Deny Identity Case

One case in the operator queue: the identifiers, plus what a human needs to recognise them.

The identifiers are the record and the label beside them is orientation. The candidate's name is optional and mutable — an account is deleted and its name goes with it — so it is served next to the stable id it describes rather than in place of it, and a missing label says so instead of rendering blank.

This row carries the captured address, and that reverses an earlier decision. It used to serve only a boolean saying whether that address matched the candidate's, on the reasoning that this queue spans every workspace and an address is the one field identifying somebody outside our own identifier space. That reasoning is sound and it was overruled on 2026-08-24: without the address an operator cannot answer the question the screen exists to ask, so the queue served six opaque ids and no way to act on them. The disclosure carries its own cost instead — the list route sets no_store and commits a platform read-audit row before any address is returned.