Digital Identity & Access Management
Relevant source files
The following files were used as context for generating this wiki page:
Digital Identity & Access Management (DIAM) within the RDM Digital ecosystem is a sovereign, federated framework designed to manage citizen, merchant, and institutional identities. It operates under the "Sovereign Identity" philosophy, ensuring that digital presence is anchored to the territory of Real del Monte while maintaining interoperability through the TAMV MD-X4 kernel. The system integrates Supabase Auth with custom PostgreSQL schemas to handle hierarchical roles and immutable audit logs.
The architecture emphasizes "Sovereign Identity" (Identidad Soberana), where users possess persistent digital personas that are verifiable and auditable. This system moves away from traditional surveillance-based identity models towards a dignity-centric approach, utilizing cryptographic signatures and federated modules to manage access across different domains like economy, technology, and health.
Identity Architecture & Data Model
The identity system is built upon a multi-layered PostgreSQL schema that extends the default Supabase auth.users table. The core component is the public.profiles table, which stores extended user metadata, including roles and sovereign identifiers like ORCID or citizenship IDs.
The diagram shows the relationship between core authentication and the extended sovereign identity profile.
Sources: scripts/001_rdm_schema.sql:17-40, scripts/001_rdm_schema.sql:102-108
Key Identity Components
| Component | Description | Data Structure |
|---|---|---|
| Sovereign Profile | Extends base auth with civilizational metadata. | public.profiles table |
| Citizen Wallet | Stores reputation and TAMV credits for economic participation. | public.wallets table |
| Role Badges | Visual representation of federated permissions in the UI. | ROLE_BADGES constant |
| Audit Logs | Immutable trace of identity-related events and analytics. | public.analytics / public.audit_log |
Sources: src/pages/Identidad.tsx:9-15, scripts/001_rdm_schema.sql:102-108, scripts/001_rdm_schema.sql:226-236
Access Control & Federated Roles
Access management is governed by a hierarchical role system. Roles are divided into administrative, operational, and commercial tiers, each granting specific capabilities within the federated modules.
Role Definitions
The system utilizes both a primary role within the profiles table and a many-to-many relationship in the user_roles table to manage complex permissions.
- Admin (Operador soberano): Full access to the Nodo Cero kernel.
- Operator (Operador federado): Management of specific domains and protocols.
- Merchant (Comercio activo): Participation in the Federated Sovereign Market.
- User/Tourist (Ciudadano TAMV): Basic identity for network interaction.
Sources: src/pages/Identidad.tsx:9-15, supabase/migrations/20260512080845_110fe96e-4027-403f-98c8-f6d495c1bf4c.sql:104-124
Role Verification Logic
The system uses a PostgreSQL function has_role(required_role) to validate permissions during database operations and Edge Function execution.
The flow describes how Edge Functions validate identity before executing protected protocols.
Sources: supabase/functions/protocols-execute/index.ts:7-13, supabase/migrations/202605080001_lovable_federated_kernel.sql:3-10
Onboarding & Lifecycle Management
Identity creation is automated via PostgreSQL triggers that execute upon user signup in Supabase Auth. This ensures that every new user is initialized with a default profile and a citizen wallet.
Automated Provisioning
The handle_new_user() function parses metadata from the auth provider to set initial roles and display names.
-- Trigger: auto-create profile + wallet on signup
create or replace function public.handle_new_user()
returns trigger language plpgsql security definer as $$
begin
insert into public.profiles (id, display_name, role)
values (new.id, coalesce(new.raw_user_meta_data ->> 'display_name', 'ciudadano'));
insert into public.wallets (user_id) values (new.id);
return new;
end;
$$;
Sources: scripts/001_rdm_schema.sql:242-261, supabase/migrations/20260512080845_110fe96e-4027-403f-98c8-f6d495c1bf4c.sql:104-142
Identity Sovereignty & Ethics
The DIAM system is not merely technical but philosophical, as detailed in the "Declaración del Arquitecto". It rejects surveillance capitalism in favor of "Identity by Design" and "Protection by Design".
Identity Governance Principles
- Sovereign Identity (F1): The first layer of the 7-layer federated canon.
- Dignity Statute: Identity metrics focus on "efficiency of care" rather than screen time.
- Auditability: Every significant action generates a traceable reasoning graph (XAI) or an entry in the audit log signed by the responsible architect.
Sources: src/components/rdm/architect.tsx:64-75, src/components/rdm/isabella.tsx:75-95, src/components/rdm/tomos.tsx:1-50
Conclusion
The Digital Identity & Access Management system in RDM Digital serves as the foundational "Layer 1" of the heptafederated kernel. By combining automated provisioning, hierarchical federated roles, and a sovereignty-first data model, it provides a secure and ethical framework for territorial digital operations. The system ensures that all technical executions remain strictly governed by the project's ontological and constitutional framework.