Glossary

ABAC

Attribute-based access control. An access model that grants access based on attributes of the identity, the resource, and the context rather than on predefined roles. ABAC can express fine-grained rules but is only as reliable as the attributes it depends on.

Access

The set of capabilities an identity is allowed to use to perform work. Access is not the same as authentication or authorization. Access is the capability that exists before a real-time authorization decision is made.

Access drift

The gradual movement of access away from its intended purpose. Access drift appears when permissions accumulate, temporary access becomes permanent, or roles no longer reflect real work.

Access management

The practice of defining, granting, reviewing, and removing the capabilities an identity needs to do its work.

Access model

The structure used to define and deliver access. This may include roles, entitlements, groups, policy logic, approval flows, and review mechanisms.

Access request

A formal request for access to a role, entitlement, application, system, or privileged capability.

Access review

A structured review of access to confirm that it is still appropriate, purposeful, and aligned with risk. The book distinguishes two kinds: the user access review and the entitlement review.

Access role

A bundle of entitlements granted together as a unit, so that access can be assigned, requested, and reviewed as one thing rather than entitlement by entitlement. Access roles are an optional layer: some organizations and applications use them, while others grant entitlements directly. (This book avoids the bare word "role" for this concept; see Business role for the job-function sense.)

Agent lifecycle

The full lifecycle of an AI agent, including intake, approval, creation, access assignment, monitoring, review, change, suspension, and retirement.

Agentic AI

An AI actor that can act autonomously, chain tools, initiate workflows, and persist state. Agentic AI behaves like a nonhuman workforce member with delegated authority and requires explicit ownership, lifecycle rules, access boundaries, and oversight.

AI identity

The identity representation of an AI system or AI agent inside the identity ecosystem.

AI system

A model or AI-enabled service that acts only when invoked by a human, application, or workflow. AI systems introduce data and inference risk but do not autonomously initiate activity in the same way agentic AI does.

Application baseline

The required configuration that makes a standard real for a specific system, the mandatory, system-specific form of a standard. Distinct from baseline access, which is the default access an identity receives.

Approval workflow

The path that routes a request to the correct approver or approvers based on policy, ownership, risk, and context.

Artifact

A practical output used to support the operating model. Examples include ownership maps, lifecycle templates, privilege chain maps, decision rights matrices, and governance standards.

Assurance level

A measure of how much confidence an authentication or identity claim deserves, based on how the identity was verified and how the credential is protected. Higher-risk access calls for a higher assurance level.

Attribute

A piece of data that describes an identity, object, or relationship. Examples include department, manager, owner, contract end date, role name, and risk classification.

Authentication

The process of verifying that an identity is who or what it claims to be at the moment it connects or signs in. Authentication proves the identity; authorization decides what it may do. See also Assurance level, MFA, SSO.

Authoritative source

The system or record designated as the trusted source for a specific identity type or attribute.

Authorization

The decision made at run time about what an identity is allowed to do in that moment, inside a system, application, or service.

Baseline access

The standard access an identity receives based on role, purpose, lifecycle state, or policy.

Birthright access

Access granted automatically at creation because it is considered necessary for a role or identity type.

Bot

A nonhuman identity that performs automated actions based on predefined logic, scripts, or rules.

Break-glass account

An emergency account used only in exceptional circumstances when normal access paths are unavailable or insufficient.

Business owner

The person accountable for the business use, purpose, or outcome of an identity object, access pattern, process, or application.

Business role

A job or function a person performs (for example, nurse or account administrator). A business role describes what someone is, in contrast to an access role, which is the bundle of entitlements that lets them do it.

Capability

A defined unit of work or function that an identity needs to perform. Capability is the most useful anchor for access design because it ties access to actual work instead of to abstract labels alone.

Capability-based access

An access design approach that models roles and permissions around what people or systems are actually there to do.

Certificate

A digital credential used to authenticate a nonhuman identity, workload, service, or device.

Certificate lifecycle

The issuance, renewal, rotation, revocation, and retirement of certificates used by nonhuman identities.

Certification

A periodic confirmation that the people holding access should still have it. Certification, recertification, and attestation are names for the same control, the user access review.

Cloud IAM

The identity and access controls used in cloud environments to govern human and nonhuman access to cloud services, workloads, resources, and policies.

CMDB

Configuration management database. A record of the systems and applications in an environment and who owns them. It is not an identity system, but it is often where application ownership lives, which makes it a common starting point when building the Identity System Catalog. Its usefulness depends entirely on being reconciled; a stale CMDB reports owners who left years ago. See also Owner, Ownership.

Conditional access

A policy-driven approach to authentication and access decisions that uses contextual signals such as device state, location, risk, and session conditions.

Control

A mechanism that enforces and verifies that standards, procedures, and governance expectations are being followed. The requirement a control checks is written into the standard or baseline.

Control plane

The layer where access decisions are made and enforced, separate from the systems those decisions govern. Some vendors describe identity itself as the control plane. This book locates that function in governance and the policy engine rather than in any single product. See also Policy engine, PBAC.

Correlation

The process of resolving records from different source systems (HR, the directory, a contractor system) to one identity, so a person is recognized as a single human rather than several unrelated accounts. Correlation happens at a moment in time; keeping that resolution accurate as time passes is a separate job. See also Reconciliation.

Credential

Evidence used to authenticate an identity. Examples include passwords, certificates, secrets, keys, tokens, and passkeys.

Credential drift

The movement of machine credentials away from their intended state through unmanaged rotation, unclear ownership, expiration, reuse, or hidden dependency.

Customer identity

The identity of a customer inside a consumer or digital experience. Customer identity often has different lifecycle signals, trust patterns, and privacy implications than workforce identity.

Decentralized identity

See Verifiable credentials.

Decision rights

The explicit definition of who decides, who approves, who advises, and who is accountable for identity-related actions and outcomes.

Delegated authority

Authority granted by one identity or role to another identity, system, or agent to act within defined boundaries.

Delegation boundary

The explicit limit placed on what an identity, system, or AI agent is allowed to do on behalf of another actor or process.

Deprovisioning

The removal of access, credentials, group memberships, or accounts when an identity changes or retires.

Directory

A system that stores identity attributes, group memberships, and account objects and helps enforce authentication and access.

Directory account

The account representation of an identity inside a directory or identity store.

Drift

The movement of identity away from its intended state through small, cumulative decisions.

Drift signal

A visible indicator that the operating model is out of alignment. Examples include unclear ownership, stale accounts, orphaned credentials, role sprawl, or unexpected AI behavior.

Drift visibility

The point at which accumulated drift becomes observable through questions, incidents, reviews, metrics, or audit findings.

Employee identity

An identity for someone on payroll, sourced from the HRIS and governed by the employment lifecycle: hire, transfer, promotion, leave, and termination. The market term "workforce identity" is broader, covering employees and non-employees together; see Workforce identity.

Enforcement

One of the four jobs every identity system must perform. Enforcement is where identity decisions become real through accounts, credentials, policies, provisioning, and controls.

Entitlement

A discrete access right or permission inside an application, system, or platform.

Entitlement drift

The gradual expansion, ambiguity, or accumulation of entitlements beyond their original purpose.

Entitlement review

A review of an entitlement itself, asking whether it still grants what its name says, is still used, carries acceptable risk, and should still exist at all. Distinct from the user access review, which checks who holds an entitlement rather than whether the entitlement is sound.

Ephemeral identity

A short-lived identity created for temporary workloads, sessions, tasks, or automation.

Exception

A time-bounded departure from the intended operating model, standard, control, or access path.

External identity

See Non-employee identity.

Federation

A trust relationship between identity systems that allows authentication or identity assertions to cross boundaries.

Four jobs of identity

The four jobs every identity system must perform: source, registry, governance, and enforcement.

Friction

The burden, confusion, delay, or complexity people experience when identity does not align well with how work is actually done.

Governance

The structure that defines who decides, who owns what, what standards apply, how exceptions are handled, and how accountability is maintained over time.

Governance drift

The movement of identity away from intended structure because ownership, standards, decision rights, or accountability are unclear or inconsistently applied.

Governance framework

The combined set of policy, standards, baselines, guidelines, procedures, controls, and decision rights that make governance operational.

Governance stack

The layered set of governance artifacts that translate direction into execution. This includes policy, standards, baselines, guidelines, procedures, controls, and accountability.

Group

A collection of identities used to assign access, apply logic, or simplify administration.

Guideline

An advisory pattern or approach that helps teams make good decisions where a standard leaves room for judgment. Guidelines are not mandatory; once a "how" becomes required and testable, it belongs in a standard or baseline.

HRIS

Human resource information system. For employees, the authoritative source is usually the HRIS. HR owns the truth of an employee; the HRIS only records it. See also Authoritative source, Employee identity.

Human identity

An identity representing a person, such as an employee, contractor, consultant, vendor, partner, or customer.

IAM

Identity and Access Management. In traditional usage, IAM often refers to the set of technologies, teams, and processes used to manage accounts and access. In this book, modern identity expands beyond that narrower understanding.

Identity

The representation of a person, system, or agent that allows the organization to decide who or what is allowed to act.

Identity discipline

The idea that identity is a governed, repeatable, organizational capability rather than only a technical function.

Identity object

Any governed item in the identity ecosystem, such as a role, group, entitlement, workload identity, certificate, or AI agent.

Identity operating model

The structure that holds identity together across Governance, Lifecycle, Access, Technology, and People & Change.

Identity truth

The current, trusted state of an identity as defined by authoritative data, ownership, purpose, and lifecycle.

Identity type

A category of identity actor, such as employee, contractor, service account, workload identity, bot, or AI agent.

Identity work

The human and structural labor required to keep identity accurate, governed, and aligned with real work.

IGA

Identity Governance and Administration. The technologies and processes used to govern identity-related decisions, access, reviews, and workflows.

Integration

A connection between systems that carries identity data, lifecycle events, access changes, or control signals.

Intelligent automation

Rule-based automation that behaves deterministically. It is not the same as agentic AI, though it still requires identity, lifecycle, credential, and access discipline.

ISPM

Identity Security Posture Management. The discipline of finding and reducing standing identity weakness: ownerless accounts, over-broad entitlements, stale credentials, and misconfiguration. It is drift made visible and measurable. See also Drift, ITDR.

ITDR

Identity Threat Detection and Response. The discipline of detecting identity-based attacks in progress, such as a compromised credential or an account behaving abnormally, and responding fast enough to limit the damage. It depends on the operating model to know what normal looks like. See also ISPM.

JML

Joiner, mover, leaver. The core lifecycle model used to describe how identities begin, change, and end.

Joiner

A lifecycle event in which a new identity enters the environment.

Just-in-time access

A model in which access is granted only when needed and often for a limited period.

Key

A cryptographic secret or credential used to authenticate or authorize nonhuman activity.

Least privilege

The principle that access should reflect only what is needed to perform the intended work and nothing more.

Lifecycle

The discipline that defines how identities begin, change, and end.

Lifecycle drift

Misalignment caused when identity state no longer reflects the real condition, role, purpose, or existence of the actor.

Lifecycle map

A structured representation of how an identity type begins, changes, and retires.

Machine credential

A credential used to authenticate a nonhuman identity, such as a certificate, key, token, or secret.

Managed identity

A cloud or platform-provided nonhuman identity used to authenticate workloads without manually managed credentials.

Managed service provider (MSP)

A third party contracted to run some or all of an organization's identity operations, such as provisioning, access reviews, and deprovisioning. Outsourcing the activity does not move the accountability. The organization still owns the outcome, and the questions it asks of the provider are part of how it owns it.

Maturity

The degree to which the identity operating model behaves predictably, reliably, and sustainably under change.

Maturity model

A framework used to assess how well the environment is functioning across governance, lifecycle, access, technology, people, drift, and AI identity.

Measurement model

The structured set of metrics used to evaluate whether the operating model is healthy, stable, and reducing drift.

MFA

Multi-factor authentication. An authentication method that requires more than one kind of evidence, such as a password plus a device or a biometric, before access is granted. MFA raises the cost of a stolen credential.

Middle layer

A custom or semi-custom identity data or logic layer built between authoritative sources, identity platforms, and applications. It can be useful when intentionally governed and dangerous when it becomes a hidden source of truth.

Mover

A lifecycle event in which an identity changes role, responsibility, ownership, or state.

Need to do

The principle that an identity should hold only the capability its task requires. It is the action dimension of access, and it maps onto the distinction between the entitlement an identity holds and the authorization that governs what it can do with that entitlement. See also Least privilege, Need to know, Authorization.

Need to know

The principle that an identity should reach only the information its work requires. It is the information dimension of access, and it maps onto data classification. See also Least privilege, Need to do.

Non-employee identity

The umbrella for anyone who works with or for the organization and is not an employee or a customer: contractors, consultants, vendors, partners, suppliers, interns, board members, and collaboration guests. Some of these sit on one side or the other, depending on the actual relationship and where the identity is mastered, not the title: a paid intern carried in the HRIS or an executive who also holds a board seat is an employee, while an unpaid intern or an outside director engaged without an employment relationship is a non-employee. Synonyms include third party and, for the contractor and consultant subset, contingent worker. Non-employees are governed in two access-depth tiers: engaged non-employees, who hold real access and need a sponsor, a governing agreement, a scope, and start and end dates; and collaboration guests, invited to share a single file or channel, who need an invitation owner, a scope, and an expiration. The weight of the lifecycle matches the depth of the access.

Nonhuman identity

Any identity that does not represent a human being. Examples include service accounts, workloads, bots, API clients, devices, and automation.

OAuth

The open standard for granting an application limited access to act on your behalf. OAuth is authorization rather than authentication, though the two are often spoken of in the same breath. See also OpenID Connect.

OCM

Organizational Change Management. The discipline of helping people understand, adopt, and sustain change.

OpenID Connect

An identity layer built on OAuth, and the modern default for new application sign-in. See also SAML, SSO.

Operating model

The structure that defines how a capability works in practice.

OWASP

Open Worldwide Application Security Project. An open, community-run body that publishes widely used lists of the most significant security risks in a given area. Its Non-Human Identities Top 10 is the nearest thing the field has to a recognized risk taxonomy for nonhuman identity, and its lists for large language model and agentic applications both land on enforcing authorization in downstream systems rather than inside the model.

Owner

The person accountable for an identity object, system, process, role, or decision.

Ownership

The condition in which responsibility for an identity object or decision is explicit, current, and actionable.

PAM

Privileged Access Management. The governance, controls, and technologies used to manage access with amplified risk or authority.

Partner identity

An external identity associated with a business partner or federated relationship.

Passkey

A modern authentication credential that replaces the password. A passkey is bound to the specific site or service it was created for, so a spoofed login page cannot capture or reuse it, which is what makes it phishing-resistant. See also Credential.

PBAC

Policy-based access control. An access model that decides access at request or run time by evaluating policy against the identity, the resource, and the context. PBAC moves the decision into a policy engine rather than into static role assignments.

People & Change

The pillar of the operating model that focuses on stakeholder alignment, communication, training, adoption, ownership clarity, and change management.

Pillars

The five disciplines that hold the Modern Identity Operating Model together: Governance, Lifecycle, Access, Technology, and People & Change.

Policy

A statement of intent and boundary that defines what must be true.

Policy engine

A technical component that evaluates conditions and enforces identity-related decisions at run time.

Predictability

The quality of identity behaving consistently under change.

Principal

The identity an agent acts for. For a delegated agent, the principal's own access is the limit on what the agent can legitimately do, so authority beyond the principal is authority nobody delegated. See also Delegated authority, Delegation boundary.

Privilege

The level of capability, authority, or access an identity possesses.

Privilege chain

The full path by which an identity can reach or influence systems, capabilities, or administrative power, including direct and indirect access.

Privileged access

Access that carries elevated capability, such as administrative rights, the ability to change configuration, or control over other identities. Privileged access deserves stronger controls because the consequences of misuse are larger. See also PAM.

Provisioning

The process of creating and assigning accounts, access, credentials, or identity state.

Purpose

The reason an identity, role, entitlement, or credential exists.

RBAC

Role-based access control. An access model that grants access through access roles, which bundle entitlements so they can be assigned and reviewed together. RBAC simplifies assignment when roles reflect real work, and it creates drift when they do not.

Reconciliation

The process of comparing identity state across systems to detect mismatch, drift, or missing alignment, and resolving what it finds back toward the trusted state. See also Correlation.

Registry

One of the four jobs every identity system must perform. The registry is where identities are tracked, correlated, and represented consistently across systems.

Reviewer

The person responsible for evaluating access, ownership, or lifecycle state during a review process.

Runtime identity

Identity that matters at execution time, such as workload identity, machine trust, or runtime authorization context.

SAML

Security Assertion Markup Language. The long-standing federation standard for workforce single sign-on. See also Federation, SSO.

SCIM

System for Cross-domain Identity Management. The standard protocol for provisioning: the automation that creates, updates, and deactivates accounts across systems. See also Provisioning.

Scope

The defined boundary of what an identity, role, entitlement, credential, or AI agent is allowed to affect.

Secrets manager

A platform used to securely store, issue, and rotate secrets.

Separation of duties

See SoD.

Service account

A nonhuman identity used by a system, application, automation, or service to act in the environment.

Service principal

A nonhuman identity that represents an application, service, or automation when it authenticates to a system, common in cloud platforms. A service principal needs an owner, a defined purpose, and lifecycle like any other identity.

Shadow identity process

An unmanaged, local, or unofficial identity-related process created outside the intended operating model.

Shared language

A consistent set of terms that helps stakeholders understand identity the same way.

Simulation identity

A synthetic or test identity used for modeling, QA, training, or experimentation.

SoD

Separation of duties. A control principle that prevents dangerous concentrations of authority or capability. NIST writes separation of duties and ISO writes segregation of duties; the terms are interchangeable.

Source

One of the four jobs every identity system must perform. The source is where identity truth begins.

Source of truth

The authoritative place where an identity or attribute is defined.

SPIFFE

Secure Production Identity Framework for Everyone. An open standard for giving workloads verifiable identities, so services can authenticate to one another without shared secrets. It sits alongside mTLS and service mesh in nonhuman identity.

Sponsor

The human owner or business backer accountable for an external, nonhuman, or AI identity.

SSO

Single sign-on. A capability that lets an identity authenticate once and then reach multiple systems without signing in again to each one. SSO improves experience and centralizes authentication, which also makes the identity provider a higher-value target.

Standard

A measurable expectation that translates policy into operating discipline.

Standing access

Access that stays granted whether or not it is being used. Standing access is convenient and is also the access most likely to drift, accumulate, and go unreviewed. Reducing it is a central aim of just-in-time and least privilege approaches.

Structural truth

A recurring, system-level reality about how identity behaves, regardless of the tools or organizational chart around it.

Synthetic identity

A temporary, test, generated, or simulated identity that does not represent a real person but still behaves as an identity in the environment. Not to be confused with synthetic identity fraud, the established term for a fabricated persona assembled from real and invented data.

Technical debt

Accumulated implementation burden caused by shortcuts, overlap, brittle integrations, unclear logic, or design choices that no longer reflect current reality.

Technology drift

Misalignment caused when identity technology, integrations, automation, or credentials no longer reflect the intended operating model.

Telemetry

Observable system signals, logs, and measurements used to understand identity behavior, detect drift, and support governance or response.

Temporary access

Access granted for a short period to meet a defined need, ideally with expiration and review built in.

Tool chaining

The behavior of an AI agent or automation calling multiple systems or tools in sequence.

Toxic combination

A set of entitlements that are each acceptable alone but dangerous together, because in combination they let one identity complete and conceal a sensitive action. Detecting toxic combinations is a core goal of access review and separation of duties.

Trust

The confidence that identity behaves predictably enough to support work safely.

User access review

A review of access assignments asking whether the right people still hold the access they have. It goes by several names, including certification, recertification, and attestation. It looks at the assignment, not at the entitlement itself.

Vendor identity

An identity representing an external vendor or service provider.

Verifiable credentials

A digital claim that an identity holds and can present directly, which a verifier confirms is authentic without contacting the issuer each time. Verifiable credentials are the model behind digital wallets and mobile driver's licenses, and the current form of what is sometimes called decentralized or self-sovereign identity. Mobile driver's licenses follow their own standard, ISO/IEC 18013-5, rather than the web-native format, though both serve the same purpose. The structural questions do not change: someone still owns the claim, grants it, and is accountable when it is wrong.

Visibility gap

The absence of usable insight into ownership, access, lifecycle state, drift, or privilege relationships.

Wave

A bounded implementation slice used to introduce change in a manageable and sustainable way.

Wave-based implementation

A structured approach to implementation that limits scope, closes one area operationally, then expands deliberately.

Workforce identity

The market's term for the internal, non-customer identity domain. This book uses the more precise terms "employee" and "non-employee."

Workload identity

A nonhuman identity used by a cloud workload, service, application, container, or runtime process.

Zero Trust

A security principle that assumes no actor should be inherently trusted and that access should be continuously validated through identity, context, and policy.