diff --git a/src/modules/auth/orchest-identity.spec.ts b/src/modules/auth/orchest-identity.spec.ts
new file mode 100644
index 0000000..c25ceaf
--- /dev/null
+++ b/src/modules/auth/orchest-identity.spec.ts
@@ -0,0 +1,36 @@
+import { deriveOrchestIdentity } from './orchest-identity';
+
+describe('deriveOrchestIdentity', () => {
+  it('passes permissions through verbatim', () => {
+    expect(deriveOrchestIdentity(['intelligence:open']).permissions).toEqual([
+      'intelligence:open',
+    ]);
+  });
+
+  it('marks super-admin from users:admin', () => {
+    expect(deriveOrchestIdentity(['users:admin']).roles).toContain('super-admin');
+  });
+
+  it('omits super-admin when users:admin absent', () => {
+    expect(deriveOrchestIdentity(['intelligence:open']).roles).not.toContain(
+      'super-admin',
+    );
+  });
+
+  it('maps intelligence:open and process:open to module keys', () => {
+    const { modules } = deriveOrchestIdentity(['intelligence:open', 'process:open']);
+    expect(modules.sort()).toEqual(['intelligence', 'process']);
+  });
+
+  it('ignores non-module permissions in modules', () => {
+    expect(deriveOrchestIdentity(['users:admin']).modules).toEqual([]);
+  });
+
+  it('handles undefined/empty permissions', () => {
+    expect(deriveOrchestIdentity(undefined)).toEqual({
+      permissions: [],
+      roles: [],
+      modules: [],
+    });
+  });
+});
diff --git a/src/modules/auth/orchest-identity.ts b/src/modules/auth/orchest-identity.ts
new file mode 100644
index 0000000..8060e34
--- /dev/null
+++ b/src/modules/auth/orchest-identity.ts
@@ -0,0 +1,27 @@
+// Claim → semantic strings. Seqid knowledge stays here, beside the enum
+// that owns it (users:admin=34, intelligence:open=31, process:open=43).
+const ADMIN_CLAIM = 'users:admin';
+const MODULE_CLAIMS: Record<string, string> = {
+  'intelligence:open': 'intelligence',
+  'process:open': 'process',
+};
+
+export type OrchestIdentityFields = {
+  permissions: string[];
+  roles: string[];
+  modules: string[];
+};
+
+export function deriveOrchestIdentity(
+  permissions: string[] | undefined,
+): OrchestIdentityFields {
+  const perms = permissions ?? [];
+  const roles: string[] = [];
+  if (perms.includes(ADMIN_CLAIM)) {
+    roles.push('super-admin');
+  }
+  const modules = Object.entries(MODULE_CLAIMS)
+    .filter(([claim]) => perms.includes(claim))
+    .map(([, key]) => key);
+  return { permissions: perms, roles, modules };
+}