Source, Registry, Governance, and Enforcement Are Distinct Jobs

As organizations move from understanding their risk and change appetite into implementing the modern identity operating model, clarity becomes essential. Teams may use different tools, patterns, and identity stacks, and that is expected. What matters is that the model's core jobs are defined so every identity type can move through the environment consistently.

The operating model depends on four distinct jobs: source, registry, governance, and enforcement. Each identity type, including nonhuman identities, may have its own version of each job. The model still works as long as the jobs are clear.

Source establishes identity truth. This is where authoritative attributes and lifecycle signals originate.

A registry tracks identity across sources. It correlates identities, tracks identity types, and provides a consistent view of identity records, even when separate registries exist for different identity types.

Governance determines what should happen. Access decisions, approvals, lifecycle impact, review, and accountability live here. An identity governance platform may perform much of this work. The important point is not the product, but which job it performs in the model.

Enforcement is where decisions become technically real. Accounts, attributes, groups, and downstream identity representations are applied here. Directories, cloud identity platforms, and application stores enforce accounts and access state.

Identity providers and directories are foundational. That is exactly why their job in the model has to stay clear.

A shared identity layer can improve visibility and consistency. It should support the model, not replace parts of it. A registry solves correlation.

Governance solves accountability. Implementing the operating model means keeping those jobs distinct so the whole system works together.

Start by getting clear on

• • Authoritative sources for each identity type
• • Whether registries already exist
• • What layer makes governance decisions
• • Which platforms enforce identity state
• • Where ownership becomes unclear

Measure

• source to registry alignment
• registry coverage across identity types
• authoritative attribute coverage
• governed attributes enforced downstream
• local overrides to governed state

Architectures can vary. The operating model still has to define how identity truth is sourced, tracked, governed, and enforced.

Once the four jobs are clear, the next challenge is helping people understand, adopt, and sustain them across the organization.

❓Which of the four jobs is least defined in your environment today?