DRAFT: Identity Practice

Purpose

The Identity Practice is an Enterprise Architecture practice that helps the University of Arkansas manage digital identities and access through shared knowledge, documented patterns, and reusable architecture guidance.

The Identity Practice exists to help the university learn from identity implementations and apply those lessons broadly rather than repeatedly solving the same problems.

Mission

Provide practical architecture guidance that helps university units manage identity and access in a consistent, supportable, and sustainable manner.

The practice supports identity and access management by documenting standards, patterns, decisions, lessons learned, and reference architectures.

Why the Identity Practice Exists

Identity is a shared foundation for university technology.

People, applications, services, devices, and automated processes require identities and permissions to access university systems and data. These identities may span multiple platforms, services, departments, and stages of the university relationship.

Identity decisions affect access to university resources, the protection of university data, and the ability to determine who or what performed an action.

The challenge is not whether identity and access decisions will be made.

The challenge is ensuring that the university can:

  • Apply consistent identity and access patterns
  • Use individual and accountable identities
  • Manage access throughout the identity lifecycle
  • Limit access to what is needed
  • Support appropriate authentication methods
  • Manage privileged and administrative access
  • Connect applications and services to university identity capabilities
  • Document ownership and operational responsibilities
  • Reduce duplicate and inconsistent identity solutions

What the Practice Does

The Identity Practice serves three functions.

Curate

Maintain reusable identity knowledge, including:

  • Standards
  • Patterns
  • Reference Architectures
  • Architectural Decision Records (ADRs)
  • Lessons Learned
  • Roadmaps

Connect

Connect identity consumers with:

  • Existing identity services
  • Application and service owners
  • Data owners and stewards
  • Subject matter experts
  • Architecture guidance
  • Institutional requirements

Accelerate

Help teams move from identity requirements to implementation by providing:

  • Proven approaches
  • Reusable patterns
  • Architecture guidance
  • Integration recommendations
  • Early identification of identity dependencies

The goal is to reduce friction, improve consistency, and make appropriate access easier to implement and support.

Scope

The Identity Practice focuses on architecture and guidance related to:

  • Digital identity architecture
  • Authentication
  • Authorization
  • Single sign-on
  • Multi-factor authentication
  • Account and identity lifecycle management
  • Role and group management
  • Access provisioning and removal
  • Privileged access
  • Service and application identities
  • Workload and agent identities
  • External and guest identities
  • Federated identity
  • Identity integration patterns
  • Access logging and auditability
  • Identity ownership and accountability

Out of Scope

The Identity Practice does not:

  • Operate all identity services
  • Provision or remove every account
  • Approve every access request
  • Determine who has a business need for data
  • Own university data
  • Own application permissions
  • Replace service owners or system administrators
  • Replace human resources, student, affiliate, or other source-system processes
  • Replace security, privacy, compliance, or policy authorities

The practice provides architecture guidance and stewardship.

Access decisions, data decisions, policy decisions, and operational ownership remain with the appropriate stakeholders.

Deliverables

Standards

Examples:

  • Authentication standards
  • Identity integration standards
  • Privileged identity standards
  • Service identity standards
  • Identity logging standards
  • Account lifecycle standards

Patterns

Examples:

  • Single sign-on pattern
  • Multi-factor authentication pattern
  • Role-based access pattern
  • Privileged access pattern
  • Service identity pattern
  • Application identity pattern
  • External user access pattern
  • Workload identity pattern

Reference Architectures

Examples:

  • Enterprise identity architecture
  • Application authentication architecture
  • Privileged access architecture
  • External identity architecture
  • Hybrid identity architecture

Architecture Decision Records

Examples:

  • Authentication method decisions
  • Authorization model decisions
  • Identity source decisions
  • Service account decisions
  • Federation decisions
  • Privileged access decisions

Roadmaps

Examples:

  • Identity platform evolution
  • Authentication capability maturity
  • Identity lifecycle improvements
  • Privileged access improvements
  • Strategic identity capabilities

Relationship to Services

The Identity Practice and identity services are related but distinct.

The Identity Practice stewards architecture knowledge.

Services provide operational capabilities.

Identity Practice Identity Service
Authentication standards Authentication Service
Single sign-on patterns Single Sign-On Service
Multi-factor authentication patterns Multi-Factor Authentication Service
Account lifecycle guidance Account Provisioning Services
Directory architecture guidance Directory Services
Privileged access patterns Privileged Access Services
External identity guidance Guest and External Access Services

A practice may inform one or more services.

A service may be influenced by multiple practices.

Practice stewardship does not imply operational ownership of an identity service.

Operational ownership of an identity service does not automatically imply stewardship of the Identity Practice.

The same individual may participate in both.

Relationship to Other Practices

The Identity Practice works across other Enterprise Architecture practices.

Practice Relationship to Identity
Cloud Practice Uses identity guidance for cloud access, privileged roles, service identities, and workload identities.
AI Practice Uses identity guidance for users, applications, agents, data access, and accountable actions.
Integration Practice Uses identity guidance for API authentication, service authorization, credentials, and system-to-system access.

The Identity Practice does not replace these practices. It provides shared identity guidance that they can apply within their respective areas.

Stewardship

The Identity Practice is maintained through the Enterprise Architecture stewardship model.

The practice may include:

  • A Practice Steward
  • Practice Contributors

Contributors may be drawn from teams responsible for identity services, enterprise applications, cloud platforms, infrastructure, integration, security, support, and other relevant capabilities.

The practice may be active, emerging, or unassigned depending on organizational need.

Participation does not require a dedicated team or full-time role.

The Identity Practice may be established before a permanent steward is assigned. An unassigned practice makes the need for identity architecture stewardship visible without transferring operational ownership from existing teams.

Success Measures

The Identity Practice is successful when:

  • Identity and access decisions become easier to make.
  • Teams can find clear guidance for common identity needs.
  • Reusable patterns reduce repeated effort.
  • Identity integrations become more consistent.
  • Access is connected to identifiable users, applications, services, or processes.
  • Identity lifecycle responsibilities become clearer.
  • Privileged access is easier to identify and manage.
  • Teams engage the appropriate stakeholders earlier.
  • Lessons learned are documented and reused.
  • Identity capabilities are easier to support and evolve.
Print Article