KuppingerCole 2nd Level Reference Architecture for CIAM

Customer Identity and Access Management (CIAM) is positioned as a distinct discipline from workforce IAM because it sits at the intersection of security, privacy, user experience, business enablement, and regulatory compliance, while operating at massive scale. The KuppingerCole 2nd Level Reference Architecture for CIAM adapts the master Identity Fabric and IAM Reference Architecture into a CIAM-specific capability map that preserves the same structural grid (four functional columns and six execution context rows) but removes workforce-centric elements and adds capabilities focused on trust, consent, personalization, external federation, and resilient operations across hybrid, multi-cloud, and SaaS environments.

CIAM’s key challenges include handling millions of identities with spiky traffic, treating UX as a conversion and retention lever, embedding privacy principles like data minimization and purpose limitation, supporting federated/social/decentralized identity ecosystems, and modeling complex relationships such as B2B2C delegation and household sharing. Foundational principles emphasize user-centric design, modular capabilities, built-in compliance, federation-ready API-first integration, operational resilience, and readiness for emerging models like verifiable credentials and tokenized consent.

Core capabilities span identity repositories, proofing, consent and preference administration, self-service account management, lifecycle and workflow management (focused on integrity and state transitions), entitlement management tied to subscriptions and contracts, organizational identity and KYB, progressive profiling, consent/legal audit logging, security event logging, risk scoring, user behavior analytics, and AI agent identity governance. Privileged CIAM focuses on externally delegated power (tenant admins, guardians) via delegated administration, tenant isolation management, federated trust governance, privileged oversight, and step-up authority for sensitive actions. Extended and integration layers add journey orchestration, privacy UX controls, omnichannel synchronization, telemetry, decentralized wallet-based identity, and ecosystem integrations (fraud, ITDR, CDP/DMP, customer support, proofing, payments). An API layer operationalizes these capabilities as an identity control plane rather than a monolith.

• The CIAM reference architecture preserves four functional columns: Administration, Audit & Analytics, Authentication, and Authorization.
• The model uses six execution context rows: Core, Privileged, Extended, Integrations, API, and Foundation.
• CIAM capabilities are associated with time phases: Admin-Time, Session Initialization, Session Management, and Post-Event Time.
• Identity scope includes Consumers, Citizens, Customers in B2B contexts, Partners, AI Agents, and Organizational Identities.
• Consent & Preference Administration versions legal artifacts such as privacy notices and Terms & Conditions and links user actions to effective versions.
• Consent & Legal Audit Logging preserves immutable, timestamped records of consent and Terms & Conditions acceptance events.
• Security & Access Event Logging captures authentication, authorization, and session events for threat detection and forensic analysis.
• Organizational Identity & KYB Management includes corporate registry verification, beneficial ownership validation, sanctions/watchlist screening, and contract-based eligibility checks.
• Federated Authorization supports OAuth 2.0 and OpenID Connect and can include UMA and Rich Authorization Requests (RAR).
• Strong Customer Authentication requires at least two factors from different categories: knowledge, possession, and inherence.

• “CIAM is no longer a subset of Identity and Access Management (IAM) - it is a distinct discipline with its own set of priorities, capabilities, and architectural patterns.”
• “Identity flows (registration, login, consent) are often the first touchpoint in digital customer journeys.”
• “Make consent, privacy, and auditability intrinsic to the identity system - not bolted on.”
• “CIAM directory services must provide high availability, low-latency lookups, and secure replication where needed across regions or brands.”
• “Unlike simple role assignment, this capability models identity relationships with formal authority semantics and lifecycle governance.”
• “This capability forms part of the operational backbone of CIAM platforms and should not be confused with customer journey optimization or marketing-driven orchestration.”
• “AI agents are subject to the same - or stronger - authentication, authorization, and audit controls as human identities.”
• “Instead of permanently assigning broader rights, this capability enforces temporary, context-bound elevation tied to a specific action, purpose, or time window.”
• “It is important to distinguish clearly between capabilities and APIs.”
• “By centralizing identity interaction through well-defined APIs, the CIAM platform becomes an identity control plane rather than a monolithic application component.”