# Identity Provider Boundaries

## Ownership

- `IUserDataProvider`: user aggregate persistence provider boundary.
- `IRoleDataProvider`: role aggregate persistence provider boundary.
- `IPermissionDataProvider`: permission aggregate provider boundary.
- `IModuleDataProvider`: module aggregate provider boundary.
- `ITenantDataProvider`: tenant aggregate provider boundary.

## Rules

- Providers isolate datastore-specific behavior.
- Provider boundaries remain internal to Thalos DAL.
- Identity abstractions remain Thalos-owned.