Unified Identity Model (UIM-001)
Use this skill when mapping OCS scopes to Keycloak roles, defining agent service accounts, or consuming user attributes (division, clearance_level, cost_center) for RBAC and cost allocation.
When to Use
- Mapping capability requiredScopes to Keycloak client roles (e.g., golden:jira:create_issue)
- Defining composite roles for workflows (e.g., onboarding-admin containing capability roles)
- Configuring agent identity (service accounts, client credentials, JWT claims with trace_id)
- Implementing or using Context Injector primitives with ID Token attributes
Instructions
- Role mapping: OCS scope maps 1:1 to Keycloak client role. Use naming golden:{provider}:{action}. Workflow-specific roles must be composite roles containing all required capability roles.
- Agents: Each agent instance uses a dedicated Keycloak service account (e.g., agent-{namespace}-{agentId}). Use Client Credentials flow; embed trace_id in token custom claims for audit.