diff --git a/modules/cloudflare-dns/module.json b/modules/cloudflare-dns/module.json
index 69b0237..7eea7e3 100644
--- a/modules/cloudflare-dns/module.json
+++ b/modules/cloudflare-dns/module.json
@@ -5,7 +5,11 @@
   "provides": [
     {
       "name": "public-dns",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a DNS label"
+      }
     }
   ],
   "serves": {
diff --git a/modules/dnsmasq/module.json b/modules/dnsmasq/module.json
index e4f3e04..f1df031 100644
--- a/modules/dnsmasq/module.json
+++ b/modules/dnsmasq/module.json
@@ -4,7 +4,8 @@
   "provides": [
     {
       "name": "wildcard-resolution",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "requires": [
diff --git a/modules/gitea/module.json b/modules/gitea/module.json
index 16175fc..33ea9d7 100644
--- a/modules/gitea/module.json
+++ b/modules/gitea/module.json
@@ -182,7 +182,11 @@
   "provides": [
     {
       "name": "npm-package-registry",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 40,
+        "in": "a Gitea user name"
+      }
     },
     {
       "name": "git",
diff --git a/modules/influxdb/module.json b/modules/influxdb/module.json
index fbc8a67..e3445fd 100644
--- a/modules/influxdb/module.json
+++ b/modules/influxdb/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "influxdb-api",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "an InfluxDB v1 authorization"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/keycloak/module.json b/modules/keycloak/module.json
index 7a18b75..da58fd1 100644
--- a/modules/keycloak/module.json
+++ b/modules/keycloak/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "oidc-client",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 255,
+        "in": "a Keycloak client id"
+      }
     }
   ],
   "requires": [
diff --git a/modules/mailu/module.json b/modules/mailu/module.json
index ac5d45c..450a27a 100644
--- a/modules/mailu/module.json
+++ b/modules/mailu/module.json
@@ -537,7 +537,11 @@
   "provides": [
     {
       "name": "smtp",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 64,
+        "in": "a mailbox's local part"
+      }
     }
   ],
   "serves": {
diff --git a/modules/mesh-vault/module.json b/modules/mesh-vault/module.json
index f68e8ed..4f6ddeb 100644
--- a/modules/mesh-vault/module.json
+++ b/modules/mesh-vault/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "secret",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a vault entry"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/minio/module.json b/modules/minio/module.json
index ac6b7aa..d4f95eb 100644
--- a/modules/minio/module.json
+++ b/modules/minio/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "s3-bucket",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 20,
+        "in": "an S3 access key"
+      }
     }
   ],
   "requires": [
diff --git a/modules/mongodb/module.json b/modules/mongodb/module.json
index 6454914..8915d62 100644
--- a/modules/mongodb/module.json
+++ b/modules/mongodb/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "mongodb-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a MongoDB database name"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/mosquitto/module.json b/modules/mosquitto/module.json
index 9308199..0ffc9c6 100644
--- a/modules/mosquitto/module.json
+++ b/modules/mosquitto/module.json
@@ -5,7 +5,10 @@
   "provides": [
     {
       "name": "mqtt-topic",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a Mosquitto client and topic prefix"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/mssql/module.json b/modules/mssql/module.json
index 5a44231..09a5b06 100644
--- a/modules/mssql/module.json
+++ b/modules/mssql/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "mssql-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 128,
+        "in": "a SQL Server login and database name"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/postgres/module.json b/modules/postgres/module.json
index 5f8da0c..48ff5c6 100644
--- a/modules/postgres/module.json
+++ b/modules/postgres/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "postgres-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a PostgreSQL role and database name"
+      }
     }
   ],
   "claims": [
diff --git a/modules/redis/module.json b/modules/redis/module.json
index 0736848..49d23f0 100644
--- a/modules/redis/module.json
+++ b/modules/redis/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "redis-cache",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a Redis ACL user and key prefix"
+      }
     }
   ],
   "requires": [
diff --git a/modules/route-adapter/module.json b/modules/route-adapter/module.json
index e7501b2..10cb2d9 100644
--- a/modules/route-adapter/module.json
+++ b/modules/route-adapter/module.json
@@ -8,7 +8,8 @@
   "provides": [
     {
       "name": "route",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "serves": {
diff --git a/modules/route-proxy/module.json b/modules/route-proxy/module.json
index 08068f3..044d336 100644
--- a/modules/route-proxy/module.json
+++ b/modules/route-proxy/module.json
@@ -8,7 +8,8 @@
   "provides": [
     {
       "name": "route",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "serves": {