Skip to content

Commit 074e9f0

Browse files
authored
Merge pull request #272 from blindzero/chore/docs
Manual website content review
2 parents 67e5f23 + eaf54d9 commit 074e9f0

18 files changed

Lines changed: 934 additions & 653 deletions

docs/about/concepts.md

Lines changed: 27 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,21 @@ title: IdLE Concepts
33
sidebar_label: Concepts
44
---
55

6-
IdLE is a generic, headless, configuration-driven engine for identity lifecycle automation (Joiner / Mover / Leaver). It intentionally separates intent from implementation: workflows (data-only PSD1 files) declare what should happen, steps implement provider-agnostic, idempotent convergence logic, and providers adapt to external systems and manage authentication.
6+
IdLE is a **generic, headless, configuration-driven engine for identity lifecycle automation** (Joiner / Mover / Leaver). It intentionally **separates intent from implementation**:
77

8-
The engine first builds a deterministic, auditable execution plan from a LifecycleRequest and a workflow (Plan → Execute). Planning validates conditions, inputs, and required provider capabilities; execution runs only the produced plan to ensure repeatability, safe approvals, and reliable auditing. This design prioritizes portability, testability (mockable providers), and minimal runtime assumptions by keeping the core headless and side-effect free.
8+
- **Workflows** (data-only PSD1 files) declare what should happen,
9+
- **Steps** implement provider-agnostic, idempotent convergence logic, and
10+
- **Providers** adapt to external systems and manage authentication.
11+
12+
The engine first builds a **deterministic, auditable execution plan** from a LifecycleRequest and a workflow (Plan → Execute). **Planning validates** conditions, inputs, and required provider capabilities; **Execution runs** only the produced plan to ensure repeatability, safe approvals, and reliable auditing.
13+
This design **prioritizes portability, testability (mockable providers), and minimal runtime assumptions** by keeping the core headless and side-effect free.
914

1015
This page explains the **big picture**: responsibilities, trust boundaries, and how the core artifacts fit together.
1116

1217
## Start here
1318

1419
- If you want to **run IdLE now**: start with [Quick Start](../use/quickstart.md).
15-
- If you want the full end-to-end flow: follow the **Walkthrough**:
20+
- If you want the **full end-to-end flow**: follow the **Walkthrough**:
1621
1. [Workflow definition](../use/walkthrough/01-workflow-definition.md)
1722
2. [Request creation](../use/walkthrough/02-request-creation.md)
1823
3. [Plan build](../use/walkthrough/03-plan-creation.md)
@@ -21,12 +26,12 @@ This page explains the **big picture**: responsibilities, trust boundaries, and
2126

2227
## Goals
2328

24-
- Generic, configurable lifecycle orchestration (Joiner / Mover / Leaver)
25-
- Portable, modular, testable
26-
- Headless core (works in CLI, service, CI)
27-
- Plan-first execution with structured events
29+
- **Generic, configurable lifecycle orchestration** (Joiner / Mover / Leaver)
30+
- **Portable, modular, testable**
31+
- **Headless core** (works in CLI, service, CI)
32+
- **Plan-first execution** with structured events
2833

29-
## Non-goals
34+
### Non-goals
3035

3136
- No UI framework or service host
3237
- No interactive prompts
@@ -41,7 +46,7 @@ This page explains the **big picture**: responsibilities, trust boundaries, and
4146

4247
### Separation of Responsibility
4348

44-
Clear separation of responsibility is the essential foundation for maintainability:
49+
**Clear separation of responsibility** is the essential foundation for maintainability:
4550

4651
- **Engine**
4752
- Orchestrates workflow execution
@@ -67,7 +72,7 @@ If you want the practical version of this (how to supply providers/auth in a run
6772

6873
## Request
6974

70-
A **request** represents your business intent (Joiner/Mover/Leaver) plus the input data required to build a plan.
75+
A **request represents your business intent** (Joiner/Mover/Leaver) plus the input data required to build a plan.
7176

7277
Typical request content:
7378

@@ -81,61 +86,54 @@ Hands-on: [Walkthrough 2: Request creation](../use/walkthrough/02-request-creati
8186

8287
## Workflow
8388

84-
A **workflow** is a data-only definition (`.psd1`) that describes **what** should happen, step by step.
89+
A **workflow is a data-only definition** (`.psd1`) that describes **what** should happen, step by step.
8590

86-
### Workflows and Steps
91+
### Workflow Steps
8792

88-
A workflow consists of ordered steps. Each step references a **StepType** by name and provides configuration under `With`.
93+
A **workflow consists of ordered steps**. Each step references a **StepType** by name and provides configuration under `With`.
8994

90-
Hands-on: [Walkthrough 1: Workflow definition](../use/walkthrough/01-workflow-definition.md).
91-
Specification: [Use → Workflows](../use/workflows.md) and the [Reference section](../reference/steps.md).
95+
- Hands-on: [Walkthrough 1: Workflow definition](../use/walkthrough/01-workflow-definition.md).
96+
- Specification: [Use → Workflows](../use/workflows.md) and [Reference section](../reference/steps.md).
9297

9398
### Providers
9499

95-
Workflows may reference providers by alias (for example: `With.Provider = 'Identity'`), but the actual provider instances are supplied by the host.
100+
**Workflows reference providers** by alias (for example: `With.Provider = 'Identity'`), but the actual provider instances are supplied by the host. Providers implement step capabilities specifically for each endpoint system.
96101

97102
Hands-on: [Walkthrough 5: Providers and authentication](../use/walkthrough/05-providers-authentication.md).
98103

99104
### Declarative conditions
100105

101-
Workflows can include declarative conditions (data-only) to decide whether steps should run.
106+
**Workflows can include declarative conditions** (data-only) to decide whether steps should run.
102107
For details, use the Reference workflow documentation.
103108

104109
---
105110

106111
## Plan
107112

108-
A **plan** is the validated, resolved execution contract produced from a workflow and a request.
113+
A **plan is the validated, resolved execution contract** produced from a workflow and a request.
109114

110115
Hands-on: [Walkthrough 3: Plan build](../use/walkthrough/03-plan-creation.md).
111116

112117
### Provider Capabilities (Planning-time Validation)
113118

114-
IdLE can validate required capabilities at plan-build time (fail-fast), if providers are supplied.
119+
**IdLE validates required capabilities** at plan-build time (fail-fast) against supplied providers.
115120
This prevents discovering missing requirements only at execution time.
116121

117122
### Plan export
118123

119-
Plans can be exported for review, approval, CI artifacts, and audit trails.
124+
**Plans can be exported** as a JSON file for review, approval, CI artifacts, and audit trails.
120125

121126
Hands-on: [Use → Plan Export](../use/plan-export.md).
122127

123128
---
124129

125130
## Execute
126131

127-
Executing a plan runs the steps in order and produces a structured result.
132+
Executing a plan **runs the steps in order as planned** and produces a structured result.
128133

129134
Hands-on: [Walkthrough 4: Invoke and results](../use/walkthrough/04-invoke-results.md).
130135

131136
### Eventing
132137

133-
IdLE emits structured events during execution.
138+
**IdLE emits structured events** during execution.
134139
Your host can log them, forward them, or store them for audit and diagnostics.
135-
136-
---
137-
138-
## Next
139-
140-
- Run the minimal end-to-end example: [Quick Start](../use/quickstart.md)
141-
- Continue with deep details: [Reference](../reference/intro-reference.md)

docs/about/intro.md

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,34 +9,35 @@ sidebar_label: Introduction
99

1010
## Introduction
1111

12-
IdLE (Identity Lifecycle Engine) is a **generic, configurable orchestration framework** for identity lifecycle processes
12+
IdLE (Identity Lifecycle Engine) is a **generic, configurable orchestration framework for identity lifecycle processes**
1313
(Joiner / Mover / Leaver and similar cases), built for **PowerShell 7+**.
1414

1515
---
1616

1717
## Why IdLE exists
1818

19-
JML (joiner/mover/leavers) processes are
19+
**JML (joiner/mover/leavers) processes** are
2020

21-
- error prone, especially if performed manually
22-
- time consuming and therefore
23-
- quite annoying for operators
21+
- **error prone**, especially if performed manually
22+
- **time consuming** and therefore
23+
- quite **annoying for operators**
2424

25-
Self-made identity lifecycle automation often turns into long scripts that are:
25+
**Self-made identity lifecycle automation** often turns into long scripts that are:
2626

27-
- tightly coupled to one environment
28-
- hard to test
29-
- hard to change safely
27+
- **tightly coupled to one environment**
28+
- **hard to test**
29+
- **hard to change** safely
30+
- **hard to maintain**
3031

31-
Identity Management Systems (IdMS) on the other side are either complex or expensive (or both of it) and then often do not care about supplementary systems that also need to be covered within the workflows.
32+
**Identity Management Systems (IdMS)** on the other side are **either complex or expensive** (or both of it) and then often do not care about supplementary systems that also need to be covered within the workflows.
3233

3334
---
3435

3536
## Start using IdLE
3637

37-
- If you want to run IdLE now: start with [Quick Start](../use/quickstart).
38-
- If you want a guided path: follow the [Walkthrough](../use/walkthrough/01-workflow-definition).
39-
- If you want the architecture and responsibility model: read [Concepts](./concepts).
38+
- If you want to **run IdLE now**: start with [Quick Start](../use/quickstart).
39+
- If you want a **guided path**: follow the [Walkthrough](../use/walkthrough/01-workflow-definition).
40+
- If you want the **architecture and responsibility model**: read [Concepts](./concepts).
4041

4142
---
4243

@@ -68,4 +69,6 @@ Workflows and requests remain data-only.
6869
- [Installation](../use/installation.md)
6970
- [QuickStart](../use/quickstart.md)
7071
- [Walkthrough - Step 1: Workflow Definition](../use/walkthrough/01-workflow-definition.md)
71-
- [Reference](../reference/intro-reference.md)
72+
- More details on
73+
- [Concepts](./concepts)
74+
- [Security](./security.md)

docs/about/security.md

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Security and Trust Boundaries
33
sidebar_label: Security
44
---
55

6-
IdLE is designed to execute **data-driven** identity lifecycle workflows in a deterministic way.
6+
IdLE is designed to **execute data-driven identity lifecycle workflows** in a deterministic way.
77

88
Because IdLE is an orchestration engine, it must be explicit about **what is trusted** and **what is untrusted**.
99

@@ -13,53 +13,58 @@ IdLE enforces a strict trust boundary between **untrusted data inputs** and **tr
1313

1414
### Untrusted inputs (data-only)
1515

16-
These inputs may come from users, CI pipelines, or external systems and **must be treated as untrusted**:
16+
These inputs may come **from users, CI pipelines, or external systems** and **must be treated as untrusted**:
1717

1818
- Workflow definitions (PSD1)
1919
- Lifecycle requests (input objects)
2020
- Step parameters (`With`, `When`)
2121
- Provider configuration maps (e.g., `Providers` passed into plan execution)
2222
- Event payloads (`Event.Data`) emitted by steps/providers
2323

24-
**Rule:** Untrusted inputs must be *data-only*. They must not contain ScriptBlocks or other executable objects.
24+
:::info
25+
**Rule:** Untrusted inputs **must be *data-only***. They must not contain ScriptBlocks or other executable objects.
26+
:::
2527

26-
IdLE enforces this by:
28+
**IdLE enforces** this by:
2729

28-
- Rejecting ScriptBlocks when importing workflow definitions
29-
- Validating inputs at runtime using the public `Assert-IdleNoScriptBlock` function (provided by `IdLE.Core`)
30-
- Recursively scanning all hashtables, arrays, and PSCustomObjects for ScriptBlocks
30+
- **Rejecting ScriptBlocks** when importing workflow definitions
31+
- **Validating inputs** at runtime
32+
- **Recursively scanning** all hashtables, arrays, and PSCustomObjects for ScriptBlocks
3133

3234
**Implementation:**
3335

34-
- The `Assert-IdleNoScriptBlock` function is the single, authoritative validator for this boundary
36+
The public `Assert-IdleNoScriptBlock` function is the single, authoritative validator for this boundary
37+
3538
- It performs deep recursive validation with no type exemptions
3639
- All workflow configuration, lifecycle requests, step parameters, and provider maps are validated
3740
- Validation failures include the exact path to the offending ScriptBlock for debugging
3841

3942
### Trusted extension points (code)
4043

41-
These inputs are provided by the host and are **privileged** because they determine what code is executed:
44+
These inputs are **provided by the host** and are **privileged** because they determine what code is executed:
4245

43-
- Step registry (maps `Step.Type` to a handler function name)
44-
- Provider modules / provider objects (system-specific adapters)
45-
- External event sinks (streaming events)
46+
- **Step registry** (maps `Step.Type` to a handler function name)
47+
- **Provider modules** / provider objects (system-specific adapters)
48+
- **External event sinks** (streaming events)
4649
- **AuthSessionBroker** (host-provided authentication orchestration)
4750

51+
:::info
4852
**Rule:** Only trusted code should populate these extension points.
53+
:::
4954

5055
These extension points may contain ScriptMethods (e.g., the `AcquireAuthSession` method on AuthSessionBroker objects) but should not contain ScriptBlock *properties* that could be confused with data.
5156

5257
#### AuthSessionBroker Trust Model
5358

5459
- The broker is a **trusted extension point** provided by the host
55-
- It orchestrates authentication without embedding secrets in workflows
60+
- It **orchestrates authentication** without embedding secrets in workflows
5661
- Broker objects may contain ScriptMethods (e.g., `AcquireAuthSession`) as part of their interface
5762
- Broker objects must **not** contain ScriptBlock properties; all logic should be in methods or direct function calls
58-
- Authentication options passed to `AcquireAuthSession` are validated as data-only (no ScriptBlocks)
63+
- **Authentication options** passed to `AcquireAuthSession` are validated as **data-only** (no ScriptBlocks)
5964

6065
## Secure defaults
6166

62-
IdLE applies secure defaults to reduce accidental code execution:
67+
IdLE applies **secure defaults** to reduce accidental code execution:
6368

6469
- Workflow configuration is loaded as data and ScriptBlocks are rejected.
6570
- Step registry handlers must be function names (strings); ScriptBlock handlers are rejected.
@@ -91,7 +96,7 @@ Redaction happens for:
9196

9297
### Where redaction is applied
9398

94-
Redaction is intentionally centralized at output boundaries to keep the execution model unchanged and to avoid altering step/provider behavior while making outputs safe-by-default.
99+
**Redaction is intentionally centralized** at output boundaries to keep the execution model unchanged and to avoid altering step/provider behavior while making outputs safe-by-default.
95100

96101
Redaction is applied **before** data is:
97102

@@ -107,7 +112,7 @@ Redaction is applied **before** data is:
107112

108113
## Guidance for hosts
109114

110-
- Keep workflow files in a protected location and review them like code (even though they are data-only).
111-
- Load step and provider modules explicitly before execution.
112-
- Treat the step registry as privileged configuration and do not let workflow authors change it.
115+
- **Keep workflow files in a protected location** and review them like code (even though they are data-only).
116+
- **Load step and provider modules explicitly** before execution.
117+
- Treat the **step registry as privileged configuration** and do not let workflow authors change it.
113118
- If you stream events, implement a small sink object with a `WriteEvent(event)` method and keep it side-effect free.

docs/reference/specs/plan-export.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ This bound prevents unbounded snapshot artifacts while keeping the marker audita
166166
```json
167167
"plan": {
168168
"id": "plan-001",
169-
"mode": "PlanOnly",
169+
"mode": null,
170170
"steps": []
171171
}
172172
```
@@ -177,7 +177,7 @@ This bound prevents unbounded snapshot artifacts while keeping the marker audita
177177
| ------ | ------------ |
178178
| id | Unique identifier of the plan |
179179
| createdAt | (Optional) ISO-8601 UTC timestamp |
180-
| mode | Plan lifecycle state |
180+
| mode | Plan lifecycle state (`null` when not explicitly set on the plan object) |
181181
| steps | Ordered list of step objects |
182182

183183
---

docs/use/installation.md

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,15 @@ Get-InstalledModule IdLE, IdLE.Core, IdLE.Steps.Common -ErrorAction SilentlyCont
3535
Install-Module -Name IdLE -Scope CurrentUser -Force
3636
Import-Module -Name IdLE
3737
```
38+
3839
:::
3940

4041
---
4142

4243
## Install optional modules
4344

4445
Providers and additional step modules are published as separate modules and can be installed independently.
46+
See the [reference](../reference/intro-reference.md) for further details on [Steps](../reference/steps.md) and [Providers](../reference/providers.md).
4547

4648
```powershell
4749
# Provider modules (examples)
@@ -56,32 +58,33 @@ Install-Module -Name IdLE.Steps.Mailbox -Scope CurrentUser
5658
Install-Module -Name IdLE.Provider.Mock -Scope CurrentUser
5759
```
5860

59-
Import only what you need:
60-
61-
```powershell
62-
Import-Module -Name IdLE.Provider.Mock
63-
Import-Module -Name IdLE.Provider.AD
64-
```
6561

6662
:::tip
6763
If a workflow references a StepType from an optional steps module, that steps module must be installed and imported in the host session.
6864
:::
6965

7066
---
7167

72-
## Install from repository source (contributors)
68+
## Install from repository source
69+
70+
:::info
71+
This installation method is primarily for fetching full example files, testing, and contributing.
72+
:::
7373

7474
This path is intended for development and contribution scenarios.
7575

7676
```powershell
7777
git clone https://github.com/blindzero/IdentityLifecycleEngine
7878
cd IdentityLifecycleEngine
7979
80-
# Import meta module (bootstraps module discovery for repo layout)
80+
# Import meta module
8181
Import-Module ./src/IdLE/IdLE.psd1 -Force
8282
```
8383

84-
After importing from source, you can import additional modules by name:
84+
:::info
85+
The meta module bootstraps module discovery for the repository layout. Avoid using this in parallel with an IdLE installation from the PowerShell Gallery.
86+
After importing from source, you can import additional modules by name.
87+
:::
8588

8689
```powershell
8790
Import-Module IdLE.Provider.Mock -Force
@@ -93,8 +96,11 @@ Import-Module IdLE.Steps.Mailbox -Force
9396
## Verify installation
9497

9598
```powershell
96-
Get-Module IdLE -ListAvailable | Select-Object Name, Version, Path
99+
Get-Module IdLE* -ListAvailable | Select-Object Name, Version, Path
100+
# Public-facing user commands
97101
Get-Command -Module IdLE | Sort-Object Name
102+
# Public interface functions from modules
103+
Get-Command -Module IdLE.* | Sort-Object Name
98104
```
99105

100106
---

docs/use/intro-use.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,5 +42,5 @@ Reference pages are the single source of truth for schemas and cmdlet details.
4242
## When to use other sections
4343

4444
- If you want the **big picture** (responsibilities, trust boundaries, architecture): see [Concepts](../about/concepts.md)
45-
- If you want to **extend IdLE** (write steps, providers, host integrations): see [Extend](../extend/intro-extend.md)
4645
- If you need **specification-level details**: see [Reference](../reference/intro-reference.md)
46+
- If you want to **extend IdLE** (write steps, providers, host integrations): see [Extend](../extend/intro-extend.md)

0 commit comments

Comments
 (0)