UID Identity Layer — Synthetic Prototype

STEP 1 — FRAGMENTED RECORDS (TODAY)

Three systems hold their own copies of the same people — with different spellings, no shared identity, and one record too ambiguous to trust:

HR-SYS

SOURCE REC	NAME	DOB	INSURANCE
SR-HR-3341	JORDAN A. MICHAELS	1996-04-12	ACTIVE
SR-HR-3342	RILEY T. CARTER	1994-08-30	ACTIVE
SR-HR-3343	RILEY T. CARTER	1999-01-17	PENDING

MED-SYS

SOURCE REC	NAME	DOB	CLEARANCE
SR-MED-88231	JORDAN MICHEALS SPELLING VARIES	1996-04-12	FIT
SR-MED-4402	R. CARTER NO DOB — AMBIGUOUS	—	?

TRN-SYS

SOURCE REC	NAME	DOB	TRAINING
SR-TRN-A19F	M. MICHAELS SPELLING VARIES	1996-04-12	CURRENT

Source records stay exactly as they are — the identity layer never overwrites them. Two different people share one name; one record has no date of birth and could belong to either. Nothing talks to anything.

STEP 2 — IDENTITY REVIEW GATE

The engine proposes candidate links. A human approves or rejects each one — no silent merging:

CANDIDATE LINK	EVIDENCE	DECISION
SR-HR-3341 + SR-MED-88231 + SR-TRN-A19F → UID 4X7Q-92	DOB matches on all three; name is a spelling variant of one person	PROPOSED
SR-HR-3342 → UID 9ZK1-04 · SR-HR-3343 → UID 7TT8-55	Same name, different DOB — two different people, must stay separate	PROPOSED
SR-MED-4402 → ?	No DOB, initial-only name — could match either CARTER or neither	PENDING REVIEW

Provenance stored per mapping: which source records, what evidence, who approved, when. The ambiguous record stays unresolved — by design.

0 of 2 mappings approvedREVIEWER: HUMAN (REQUIRED)

STEP 3 — AUTHORIZED LOOKUP

SIMULATED ROLE:

QUERY UID:

RESPONSE PAYLOAD — fields returned per illustrative policy (production: enforced server-side)

FIELD	VALUE	SOURCE RECORD
Approve the identity mapping in Step 2, then run a lookup.

AUDIT TRACE

awaiting query…

IDLE UID = IDENTITY · POLICY = AUTHORIZATION · THEY ARE SEPARATE

Knowing a UID identifies an entity — it grants nothing. Fields you are not cleared for are absent from the payload (shown masked for the demo). The ambiguous record cannot be queried as a person until a human resolves it. In production the real matching and policy logic runs server-side and stays closed-source; this browser demo is a simulation with synthetic data.