Identify
Which records refer to the same entity?
DeliverablePersistent IDs, crosswalks, match evidence, exception queue
Home Framework
Thought leadership
Enterprise Identity & MDM Framework
A practitioner-led perspective on identity as enterprise infrastructure, not a platform deployment.
- 01Identify
- 02Trust03Understand
- 04Activate
- 05Measure
Executive thesis
Enterprise MDM succeeds when identity becomes trusted infrastructure, authority is explicit, and production consumers turn reusable data into measurable business outcomes. Centralize standards and shared services; federate domain accountability.
Why this point of view matters
The hardest work is not buying matching software. It is defining real-world entities, assigning decision rights, choosing consumption patterns, and proving that teams stop rebuilding their own identity logic.
Designed for
CDOs, CDAIOs, CIOs, MDM leaders, and technology partners evaluating enterprise identity strategy, operating models, and AI readiness.
01 · The five-stage model
Five questions every identity program has to answer
Trust
Who is accountable, and can data be relied upon?
DeliverableAuthority rules, stewardship, quality thresholds, access policies
Understand
What does the entity mean in business context?
DeliverableEntity models, relationships, definitions, hierarchies
Activate
Who consumes trusted identity, and how?
DeliverableProduction data products, APIs, events, native sharing
Measure
What changed for the business?
DeliverableQuality, adoption, and outcome scorecards
Trust and Understand are designed together. The entity model informs authoritative attributes and survivorship; governance decisions refine the model.
A reinforcing operating cycle. Identify creates durable linkage. Trust and Understand co-evolve through governance and entity modeling. Activate establishes consumption. Measure tests match quality, adoption, and business impact, then drives improvements upstream.
Seven practitioner principles
What experience teaches
- Name three production consumers and their outcomes before committing to an MDM platform.
- Resolve identity before attempting enterprise-wide physical consolidation. Use registry, coexistence, or hybrid patterns based on needs.
- Authority is a business decision at the attribute and context level, not a storage-location decision.
- Use the right distribution pattern: native sharing for many analytical consumers; APIs and events for operational decisions.
- Make stewardship a staffed operating capability, with decision rights and exception SLAs.
- Sample both false-positive and false-negative matches. Their consequences differ sharply in regulated domains such as healthcare and financial services.
- Measure adoption and changed workflows, not just record volumes or service throughput.
02 · Architecture
Authority is not storage
Consumption
Unified profiles, service workflows, measurement, segmentation, analytics, and grounded AI use cases.
Distribution
Operational APIs and events for transactional consumers; native data sharing and governed data products for analytical consumers.
Enterprise identity services
Match and link; persistent platform-managed identifiers; crosswalks; survivorship where needed; lineage and stewardship.
Source domains
Member, customer, provider, product, CRM, eligibility, billing, and external data. Preserve source provenance.
Cross-cutting controls
Federated decision rights, quality monitoring, privacy, access control, audit, and observability, applied at every layer.
Choose the MDM pattern to fit the domain
| Pattern | When it fits |
|---|---|
| Registry | Link entities while authoritative source records remain distributed. |
| Consolidation | Create analytical reference views without taking over operational writes. |
| Coexistence | Synchronize selected governed attributes across participating applications. |
| Centralized | Control creation and changes for domains that need a single operational master. |
| Hybrid | Mix patterns across entities and consumers. Often the enterprise reality. |
Extending the model
From golden record to identity graph
The same five stages apply when identity reaches beyond the enterprise's own systems into digital channels.
- Anchor on known identity. Hashed emails, mobile ad IDs, device IDs, and cookies attach to a persistent person and household ID, never replace it.
- Keep the evidence. Record whether each link is deterministic (a login, an exact hash match) or probabilistic (a shared IP, a scored match), with its confidence and source.
- Govern each identifier. Consent, permitted use, and retention differ by identifier type and channel, so policy travels with the link.
- Activate by use case. Measurement and analytics can tolerate probabilistic links that operational or clinical decisions cannot.
Person · householdGlobal ID
EmailPhonePostal
HEMMAIDCTV ID1P cookieIP
03 · Federated governance & AI readiness
Decision rights, made explicit
| Accountable role | Decision rights |
|---|---|
| Executive council | Enterprise priorities, risk tolerance, funding, and cross-domain disputes. |
| Enterprise MDM / data office | Identity standards, shared services, platform patterns, scorecard. |
| Domain owner | Business meaning, attribute authority, thresholds, and source decisions. |
| Data steward | Exception review, quality remediation, hierarchy changes. |
| Security / privacy | Permitted use, authorization, retention, audit. |
| Consuming product owner | Adoption, workflow change, realized benefits. |
Example. Member eligibility status may be authoritative in an enrollment domain, contact preferences in a consent domain, and provider attribution in the relevant care-management domain. Clinical encounters are transactions, not master-data attributes.
Why identity matters for AI
Entity grounding
Link references to the correct person or organization before assembling AI context.
Feature consistency
Align training and inference features to governed identity and time-valid attributes.
Retrieval integrity
Reduce fragmented or conflicting context in search and RAG workflows.
Governed use
Preserve provenance, consent, access policies, and human review for consequential decisions.
04 · Measure what matters
Track quality, consumption, and benefits separately
Trust
Identity resolution coverage; sampled false-positive and false-negative match rates; authoritative-attribute quality; unresolved exceptions and stewardship SLA.
Adoption
Production consumers; share of in-scope applications using enterprise identity; cross-domain reuse; eliminated reconciliation paths.
Business value
First unified profile and improved experience; avoided integration complexity; process cycle time; quantified savings or revenue only when verified.
Coverage alone is not accuracy.Validate sampled match quality against human-reviewed truth sets.
More records per identity is not automatically a defect.In a registry pattern, linked source records are expected linkage, not duplicates to be removed. Don't confuse identity counts with duplicate-record counts.
Throughput is not adoption.Latency and transactions per second indicate platform performance, not business use.
Every KPI needs five things.A denominator, baseline, owner, target, and validation method. Report delivered capabilities separately from dollar-value ROI claims.
Diagnostic lens
Where does your program stand?
Score each stage from 1 to 5. Evaluate evidence, not aspiration.
1 Siloed, manual2 Localized, emerging3 Standards and ownership defined4 Broadly operationalized5 Continuously optimized, with evidenced value
Your profile
Score all five stages to see your profile and where to focus first.
Review it in a 30-minute session