IT:AD:Account

An Entity (User, Device, Service) can have multiple Identities.

An Identity can be used to start an Account with a Service.

An Account can be associated to one or more Subscriptions. In some cases as the Subscription owner/manager.

EntityPersonDeviceService

EntityRelying Party (RP)PersonDeviceServiceAccountSubscriptionOwner:AccountIdentity1-*