Demos
IdentityRM

Which Sarah?

The "Which Sarah?" Problem

User Resolution + Role Resolution

See how IdentityRM resolves both in one call

The Request

"Grant Sarah the Manager role at Platform"

User Problem

47

people named Sarah in your directory

Which one is "Sarah"?

Role Problem

60

roles named "Manager" — no way to scope them

Which one is "Manager"?

The Consequence

Traditional RBAC Wasn't Built for This

47 Sarahs Returned

User lookup exposes full directory

→ Privileged data leaked

Global Roles

"Manager" = same permissions everywhere

→ All or nothing access

Role Sprawl

Platform-Manager, Infra-Manager...

→ 60+ roles, naming chaos
Organization + NodeRoles
Acme Corp
Engineering
Seattle (HQ) ●
Platform ●
Infrastructure ●
London
Marketing
Finance
Agent Persona Engineering / Seattle
User Resolution
Scope Applied
3 Sarahs visible in subtree
"from Seattle"
Strict filter → 1 Sarah
User Match
Sarah Williams @ Seattle HQ
Role Resolution
"Manager at Platform"
Lookup role at target node
Role Match
NodeRole:42 (Manager @ Platform)
Role Granted Sarah Williams Manager @ Platform
Event Stream
Waiting for events...

Complete Audit Trail

2025-01-23 14:32:00 GRANTED

actor: [email protected]

node: Engineering/Seattle/Platform

target: [email protected]

role: Manager (NodeRole:42)

ai_decision_context bound by MCP

agent_id: eng-ops-agent

model: claude-sonnet-4

decision_type: role_assignment

mode: autonomous

✓ user_exists ✓ role_exists ✓ node_exists ✓ role_available_at_node ✓ quota_ok ✓ policy_allows
resolution_trace:

User Resolution

input: "Sarah from Seattle"

filter: strict_node

match: 1/1 unique

Role Resolution

input: "Manager at Platform"

lookup: node_role @ target

match: NodeRole:42

event_template: user_role_grant:sarah.williams:Manager:Platform

Dual Resolution

Natural language in. Validated grant out.

User resolution + Role resolution in one call