find-out-what-identity-your-tool-receives

The procedure as a graph, on its own page — zoom it, print it, send somebody the address. Back to the record for the steps, the trust panel and the provenance.

Procedure

The same procedure, read in order

  1. start start. Goes next to s1
  2. action Build one tool that reports its caller, RW (reversible-write). Goes on_fail to s9; next to s2
  3. action Register it in the host you will really use, RW (reversible-write). Goes on_fail to s9; next to s3
  4. action Call it as an ordinary user, RO (read-only). Goes on_fail to s9; next to s4
  5. decision What identity actually arrived?. Goes if per_user to s5; if service_only to s6; if differs_by_surface to s7; if default to s9
  6. action Exchange the user token, scoped to them, RO (read-only). Goes on_fail to s9; next to s8
  7. action Decide where consent will live, RO (read-only). Goes on_fail to s9; next to s8
  8. action Pin the scenario to the surface that works, RO (read-only). Goes on_fail to s9; next to s8
  9. check The protocol versions agree. Goes on_fail to s9; next to __end_success
  10. escalate Stop before building on an assumption. Terminal
  11. end success. Terminal