🚧 Add no-negative identity filter

This mirrors exactly what the IdentityManager already does but it adds a test!