Say user throughout, noting Ory's identity naming in the docs

ory/keto/namespaces.keto.ts

@@ -4,35 +4,36 @@
 // identity ids (== the JWT `sub`).
 import { Context, Namespace, SubjectSet } from "@ory/keto-namespace-types"
 
-// A Kratos identity. Subjects are written as `identity:<kratos-identity-id>`.
-class Identity implements Namespace {}
+// A person. Ory calls this an "identity" (Kratos owns the record); Plainpages says "user"
+// throughout. Subjects are written as `user:<kratos-identity-id>`.
+class User implements Namespace {}
 
-// A named set of identities (and nested groups), resolved transitively. The admin "Groups"
+// A named set of users (and nested groups), resolved transitively. The admin "Groups"
 // screen manages membership; checks expand it automatically.
 class Group implements Namespace {
   related: {
-    members: (Identity | SubjectSet<Group, "members">)[]
+    members: (User | SubjectSet<Group, "members">)[]
   }
 }
 
 // A coarse permission — an operation a route or menu item gates on, and the source of truth
-// for the JWT `permissions` claim. At login the app reads `Permission:<name>#granted@identity:<id>`
+// for the JWT `permissions` claim. At login the app reads `Permission:<name>#granted@user:<id>`
 // from Keto and projects the result into the token (README: Login → session JWT). A group can
-// hold a permission, so grants go to an identity or to a whole group.
+// hold a permission, so grants go to a user or to a whole group.
 class Permission implements Namespace {
   related: {
-    granted: (Identity | SubjectSet<Group, "members">)[]
+    granted: (User | SubjectSet<Group, "members">)[]
   }
 }
 
 // A fine-grained, relationship-checked resource — README's third "may I?" tier, the rare
 // live Keto check (e.g. sharing/delegation). Permits nest: owner ⊇ editor ⊇ viewer.
-// Grants accept an identity directly or any member of a group.
+// Grants accept a user directly or any member of a group.
 class Resource implements Namespace {
   related: {
-    owners: (Identity | SubjectSet<Group, "members">)[]
-    editors: (Identity | SubjectSet<Group, "members">)[]
-    viewers: (Identity | SubjectSet<Group, "members">)[]
+    owners: (User | SubjectSet<Group, "members">)[]
+    editors: (User | SubjectSet<Group, "members">)[]
+    viewers: (User | SubjectSet<Group, "members">)[]
   }
 
   permits = {