Over time, dataone users will accumulate multiple institutional accounts that will be linked via equivalent-identity mappings, representable as a graph of identities linked with bidirectional equivalencies (each knows the other as an equivalent identity). These graphs are encapsulated and persisted in collection of Person objects the CN identityManager maintains, and need to be available to entities (CNs and MNs) responsible for authorizing a requestor's action.

Dataone needs to articulate both:
* the desired behavior of authorization with regards to the "transitivity" of permissions across these graphs (does group membership convey? does verified status? is either limited somehow? etc.)
* the responsibilities of each of the players involved in authorizing actions for users (the CNs, CILogon, and the MNs) to meet the desired behavior

Responsibilities for the CNs include:
* what Persons to return in the SubjectInfo, and are they guaranteed to be equivalent identities (can the authorizing agent trust that)?
* is that set of Persons the complete graph?

Responsibilities for CILogon:
* guarantee to return only unadulterated SubjectInfo from getSubjectInfo in the certificate?

For the authorizing entity:
* Does it need to recurse the set of Persons provided with the certificate SubjectInfo, or can it just include all of those subjects?
* Is it expected to call cn.listSubjects() to complete the graph if there are missing Persons from what was provided?
* Does it apply the appropriate restrictions on transitivity if that's the policy?