Identities

An identity is one of your organization's end users: a nurse, a store manager, a field engineer. They are not administrators, and they do not sign in to Canopy. They sign in to your application, and Canopy answers what they are allowed to do there.

The directory is the list of those people, and it is where most work starts.

Opening a person shows what they hold and lets you change it: assign a role at one of your places, change the role or the dates on an assignment they already have, or remove one. Each of those is the assign capability rather than the reading capability, so an administrator can be able to see the directory in full and change nothing in it. Editing a person's name, resetting their sign-in, and deactivating them are not here: those are account-wide actions.

Every person is either active or deactivated, and the flag is account-wide rather than per place. Deactivating blocks them from signing in immediately, and it is deliberately not a deletion: their memberships, roles, and data stay exactly as they were, and reactivating restores access at once.

Deactivating is one of a set of actions that belong to the account-wide directory rather than to your places. That directory covers every Environment, is a different capability, and is where someone with account-wide authority edits a person's name, sends a password reset, resends a verification email, revokes every session at once, resets multi-factor enrollment when a device is lost, and adds or removes a person's membership of an Environment. Resetting multi-factor removes every enrolled factor and invalidates their recovery codes, so the person enrolls again at their next sign-in.