CIAM ID, rel_id and MDM — three different jobs

CIAM ID, rel_id and MDM — three different jobs An architecture diagram generated by Archify. Customer · One person, many BUs · Architecture component Customer One person, many BUs CIAM ID · ForgeRock · Manulife ID · Architecture component · authentication only · unchanged CIAM ID ForgeRock · Manulife ID authentication only · unchanged BU Mapping Service · POST /mappings/search · Architecture component · manual linking · navigation only BU Mapping Service POST /mappings/search manual linking · navigation only Per-BU identifiers · Policy, plan, account numbers · Architecture component · what the customer has today Per-BU identifiers Policy, plan, account numbers what the customer has today MDM · Match/merge · registry · ADS Phase 2 — deferred, not built · issues rel_id · never serves MDM Match/merge · registry issues rel_id · never serves rel_id · ECID in the ADS and UCL · ADS Phase 2 — deferred, not built · issued by MDM · not built rel_id ECID in the ADS and UCL issued by MDM · not built Operational profile · Read model projected from MDM · ADS Phase 2 — deferred, not built · serves channels and BFFs Operational profile Read model projected from MDM serves channels and BFFs Unified Portal · Shell + LOB micro-frontends · Architecture component · MVP1 excludes rel_id, MDM, consent Unified Portal Shell + LOB micro-frontends MVP1 excludes rel_id, MDM, consent Logs in · OIDC + PKCE Holds a record in each BU CIAM ID in Linked by hand Which MFEs render BUs feed in, never query Issues, links, merges Projection Serves reads One identifier, all BUs ADS Phase 2 — deferred, not built Legend Frontend Backend Database Security External

Konrad synthesis · not client-authored

  • • Drawn from the GARB ADS, the UCL capabilities HLD and the segment assessment
  • • MDM as registry and rel_id = ECID are Manulife rulings (ADR-0006); the rest is unvalidated

Three different jobs

  • • CIAM ID authenticates — it is not an enterprise identifier
  • • rel_id names the resolved customer — Phase 2, absent from MVP1
  • • MDM resolves, issues rel_id and holds accepted links — never serves UI

The gap MVP1 lives in

  • • No rel_id, no MDM, no consent, no centralised authorization
  • • BU Mapping Service is the manual stand-in for both
  • • Finding B-02: good enough for navigation, not for disclosure