# Update profile and account

**Flow key:** `profile-and-account-update`

## Outcome

An authorized user changes permitted identity or preference data, proves sensitive changes, and sees consistent state across sessions and integrations.

## Actors

- Authenticated user
- Identity/profile service
- Admin or organization policy
- Notification channels

## Preconditions and entry points

- An editable synthetic account exists.
- Current values and permissions are captured.
- Reauthentication and verification channels are available.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Profile fields | name `CARBON User 001`, locale `en-US` | empty optional, long, emoji/emoticon, RTL, markup canary |
| Identity fields | username/email/phone synthetic values | duplicate, normalization-equivalent, unverified, reserved |
| Sensitive proof | current password or step-up session | expired, wrong, SSO-only account |
| Concurrent state | second tab with original profile version | admin edit, sync/import update |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Open account/profile settings. | Current values, editability, privacy, and organization-managed fields are accurate. |
| 2 | Change ordinary profile fields. | Validation preserves unrelated data and previews intended display. |
| 3 | Submit once. | One version is committed and reflected in visible profile, session, and audit. |
| 4 | Start a sensitive identity change. | Reauthentication and new-channel verification occur before authority moves. |
| 5 | Complete verification. | Old/new identifiers, login, recovery, notifications, and uniqueness update coherently. |
| 6 | Refresh another session and connected surface. | Stale caches and sessions converge without leaking prior private data. |

## Alternate paths

- Self-service profile edit
- Admin-managed fields
- Username rename
- Email/phone change
- Avatar/time zone/language preferences

## Failure and recovery paths

- Duplicate identity discovered at commit
- Verification sent but value changes again
- Concurrent update overwrites data
- Downstream sync fails
- Old identifier remains usable unexpectedly

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [person contact and profile](../../items/identity/person-contact-and-profile.md)
- [username](../../items/controls/username.md)
- [email address](../../items/controls/email-address.md)
- [update](../../items/actions/update.md)

[Back to Identity and access flows](index.md)
