Research is changing what I think an “identity layer” should actually do

I've been researching identity, ownership, security controls, and operational incidents across engineering and infrastructure teams.

And the more conversations I have, the less I think an identity layer should be limited to authentication.

Authentication answers:

“Who are you?”

But production systems often need to answer much more:

Who are you?
→ Identity

What are you responsible for?
→ Ownership

What are you allowed to do?
→ Authorization

Who is accountable when something changes or fails?
→ Accountability

What is happening in the environment right now?
→ Operational context

That distinction is becoming increasingly important in my research.

A user can be correctly identified while their role has changed.

A service can have an owner recorded in a catalog while the operational responsibility has moved elsewhere.

A security control can be correctly configured while the environment around it changes.

A permission can remain valid technically while the reason it was granted no longer exists.

So the problem isn't always that the identity record is wrong.

Sometimes the identity is correct.

The problem is that the relationships around the identity have drifted.

That's changing how I'm thinking about the infrastructure I'm building.

Instead of treating identity as an isolated authentication layer, I'm exploring whether it should become part of a continuously traceable context:

Identity → Ownership → Authorization → Accountability → Operational State

The goal isn't to replace existing IAM, security, observability, or incident-management systems.

It's to understand whether the relationships between them can remain trustworthy as the environment changes.

I'm still validating this.

And I'm deliberately not assuming that an identity layer is the right answer yet.

For founders and engineers building infrastructure:

Do you think identity should remain primarily an authentication/authorization primitive?

Or should an identity layer eventually understand ownership, accountability, and operational context as well?

I'd especially like to hear from people who have dealt with this at production scale.