There are three elements that specify who the user is - who, altId and name. Type, role, request & purposeOfUse are specific to user and don't seem to make sense if the user isn't specified. I'd expect at least a warning invariant (if you wanted to allow for extensions). Alternatively, have a choice of Reference, Identifier or string. If you have a Reference, you don't need the others. If you have a userid, it's tied to a system and can convey the name in display. If you have just a name, that's the string. Then you could make it 1..1 (and extend the string if need-be)

(Comment 11 - imported by: Ron G. Parker)