Used for add,modify,delete,read operations. Each operation operates on a single subjectKey or returns a single subject. Used in connection with an authentication (which returns one subject key) or search operation (which may return one or more subject keys). Authenticate maps a set of credentials to a unique subject key. Searching may be used for to determine if a set of identities match a particular set of conditions (used in reporting). All operations act on a single record (or return a single record). Only a search may return more than one record.