distinct from the person's federated digital identity.","scope":{"in":[],"out":[],"boundaries":[]},"distinguishingFeatures":["It exists within one service and is governed by that service's terms.","One person can hold many accounts, and an account can be held by an organisation or an agent.","Distinct from a federated digital identity, which can be used across services to sign in.","Distinct from a financial account, which holds monetary balances rather than service access."],"structure":{"bundles":[{"id":"VRT005-B1","name":"Account and holder","description":"What the account is and who controls it.","layers":[{"id":"VRT005-B1-L1","name":"Account record","description":"Identifier, service and status of the account.","findings":[{"id":"VRT005-F01","name":"Account identity","description":"The service-scoped identifier and handle of the account.","questions":[{"text":"Which service holds the account, and under which identifier and handle?","id":"VRT005-Q01"},{"text":"Is the account active, suspended, locked or closed?","id":"VRT005-Q02"}]},{"id":"VRT005-F02","name":"Holder relationship","description":"The person, organisation or agent that controls the account.","questions":[{"text":"Is the account held by a person, an organisation or a non-human agent?","id":"VRT005-Q03"},{"text":"Is the holder's identity verified, and to what assurance level?","id":"VRT005-Q04"}]}]}]},{"id":"VRT005-B2","name":"Authentication and access","description":"How the holder signs in and what the account can do.","layers":[{"id":"VRT005-B2-L1","name":"Credentials and federation","description":"Authenticators and linked identity providers.","findings":[{"id":"VRT005-F03","name":"Sign-in methods","description":"The authenticators and federated logins bound to the account.","questions":[{"text":"Which authentication methods are enabled, and is multi-factor authentication on?","id":"VRT005-Q05"},{"text":"Is sign-in federated through an external identity provider?","id":"VRT005-Q06"}]}]},{"id":"VRT005-B2-L2","name":"Roles and delegation","description":"Permissions held and delegated access.","findings":[{"id":"VRT005-F04","name":"Permissions","description":"Roles, scopes and delegated grants of the account.","questions":[{"text":"Which roles or scopes does the account hold in the service?","id":"VRT005-Q07"},{"text":"Which third-party applications have been granted access, and with which scopes?","id":"VRT005-Q08"}]}]}]},{"id":"VRT005-B3","name":"Lifecycle","description":"How the account is created, changed and ended.","layers":[{"id":"VRT005-B3-L1","name":"Status and closure","description":"Creation, suspension, recovery and deletion.","findings":[{"id":"VRT005-F05","name":"Closure and data","description":"What happens to the account and its data at the end.","questions":[{"text":"Has the holder requested closure or deletion, and when?","id":"VRT005-Q09"},{"text":"Which data remains after closure, and for how long?","id":"VRT005-Q10"}]}]}]}]},"agentConduct":{"may":["Report the status, roles and connected applications of an account to its holder.","Flag weak authentication settings or unusual sign-in activity.","Help the holder export their account data through the service's own tools."],"mustNot":["Obtain, store or reveal account passwords, recovery codes or session tokens.","Create accounts or sign in on someone's behalf without that person's authorisation.","Bypass verification, rate limits or bot detection of a service.","Link accounts across services to the same person without a lawful basis.","Close or delete an account without the holder's instruction."],"requiresHuman":["Recovering access to an account after lost credentials.","Suspending or closing an account for terms violations.","Granting a third-party application access to the account."]},"ethics":{"considerations":["Accounts give access to private communications, purchases and personal data.","Losing access to an account can cut people off from services they depend on.","Linking accounts across services enables tracking and profiling of people."],"affectedParties":["Account holders","Service providers","Contacts and others whose data the account holds"]},"owners":{"steward":"The service provider that operates the account system answers for its records and access controls.","roles":[],"masterSystems":["Identity and access management systems","Customer identity stores of online services"]},"relations":[{"target":"world-r4-identity-register","type":"neighbor","note":"Federated digital identity is held there; an account is local to one service."},{"target":"wm-per-001-person","type":"references","note":"A person may hold many accounts."},{"target":"wm-per-010-contact-point-party-profile","type":"related","note":"Accounts often carry contact points of their holder."}],"interaction":{"identity":{"applicability":"required","items":["An account is identified by a service-scoped identifier, often with a user name, handle or email address.","Federated sign-in links it to an identity provider's subject identifier."]},"properties":{"applicability":"not-applicable","items":[]},"recognition":{"applicability":"optional","items":["An online account has a service-scoped identifier, a holder, authenticators and a status.","Often confused with the person, a federated digital identity or a public profile page."]},"capabilities":{"applicability":"required","items":["Accounts can be created, verified, suspended, recovered, merged and closed.","Accounts can grant scoped access to third-party applications."]},"hazards":{"applicability":"required","items":["Account takeover through phishing, credential stuffing or weak recovery.","Impersonation and fake accounts.","Lock-out and data loss when recovery fails."]},"interfaces":{"applicability":"required","items":["OpenID Connect and OAuth 2.0 for federated sign-in and delegated access.","SCIM (IETF RFC 7643 and RFC 7644) for account provisioning.","W3C WebAuthn for phishing-resistant authentication."]},"context":{"applicability":"required","items":["Used in every online service, platform, game and enterprise application.","Subject to data protection law and to the service's own terms of use."]}},"sources":[{"title":"NIST SP 800-63 Digital Identity Guidelines (NIST)"},{"title":"OpenID Connect Core 1.0 (OpenID Foundation)"},{"title":"RFC 7643 System for Cross-domain Identity Management: Core Schema (IETF)"}],"openQuestions":["Planned model: boundary questions, research and every section remain to be written."],"resources":{"spec":"https://ver.cy/models/wm-vrt-005-online-account/spec.yaml","agents":"https://ver.cy/models/wm-vrt-005-online-account/AGENTS.md"},"provenance":{"origin":"planned (registry candidate)","builtFrom":["models/runtime-index.json","ver-cy/world-models/card-supplements/wm-vrt-005-online-account.json"],"providers":[],"researchStatus":"todo","generatedAt":"","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"filled","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"filled","interaction.context":"filled","sources":"filled"},"notes":{"_":"Planned entry, hidden from the catalogue until researched.","interaction.properties":"An online account is a record in a service with no physical properties to measure.","_supplement":"Sections authored in card supplement 1.0.0 by Claude (Opus 5.5) (2026-10-06, unreviewed). Written from the card's existing content and established practice in the field; no new sources were read. Unreviewed."},"score":1.0}}