Component Flow Diagram — customer identity, Manulife Canada

draft — not for client viewingarchitecture

Konrad's reconstruction of the customer identity path, versioned: v1 is the current state drawn from the API landscape inventory and the CIAM login telemetry in the segment assessment; the working file is the target state argued by R1.1 and R1.2. Neither is a client artifact and neither has been validated with Manulife. Must not be shown as Manulife's own picture.

Open the diagram908 KB · standalone, works offline

Guided views

Each opens the diagram with that chapter active.

• One CIAM session, audience-bound tokens — Portal and BU applications share one CIAM browser session; each client receives tokens restricted to its own audience.
• Permission has a source — Entitlement becomes a decision from the identity platform; BU Mapping is demoted to a navigation hint.
• Protected-data delegation — Whenever protected BU data is aggregated: exchange at the boundary so the data owner can verify the customer.
• Unchanged on purpose — ForgeRock still authenticates and the product portals still own servicing. No new identity surface is built.

Versions

1 cut version · the working copy has uncut changes. See the full timeline →

Source

Authored as typed JSON IR at diagrams/src/component-flow.architecture.json. Rendered by Archify; never drawn by hand. Last built Oct 30, 2026, 9:02 PM.