Person

Overview#

Building a complete picture of a person of interest means more than a name and a photo. It means aliases, organisational affiliations, faction membership, behavioural patterns, movement history, and a graph of everyone they connect to. The Person domain is the central POLE (Person, Organisation, Location, Object, Event) record for individual subjects, providing the full profile lifecycle that investigation teams need from first identification through case closure.

Key Features#

Full profile lifecycle management: create, read, update, and delete
Multiple alias tracking for name variants and identity verification
Organisational affiliation mapping with faction classification
Contact information management for phone numbers, email addresses, and social media
Last known location tracking with geographic data
Pattern of life analysis for behavioural and movement patterns
Mission plan association for operational linkage
Graph-based relationship connections with analyst annotations
Threat level classification: Critical, High, Medium, Low, and Unknown
Status tracking: active, inactive, deceased, unknown, and imprisoned

Use Cases#

Relevant sectors include law enforcement, intelligence agencies, and defence.

Building comprehensive profiles of persons of interest with aliases and affiliations
Tracking behavioural patterns and movement data for intelligence analysis
Linking persons to investigations, mission plans, and related entities
Mapping relationship networks through graph connections and associations

Integration#

The Person domain connects with the base profile system, investigation management, graph relationship engine, mission plan operations, and annotation capabilities.

Open Standards#

POLE Data Model (ACPO/Law Enforcement): The domain is the canonical Person entity within the POLE (Person, Organisation, Location, Event) framework, with permission scopes explicitly namespaced as pole:read, pole:write, and pole:enrich.
FIRST Traffic Light Protocol (TLP) 2.0: Every person profile carries a TLP-aligned secrecy classification (TLP:WHITE, TLP:GREEN, TLP:AMBER, TLP:RED) that gates read access based on the requesting user's clearance level.
GraphQL (June 2018 specification): All create, read, update, and delete operations are exposed as typed GraphQL queries and mutations via Strawberry, with role-gated field resolvers for sensitive identifiers.
ISO 3166-1 (Country Codes): Nationality and country fields are validated against ISO 3166-1 alpha-2 and alpha-3 country codes enforced at the domain model layer.
FIPS 197 / NIST SP 800-38D (AES-256-GCM): PII columns (phone numbers, email addresses, tax numbers, identity numbers) are encrypted at rest with AES-256-GCM and bound to the row identifier via authenticated additional data to prevent ciphertext transplantation.
FIPS 198-1 / FIPS 180-4 (HMAC-SHA-256): Blind indexes computed with HMAC-SHA-256 allow equality searches over encrypted PII fields without decrypting stored ciphertext.
RFC 4122 (UUID): All person profile records are identified by version-4 UUIDs, ensuring globally unique, collision-resistant identifiers across tenants.
RFC 7519 / OAuth 2.0 (JWT Bearer, RS256): Every GraphQL resolver requires a valid RS256-signed JSON Web Token verified against a published JWKS endpoint before any profile data is returned or mutated.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14