# Identity

Identity is operated as roles + leases.

In this repo:

- roles: `20-identity/roles/`
- policies: `20-identity/policies/`
- leases (time-bound grants): `20-identity/leases/`
- public keys only: `20-identity/keys/public/`

Private keys and plaintext secrets do not belong here.