Identity

Placeholder. Corporate login in front of collector, dashboard and MCP server, and mapping of people to teams.

• Reads: identity claims (user, email, groups); team structure from directory sync.

Coverage (tentative priority)

• First: Okta, Microsoft Entra ID, Google Workspace.
• Next: generic OIDC/SAML (Keycloak, Auth0, JumpCloud).
• Team mapping: SCIM or directory groups; fallback a CSV the owner maintains.

Pitfalls

• Harness identity is the vendor account email, often not the corporate one; keep an alias table.
• Contractors and shared accounts break per-user metrics; mark them.
• Per-person views follow the privacy defaults in ../02-measure/METHOD.md.