I think I get it. The idea is that you assign capabilities based on whatever authentication mechanism. Access to read email sent to this email address, access

I think I get it. The idea is that you assign capabilities based on whatever authentication mechanism. Access to read email sent to this email address, access to withdraw money from this bank account, etc. The way a lot of people think about this is that a set of permissions is associated with a person with a Real Name and then a person with a Real Name is associated with an account or some other context. But the middle step is irrelevant from a technical perspective. Your name isn't a secret and can't reasonably be used for any kind of authentication. It's effectively an alphabetic account number. Using the same Name for all of your accounts is only useful if you want to give companies the ability to correlate them all, which is often the opposite of what you want. If you take it out you're left with a set of capabilities associated with an authentication context, which works just as well from a technical perspective and doesn't have that problem.