First-time onboarding

§8 journey 1, drawn for a person assigned Tier 3 access. Every step after the second is blocked by the second - which is the point of drawing this at all.

  1. 01An administrator creates the record

    Done

    Self-registration is prohibited (FR-02). An approved organisational record is created in MOD One and assigned an immutable MOD Person ID - MOD-P-0900007 here. Email and title hang off it as changeable attributes; the ID never changes and is never reused (FR-01).

  2. 02Activation reaches the person - through what?

    OQ-08 open - undesignable

    §8 requires "an approved independent channel". For a person with no account yet, that channel cannot be their Relay mailbox (it may not exist and recovery must not depend on it, FR-11), cannot be MOD One (no account to sign into), and cannot be SMS (not an approved factor at any tier, FR-07). The constraint set may be empty. This step is not designed because it cannot be designed until OQ-08 is answered.

  3. 03Enrol the required authenticator

    Blocked behind step 2

    MFA on every interactive account (FR-07). TOTP satisfies the lower-risk rollout; Tier 3 and privileged access require a phishing-resistant authenticator. This person has Tier 3 access assigned, so the stronger enrolment happens now, not later.

  4. 04Enrol the approved device, validate posture

    Blocked behind step 2

    Runs only when sensitive access is assigned. The device is enrolled, the posture baseline is validated (§7.1), and the result is a verdict that will be re-evaluated at every use - passing today is not a standing pass.

  5. 05The portal shows what this person may reach

    Blocked behind step 2

    Only approved applications, with access status (FR-03). Onboarding ends where daily use begins.

Walk the same journey as the person it happens to:

Walk it as a user

Where this journey ends when the hole is filled:

The portal
Simulated appStart screenAdmin console