The one sentence · every depth
One identity truth governs every actor — human, service, and agent — across three planes: provision, signal, mediate.
Behind CF Access: role resolves from Duo SSO OIDC groups via /cdn-cgi/access/get-identity · outside Access: simulator mode · nav is authz-derived — absent means unrouted · session is a claim, revalidated on interval.