# Core concepts

Three ideas shape how Prosopia handles access and visibility. Understanding
them makes the rest of the documentation straightforward.

## Identity: the ORCID iD is the proof

A profile is keyed on a canonical ORCID iD. When you log in with ORCID and
your iD matches a profile's, the match *is* the proof of ownership — no
operator approval, no challenge. This is why claiming is self-verifying.

Two login providers are supported: **ORCID** (the primary path — its subject
is the ORCID iD, so only an ORCID login can self-claim) and **Google OIDC**
(can be made an editor or given a permission, but cannot self-claim because
it carries no ORCID iD).

## Ownership, management, and permissions

Three separate things, each with one home:

- **Ownership** is one row per profile: one person owns it. Written in the
  same transaction that creates or claims it, so there is never a moment when
  a profile exists but nobody owns it.
- **Management** is per profile and people-only. The owner can add a
  **co-owner** (everything the owner may do except transfer) or an
  **editor** (rewrite the document; cannot publish, delete, or manage
  access).
- **Permissions** are per *person*, not per profile. A permission says a
  **principal** — a person (from a session cookie) or a consumer app (from an
  API key) — may `read` or `write` everything the granting person holds:
  every profile they own and every lens they wrote. All-or-nothing: there is
  no lab-only permission, and a read permission is a whole read. `write`
  implies `read`.

The operator token is deliberately *not* a principal — it cannot publish,
grant, or take ownership.

## Visibility: tiers and publication

There is no "make this public" toggle. Visibility is decided **per artifact,
per caller, on every read**, through two controls:

1. **Viewer tier.** Each caller resolves to a tier (`public`, `internal`, or
   `restricted`) based on their credential, whether they own or manage the
   profile, and any permission its owner gave them. The tier engine projects
   each artifact down to what that caller may see.

2. **Publication floor.** A profile whose owner has not published it is capped
   at `internal`, no matter what the document declares. A stranger sees
   nothing until the owner publishes.

**Signing in is not a privilege.** A logged-in person with no permission from
a profile's owner sees exactly what the open web sees. Access comes from a
permission or a key, never from merely having an account.

**Publication is consent, not a content change.** It is a separate, recorded,
revocable act that only the person the profile describes can perform. No
ingest path, migration, or bulk import can publish anyone — the schema
enforces this structurally. Unpublishing narrows visibility (back to
`internal`) but does not black out: permission holders and lab consumers keep
reading as they always could.

Paper **full text** sits at a hard floor that nobody can lift — not the
owner, not the operator, not any permission or key tier.