In the webshop's state table, compare case 1.1 (new in the CRM, rest unknown) with case 1.3 (not in the CRM, new in the self-service). Why does one user get an initial password and a company, and the other neither?
In 1.1 sales create the user, so nobody has chosen a password yet and the provisioning must assign an initial one, and the company comes from the CRM; in 1.3 the customer registers personally, choosing their own password, and as a private customer has no company.
| 1.1: created via the CRM | 1.3: created via self-service | |
|---|---|---|
| Who starts it | Sales, after a contract | The customer, by registering |
| Password | Initial password assigned by the system | Chosen by the customer at registration |
| Company | Set from the CRM | None: a private customer |
| Self-service afterwards | Not yet known there | The user exists there |
The comparison teaches the core idea of the table: the source of creation decides which attributes exist and which password LCP step runs. The same object, an IdP user, enters its life cycle by two doors and ends up in two different states.
It also points at follow-up work. In 1.1 the user holds a password they have never seen, so the password LCP must define how the initial password reaches the user securely and whether it has to be replaced at first login. And in 1.1 the self-service does not know the user yet, so the account LCP must define what happens when that business user first opens the self-service.
Go deeper:
NIST SP 800-63B: Password authenticators — passwords are either chosen by the subscriber or assigned randomly by the provider, exactly the two doors of cases 1.3 and 1.1.