# Identity & Access — Final UX and Ownership Contract

## Navigation ownership

Permanent sidebar navigation should expose stable administration areas, not workflow steps.

### Sidebar

- **Users** — workspace identity directory and lifecycle entry point.
- **Roles & Permissions** — roles, permission catalog, permission matrix, teams and departments.
- **My Security** — the signed-in user's own sessions and devices.

### Contextual user workflows

These routes remain real application screens but are intentionally not permanent sidebar items:

- `/users/create`
- `/users/edit`
- `/users/details`
- `/users/activity`
- `/users/sessions`
- `/users/login-history`
- `/users/devices`
- `/users/api-keys`

The user directory exposes **Add user**. Each user row exposes **View details**, **Edit user**, **View activity** and **Review sessions**. The user details experience provides contextual tabs for overview, activity, sessions, login history, devices and API keys.

## Create-user flow

1. Enter full name and work email.
2. Assign primary role and team.
3. Choose **Invite by email** or **Provision account**.
4. Set initial lifecycle status.
5. Apply MFA and notification policy.
6. Submit the request to the buyer's connected identity backend.

The admin UI does not collect passwords, SSO credentials, recovery secrets or MFA enrollment secrets. Authentication belongs to the buyer's identity service/backend.

## Edit-user flow

Open a user from the directory, select **Edit user**, then update profile, role/team assignment, lifecycle status and security requirements. Suspending a user is an administrative intent; the production backend must revoke/limit active authorization and sessions.

## User details

The details workspace is the administrative source of context for one identity. It links to activity, sessions, login history, devices and personal API keys without adding those views to the global sidebar.

## RBAC boundary

Vexlora presents role and permission intent in the frontend. Production authorization must still be enforced server-side against the authenticated actor, tenant/workspace, resource and action. UI hiding alone is never authorization.

## Readability

Primary Identity & Access page metadata uses the shared 13px `text-compact` floor or normal 14px body text. Dense 12px page copy is not used in the finalized identity administration components.