vpd-permission-poc/docs/design/smilegate-identity-administration

Smilegate Backoffice Identity Administration

Goal

Keep admin as the backoffice control-plane login. Provide an administrator-facing model for managing Smilegate PoC tool users, groups, roles, and their assignments. These users are tool operators (for example a Data & AI TF lead or member), not game-service players.

Scope

• SG_APP_USER, SG_APP_GROUP, and SG_APP_ROLE are the application masters.
• SG_USER_ROLE, SG_USER_GROUP, and SG_GROUP_ROLE express normalized user/group/role assignments.
• Every change is recorded in SG_AUDIT_EVENT by the backoffice audit service.
• Existing /users, /groups, and /roles pages use only the SG_* identity model. They must not require the legacy VPD/permission objects to render.

Seed data

Type	Code	Purpose
User	sg-teamlead	Data & AI TF team lead demo operator
User	sg-member	Data & AI TF member demo operator
Group	DATA_AI_TF	Smilegate Data & AI TF
Role	DATA_AI_TEAM_LEAD	Team lead operational role
Role	DATA_AI_TEAM_MEMBER	Team member operational role

Acceptance checks

1. An authenticated admin can open /users, /groups, and /roles.
2. The seed users, group, and roles appear; assignments can be added and removed.
3. Create, activation, role, and group changes are committed atomically and leave an SG_AUDIT_EVENT row.
4. The pages do not call the legacy effective VPD permission matrix.