User Service overview

Who this is for: teams deciding how identity fits alongside RBAC.

The User Service is a Cognito-backed identity module deployed as part of your Instance: user pools, sign-in flows, and the user lifecycle APIs your product integrates against.

Identity vs permissions

The split is deliberate:

• User Service answers "who is this?" — authentication, user records, sessions.
• RBAC Service answers "what may they do?" — roles, scopes, denies, boundaries.

A signed-in identity from the User Service is the subject of RBAC checks. The two modules compose but neither depends on the other's internals.

Owner bootstrap

Every new Instance seeds an owner — the first Customer Admin identity — plus the namespaced admin role that lets them into the Admin Console. No manual console clicking to get the first admin working.

Directions

• Passwordless sign-in flows are the primary direction for End User auth.
• Bring-your-own IdP via trust policies is planned: federate an existing identity provider while keeping RBAC as the authorization layer.