ENES
Resources · Glossary

Glossary

  1. A
  2. Access CertificationIAM FoundationsA periodic review where a manager or resource owner confirms that a person's current access is still needed — the core mechanism of identity governance.
  3. Access Control List (ACL)AM & AccessA list attached to a resource that names which subjects can access it and how — the column-slice of the access control matrix, and the most common way DAC is actually implemented.
  4. Access Control MatrixAM & AccessThe theoretical model underneath every authorization model — subjects as rows, objects as columns, and each cell holding the permissions a subject has on that object.
  5. Access TokenAM & AccessA short-lived, scoped credential a client presents to a resource server to call an API on a user's behalf — proof of permission, not proof of identity.
  6. AccountIAM FoundationsThe technical record — row, credentials, permissions — that implements one identity inside a single application.
  7. Active Directory (AD)AM & AccessMicrosoft's on-premise directory product — LDAP plus Kerberos authentication, Group Policy, and a domain/forest structure for managing Windows-joined machines.
  8. Assurance Level (IAL / AAL / FAL)AM & AccessNIST SP 800-63's three independent dials — identity proofing, authenticator strength, and federation strength — each rated 1 to 3, for stating exactly how strong each part of a system must be.
  9. AttributeIAM FoundationsA fact about an identity — name, email, department — owned by exactly one authoritative source and read by many systems.
  10. Attribute-Based Access Control (ABAC)AM & AccessAn access model where a decision is computed from attributes of the subject, resource, action, and environment — the engine behind most Zero Trust and situational access decisions.
  11. Authentication FactorAM & AccessOne of five categories of evidence — something you know, have, are, do, or your context — that backs a claim of identity; combining independent categories is what makes MFA meaningfully stronger than a single factor.
  12. Authoritative SourceIAM FoundationsThe single system declared as the system of truth for a given identity attribute — the place every other system defers to instead of keeping its own copy.
  13. Authorization Code + PKCEAM & AccessThe default OAuth grant for user-facing apps — the client gets a short-lived authorization code first and exchanges it for tokens, with PKCE proving the exchange came from the same client that started the flow.
  14. B
  15. Birthright AccessIAM FoundationsAccess granted automatically to every identity in a population, purely from its attributes — email, intranet, VPN — never copied from a colleague.
  16. Break-glass AccessIAM FoundationsA controlled emergency override that trades prevention for detection — granting immediate access in a crisis, logged and reviewed after the fact instead of pre-approved.
  17. C
  18. ClaimIAM FoundationsA digitally signed assertion an issuer makes about an identity, carried in a token and trusted because of the issuer's signature.
  19. CredentialIAM FoundationsWhat an identity presents to prove itself — classified by factor — something you know, have, are, or do.
  20. Customer IAM (CIAM)IAM FoundationsIdentity for external, high-scale audiences — customers and prospects — optimized for conversion and user experience rather than internal control.
  21. D
  22. Discretionary Access Control (DAC)AM & AccessAn access model where the resource's owner decides who else gets access — the model behind file permissions on nearly every operating system.
  23. Dormant AccountIAM FoundationsAn account that's still active and technically valid, but hasn't been used in a long time — leaver-shaped risk hiding in plain sight.
  24. E
  25. EntitlementIAM FoundationsWhat an identity is allowed to do once authenticated — expressed as roles, permissions, scopes, or group membership depending on the system.
  26. F
  27. FAR / FRR / EERAM & AccessThe three error metrics that describe a biometric system's accuracy trade-off — how often it wrongly accepts an impostor (FAR), wrongly rejects a legitimate user (FRR), and the threshold where the two rates meet (EER).
  28. FederationIAM FoundationsTrusting another organization's identity provider so its users can authenticate with their home identity while being authorized locally as a guest.
  29. FIDO2 / WebAuthnAM & AccessA public-key authentication standard where the private key never leaves the user's device or security key — the phishing-resistant foundation passkeys are built on.
  30. Fine-Grained AuthorizationAM & AccessAuthorization decided at the level of individual resources and their relationships, not broad modules or roles — the granularity needed for "share this specific report with this specific team."
  31. I
  32. IAAA (Identification, Authentication, Authorization, Auditing)AM & AccessThe four-stage frame access management runs on — who you claim to be, proving it, deciding what you may do, and recording what happened — with auditing cutting across the other three rather than sitting after them.
  33. ID TokenAM & AccessA signed JWT, issued by an OIDC provider, that carries claims about who the user is — the piece OAuth never had and OIDC exists to add.
  34. IdentityIAM FoundationsAnything — human or machine — that authenticates against a system in order to act on it.
  35. Identity as the New PerimeterIAM FoundationsThe observation that the network boundary dissolved — cloud, remote work, BYOD — so trust now gets decided per request based on identity, device, and behavior instead of network location.
  36. Identity CorrelationIAM FoundationsLinking a known identity to its accounts across every application it touches — and, in the opposite direction, reconciliation, scanning existing accounts to flag ones matching no known identity.
  37. Identity FabricIAM FoundationsAn architectural pattern that stitches together an organization's identity tools and processes — human and non-human — into one coherent, interoperable layer instead of isolated silos.
  38. Identity Governance (IGA)IAM FoundationsThe discipline that answers "does the right identity have the right access, today and over time" — lifecycle, access requests, certification, role modeling, and separation of duties.
  39. Identity Provider (IdP)IAM FoundationsThe central system that authenticates identities and issues the signed tokens other systems trust — the organization's most critical piece of identity infrastructure.
  40. Identity Threat Detection & Response (ITDR)IAM FoundationsThe security category that watches the identity plane in real time and closes the gap that governance and access controls alone can't cover — detecting and responding to identity-based attacks as they happen.
  41. J
  42. Joiner-Mover-Leaver (JML)IAM FoundationsThe lifecycle discipline that keeps an identity's access equal to what its current relationship with the organization actually justifies.
  43. JSON Web Key Set (JWKS)AM & AccessA published set of public keys an OIDC provider rotates over time, letting any client verify a token's signature without a pre-shared secret.
  44. JSON Web Token (JWT)AM & AccessA compact, self-contained, signed JSON structure that carries claims directly in the token itself — the workhorse format behind most modern access and ID tokens.
  45. Just-in-Time (JIT) AccessIAM FoundationsAccess granted only for the time it's actually needed and automatically revoked afterward — the structural fix for standing privilege.
  46. K
  47. KerberosAM & AccessA ticket-based authentication protocol from the 1980s that still runs under every Active Directory login — you prove yourself once and use encrypted tickets to reach services after.
  48. L
  49. LDAP (Lightweight Directory Access Protocol)AM & AccessThe protocol and data model most on-premise directories speak — a hierarchical tree of entries, queried and authenticated over a standard wire protocol.
  50. M
  51. Mandatory Access Control (MAC)AM & AccessAn access model where a central authority — not the resource's owner — sets labels and clearances, and the system enforces them regardless of what any individual owner wants to allow.
  52. Master Identity RecordIAM FoundationsThe unified, canonical record for one identity — aggregating attributes from every authoritative source, each tagged with where it came from and when.
  53. Mutual TLS (mTLS)AM & AccessTLS where both sides present a certificate — the client proves its identity to the server too, not just the other way around, using X.509 certificates.
  54. N
  55. N+1 Authorization ProblemAM & AccessCalling a per-item authorization check in a loop to filter a list — one call per item, plus the list query itself — instead of one bulk or reverse-lookup call that returns only what's allowed.
  56. Next-Generation Access Control (NGAC)AM & AccessA NIST standard where users, resources, and everything else are nodes in one graph, and access is computed by traversing it — general enough to express RBAC, ABAC, and DAC-style policies within a single model.
  57. Non-Human Identity (NHI)IAM FoundationsAny identity that isn't a person — a device, a software workload, or an AI agent — now far outnumbering human identities in a typical organization.
  58. O
  59. OAuth 2.0AM & AccessA delegated-authorization framework that lets an app get limited, scoped access to a user's resources on another service — without ever seeing the user's password.
  60. Open Policy Agent (OPA)AM & AccessA general-purpose policy engine, and Rego, its query language, that evaluate policy against JSON input — deployable as a library, sidecar, or standalone service.
  61. OpenFGAAM & AccessAn open-source authorization engine implementing the Zanzibar model — a readable DSL for defining types and relations, JSON tuples for facts, and a Check API for answering access questions.
  62. OpenID Connect (OIDC)AM & AccessAn identity layer built on top of OAuth 2.0 that adds a standardized way to prove who the user is — the "login" OAuth alone was never designed to provide.
  63. Orphan AccountIAM FoundationsAn account with no corresponding identity in the master record — typically left behind when someone departs and their access was never removed.
  64. P
  65. PasskeyAM & AccessA WebAuthn credential synced across a user's devices through their platform account, so phishing-resistant public-key login works without a separate hardware key per device.
  66. Policy as CodeAM & AccessWriting authorization rules in a dedicated, testable language instead of scattering `if` statements through application code — the engineering practice that makes PBAC real.
  67. Policy BundleAM & AccessA versioned package of compiled policy that a central authoring point publishes to a registry, which distributed PDPs — sidecars, edge functions — pull and hot-load independently.
  68. Policy Decision Point (PDP)AM & AccessThe component that evaluates a policy against a request and returns a decision — permit, deny, or something more nuanced — without itself blocking or allowing anything.
  69. Policy Enforcement Point (PEP)AM & AccessThe component that sits in the request path, asks a PDP for a decision, and actually allows or blocks the request — the reference monitor's role in a modern distributed architecture.
  70. Policy-Based Access Control (PBAC)AM & AccessThe umbrella move of decoupling access decisions from application code into a formal, centrally managed policy — the discipline ABAC, RBAC, and ReBAC rules can all be written and governed under.
  71. Principle of Least PrivilegeIAM FoundationsThe rule that every identity should hold the minimum access needed to do its job — no more, "just in case."
  72. Privilege CreepIAM FoundationsThe silent accumulation of access across role changes, caused by granting new entitlements without ever retiring the old ones.
  73. ProfileIAM FoundationsA partial, contextual view of an identity, exposed for presentation or data-minimization purposes.
  74. ProvisioningIAM FoundationsThe automated creation of accounts and access when someone joins — and, in reverse, their removal when someone leaves.
  75. Push Bombing (MFA Fatigue)AM & AccessAn attack where someone with a stolen password floods a victim with MFA push notifications until they approve one out of annoyance or confusion, rather than because they intended to log in.
  76. R
  77. RADIUSAM & AccessA network-access protocol from the 1990s that centralizes authentication, authorization, and accounting for who gets onto the network — VPNs, Wi-Fi, and switches all lean on it.
  78. Reference MonitorAM & AccessThe abstract concept of the thing that actually says "no" — an access-control checkpoint that mediates every subject-to-object request, can't be bypassed, and is small enough to verify.
  79. Refresh TokenAM & AccessA long-lived credential a client stores privately and exchanges at the authorization server for new access tokens, so the user isn't asked to re-approve access every few minutes.
  80. Relationship TupleAM & AccessThe single fact Zanzibar-style systems store — object, relation, subject — like "report:Q3
  81. Relationship-Based Access Control (ReBAC)AM & AccessAn access model where permission comes from a relationship between subject and resource — often walked through a graph — rather than a role or a static attribute, the model Google Zanzibar popularized.
  82. Risk-Based Authentication (RBA)AM & AccessAuthentication that computes a real-time risk score from signals like location, device, and behavior, and asks for more proof only when the score is high — instead of applying the same fixed friction every time.
  83. Role ExplosionAM & AccessRBAC's characteristic failure mode — minting a new, narrower role for every resource-specific exception until the role count rivals or exceeds the user count, defeating the whole point of roles.
  84. Role-Based Access Control (RBAC)AM & AccessAn access model that assigns permissions to roles, and roles to users, instead of managing individual grants per person — the model that actually runs most enterprises.
  85. S
  86. SAML 2.0AM & AccessAn XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider, best known for enterprise web SSO.
  87. SCIM 2.0AM & AccessA standard REST API and resource model for provisioning and deprovisioning users and groups across systems — the protocol that drives the JML lifecycle instead of custom scripts.
  88. ScopeAM & AccessA named permission an OAuth client requests and a user consents to — the unit that limits what an access token actually authorizes.
  89. Segregation of Duties (SoD)IAM FoundationsRules that flag toxic combinations of access — like being able to both create a vendor and approve payments to it — usually created by overlapping entitlements.
  90. Service Provider (SP)AM & AccessThe application a user is trying to reach — it outsources authentication to an identity provider and trusts the assertion or token that comes back instead of checking a password itself.
  91. Session HijackingAM & AccessStealing a valid session identifier — through interception, XSS, or an insecure cookie — to act as the victim without ever knowing their password.
  92. Session TokenAM & AccessAn opaque identifier stored in a cookie that points to session state kept on the server — the alternative to a self-contained JWT session, revocable by deleting one database row.
  93. Sidecar AuthorizationAM & AccessRunning a local authorization engine alongside each service instance — reached over `localhost` — so every request is checked without a network hop to a central decision service.
  94. Single Sign-On (SSO)AM & AccessOne login that establishes a session trusted across many applications, instead of a separate username and password for each — the master session an IdP issues once and every app checks after.
  95. Step-Up AuthenticationAM & AccessAsking for an additional authentication factor mid-session, right when a user attempts something more sensitive than their original login justified.
  96. SubjectIAM FoundationsThe real-world person, device, service, or system that a digital identity represents inside a computer system.
  97. T
  98. TOTP (Time-based One-Time Password)AM & AccessA one-time code, valid for about 30 seconds, generated from a shared secret and the current time — the algorithm behind most authenticator apps.
  99. Z
  100. Zero TrustAM & AccessA security model built on "never trust, always verify" — no request is trusted by default just because it came from inside the network perimeter; every access decision is checked on its own merits.