diff --git a/iam/cmd/iam/main.go b/iam/cmd/iam/main.go
new file mode 100644
index 0000000..2a4ea05
--- /dev/null
+++ b/iam/cmd/iam/main.go
@@ -0,0 +1,7 @@
+package main
+
+import "todo-vibe-coding/iam/internal/service"
+
+func main() {
+	_ = service.NewIAM()
+}
diff --git a/iam/deployments/README.md b/iam/deployments/README.md
new file mode 100644
index 0000000..5e3d3f1
--- /dev/null
+++ b/iam/deployments/README.md
@@ -0,0 +1,3 @@
+# deployments
+
+Deployment manifests placeholder.
diff --git a/iam/docs/README.md b/iam/docs/README.md
new file mode 100644
index 0000000..17c1398
--- /dev/null
+++ b/iam/docs/README.md
@@ -0,0 +1,8 @@
+# IAM Demo Structure
+
+This folder is a lightweight example showing how files can be split by responsibility.
+
+- cmd/iam/main.go creates the service.
+- internal/service wires dependencies.
+- internal/auth/jwt holds token logic.
+- internal/repo provides data access interfaces.
diff --git a/iam/internal/api/http/router.go b/iam/internal/api/http/router.go
new file mode 100644
index 0000000..9834e0f
--- /dev/null
+++ b/iam/internal/api/http/router.go
@@ -0,0 +1,7 @@
+package http
+
+type Router struct{}
+
+func NewRouter() *Router {
+	return &Router{}
+}
diff --git a/iam/internal/api/middleware/logging.go b/iam/internal/api/middleware/logging.go
new file mode 100644
index 0000000..913ac33
--- /dev/null
+++ b/iam/internal/api/middleware/logging.go
@@ -0,0 +1,7 @@
+package middleware
+
+type Logger struct{}
+
+func NewLogger() *Logger {
+	return &Logger{}
+}
diff --git a/iam/internal/auth/jwks/jwks.go b/iam/internal/auth/jwks/jwks.go
new file mode 100644
index 0000000..9e55161
--- /dev/null
+++ b/iam/internal/auth/jwks/jwks.go
@@ -0,0 +1,7 @@
+package jwks
+
+type Store struct{}
+
+func NewStore() *Store {
+	return &Store{}
+}
diff --git a/iam/internal/auth/jwt/manager.go b/iam/internal/auth/jwt/manager.go
new file mode 100644
index 0000000..e3eafa2
--- /dev/null
+++ b/iam/internal/auth/jwt/manager.go
@@ -0,0 +1,9 @@
+package jwt
+
+type Manager struct {
+	secret string
+}
+
+func NewManager(secret string) *Manager {
+	return &Manager{secret: secret}
+}
diff --git a/iam/internal/auth/keys/keys.go b/iam/internal/auth/keys/keys.go
new file mode 100644
index 0000000..e67e1b4
--- /dev/null
+++ b/iam/internal/auth/keys/keys.go
@@ -0,0 +1,7 @@
+package keys
+
+type Manager struct{}
+
+func NewManager() *Manager {
+	return &Manager{}
+}
diff --git a/iam/internal/auth/refresh/refresh.go b/iam/internal/auth/refresh/refresh.go
new file mode 100644
index 0000000..2f0ac46
--- /dev/null
+++ b/iam/internal/auth/refresh/refresh.go
@@ -0,0 +1,7 @@
+package refresh
+
+type Store struct{}
+
+func NewStore() *Store {
+	return &Store{}
+}
diff --git a/iam/internal/auth/revoke/revoke.go b/iam/internal/auth/revoke/revoke.go
new file mode 100644
index 0000000..f590736
--- /dev/null
+++ b/iam/internal/auth/revoke/revoke.go
@@ -0,0 +1,7 @@
+package revoke
+
+type Tracker struct{}
+
+func NewTracker() *Tracker {
+	return &Tracker{}
+}
diff --git a/iam/internal/config/config.go b/iam/internal/config/config.go
new file mode 100644
index 0000000..1dec066
--- /dev/null
+++ b/iam/internal/config/config.go
@@ -0,0 +1,9 @@
+package config
+
+type Config struct {
+	Issuer string
+}
+
+func Default() Config {
+	return Config{Issuer: "iam-demo"}
+}
diff --git a/iam/internal/domain/models.go b/iam/internal/domain/models.go
new file mode 100644
index 0000000..d7a59e5
--- /dev/null
+++ b/iam/internal/domain/models.go
@@ -0,0 +1,11 @@
+package domain
+
+type User struct {
+	ID   int64
+	Name string
+}
+
+type Role struct {
+	ID   int64
+	Name string
+}
diff --git a/iam/internal/errors/errors.go b/iam/internal/errors/errors.go
new file mode 100644
index 0000000..9cf6152
--- /dev/null
+++ b/iam/internal/errors/errors.go
@@ -0,0 +1,5 @@
+package errors
+
+import "errors"
+
+var ErrUnauthorized = errors.New("unauthorized")
diff --git a/iam/internal/repo/user_store.go b/iam/internal/repo/user_store.go
new file mode 100644
index 0000000..67ed89d
--- /dev/null
+++ b/iam/internal/repo/user_store.go
@@ -0,0 +1,20 @@
+package repo
+
+type User struct {
+	ID   int64
+	Name string
+}
+
+type UserStore interface {
+	FindByID(id int64) (*User, error)
+}
+
+type inMemoryUserStore struct{}
+
+func NewInMemoryUserStore() UserStore {
+	return &inMemoryUserStore{}
+}
+
+func (s *inMemoryUserStore) FindByID(id int64) (*User, error) {
+	return &User{ID: id, Name: "demo"}, nil
+}
diff --git a/iam/internal/service/iam.go b/iam/internal/service/iam.go
new file mode 100644
index 0000000..e1c5fae
--- /dev/null
+++ b/iam/internal/service/iam.go
@@ -0,0 +1,18 @@
+package service
+
+import (
+	"todo-vibe-coding/iam/internal/auth/jwt"
+	"todo-vibe-coding/iam/internal/repo"
+)
+
+type IAM struct {
+	tokens *jwt.Manager
+	users  repo.UserStore
+}
+
+func NewIAM() *IAM {
+	return &IAM{
+		tokens: jwt.NewManager("dev-secret"),
+		users:  repo.NewInMemoryUserStore(),
+	}
+}
diff --git a/iam/internal/transport/events.go b/iam/internal/transport/events.go
new file mode 100644
index 0000000..9ebd99d
--- /dev/null
+++ b/iam/internal/transport/events.go
@@ -0,0 +1,7 @@
+package transport
+
+type Emitter struct{}
+
+func NewEmitter() *Emitter {
+	return &Emitter{}
+}
diff --git a/iam/internal/util/ids.go b/iam/internal/util/ids.go
new file mode 100644
index 0000000..d404f40
--- /dev/null
+++ b/iam/internal/util/ids.go
@@ -0,0 +1,5 @@
+package util
+
+func NextID() int64 {
+	return 1
+}
diff --git a/iam/migrations/README.md b/iam/migrations/README.md
new file mode 100644
index 0000000..1eb99b2
--- /dev/null
+++ b/iam/migrations/README.md
@@ -0,0 +1,3 @@
+# migrations
+
+Database migrations placeholder.
diff --git a/iam/pkg/README.md b/iam/pkg/README.md
new file mode 100644
index 0000000..3537b5c
--- /dev/null
+++ b/iam/pkg/README.md
@@ -0,0 +1,3 @@
+# pkg
+
+Shared packages for reuse across services (placeholder).
diff --git a/iam/scripts/README.md b/iam/scripts/README.md
new file mode 100644
index 0000000..7dc19e9
--- /dev/null
+++ b/iam/scripts/README.md
@@ -0,0 +1,3 @@
+# scripts
+
+Ops scripts placeholder.
diff --git a/iam/test/README.md b/iam/test/README.md
new file mode 100644
index 0000000..ef392d2
--- /dev/null
+++ b/iam/test/README.md
@@ -0,0 +1,3 @@
+# test
+
+Integration tests placeholder.