arckit-uae-uaepass

name	arckit-uae-uaepass
description	[COMMUNITY] Generate UAE Pass integration design (OIDC/OAuth flow, claim mapping, Basic vs Verified profile selection, Service Provider onboarding pack, e-signature audit trail design).

⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / federal compliance counsel before reliance. Citations to UAE Cabinet / PDPL / IAS / Cybersecurity Council text may lag the current text — verify against the source.

User Request

$ARGUMENTS

You are an enterprise architect generating a UAE Pass integration design for a UAE federal entity service provider.

Process

1. Read prerequisites:
   • projects/000-global/ARC-000-PRIN-*.md (federal principles, if present)
   • The project's REQ, ARCH, INT, NFR-SEC, and SECD artefacts (if present)
   • .arckit/templates/_partials/RENDERING.md
2. Read the template:
   • First, check .arckit/templates-custom/uae-uaepass-template.md (user override)
   • Then, .arckit/templates-custom/uae-uaepass-template.md
   • Fallback, .arckit/templates/uae-uaepass-template.md
3. Use scripts/bash/create-project.sh --json --name "<project-name>" if the project does not yet exist; otherwise locate it.
4. Use node scripts/generate-document-id.mjs <PROJECT_ID> UPASS --filename for the artefact filename.
5. Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md.
6. Generate the following sections:
   • Scope — which user journeys require UAE Pass authentication, in-scope user populations (citizens, residents, visitors), and the Service Provider category being onboarded.
   • Authentication Flow Diagram — Mermaid sequence diagram showing the OIDC Authorization Code flow with PKCE: user agent, Service Provider, UAE Pass IdP, claim issuance, session establishment.
   • Profile Selection (Basic vs Verified) — per user journey, justify Basic profile (login only) vs Verified profile (KYC + e-signature). Verified profile requires the user to have completed Emirates ID verification at a UAE Pass kiosk or via supported video KYC.
   • Claim Mapping — table mapping UAE Pass claims (sub, idn (Emirates ID), fullnameAR, fullnameEN, mobile, email, nationalityEN, nationalityAR, gender, dob, profileType) to the Service Provider's user record schema, with consent/privacy notes per claim.
   • Service Provider Onboarding Checklist — TDRA / ICP onboarding artefacts (production credentials request, callback URL allow-list, branding pack, security review, go-live checklist).
   • E-signature Audit Trail Design — for journeys that use the Verified profile e-signature, describe how the signed artefact, the signer's UAE Pass identity, the timestamp, and the signature certificate chain are stored for non-repudiation. Cite the UAE Pass e-signature legal effect.
7. Populate the External References section per .arckit/references/citation-instructions.md. The UAE Pass developer documentation MUST appear in the Document Register with its primary URL and the verification date.
8. Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks plus the UPASS per-type checks pass. Fix any failures before proceeding.
9. Write the artefact via the Write tool to projects/<project-id>/<filename>.
10. Show only a summary to the user (one paragraph plus the headline profile selection per journey and any onboarding gaps flagged).

Authoritative anchor

UAE Pass developer documentation (TDRA + ICP). Primary URL: https://docs.uaepass.ae/

Important notes

• UAE Pass is the federal-mandated digital identity for UAE Federal entities. Do NOT design custom username/password authentication in parallel for in-scope citizen/resident journeys.
• Verified profile journeys depend on user-side KYC completion — design a graceful Basic-to-Verified upgrade path for users who arrive without KYC.
• E-signature flows require explicit consent capture before redirecting to the UAE Pass signing endpoint. Capture the consent artefact alongside the signed document.

Suggested Next Steps

After completing this command, consider running:

• $arckit-platform-design -- UAE Pass OIDC endpoints and claim mapping feed the wider integration specification.
• $arckit-adr -- Profile selection (Basic vs Verified) and e-signature mechanism are architecturally significant decisions that warrant an ADR.