Glossary

Identity & access management, defined.

Plain-English reference for the vocabulary that comes up in every IAM engagement, including the terms around AI agents and non-human identity that many companies are only just starting to grapple with.

Core terms

The fundamentals.

IAM (Identity and Access Management): The discipline of ensuring the right identities, human or otherwise, have the right access to the right systems, for the right amount of time, with evidence to prove it. Covers the account lifecycle, access governance, and authentication.
IGA (Identity Governance and Administration): The combination of identity lifecycle management (provisioning, deprovisioning) and access governance (certification, policy enforcement) into one coordinated program.
RBAC (Role-Based Access Control): An access model where permissions are assigned to roles rather than individuals, and users inherit access by being assigned to a role. Simplifies provisioning and makes access reviews far easier to reason about than per-user permissions.
ABAC (Attribute-Based Access Control): An access model where permissions are granted based on attributes of the user, resource, and context (department, clearance level, time of day, location) rather than a fixed role. More flexible than RBAC, but harder to audit.
SSO (Single Sign-On): Authentication that lets a user log in once and access multiple connected applications without re-entering credentials for each one. Reduces password sprawl and gives IT a single point to enforce policy and revoke access.
MFA (Multi-Factor Authentication): Authentication requiring two or more independent factors, something you know (a password), something you have (a device or token), or something you are (biometrics), before granting access.
PAM (Privileged Access Management): Controls specifically for accounts with elevated permissions, such as administrators, service accounts, and break-glass credentials, including credential vaulting, session monitoring, and just-in-time access instead of standing privilege.
SoD (Segregation of Duties): A control that prevents any single identity from holding two permissions that, combined, create fraud or error risk, for example the ability to both create a vendor and approve payments to it.
Least Privilege: The principle that every identity, human or non-human, should hold the minimum access necessary to do its job, and nothing more. The foundational assumption underneath almost every other IAM control.
Zero Trust: A security model that assumes no user, device, or system is inherently trusted, even inside the network perimeter. Every access request is verified based on identity, device posture, and context, every time.
Provisioning / Deprovisioning: Provisioning is creating accounts and granting access when an identity needs it. Deprovisioning is removing that access when it's no longer needed. It's the single most common source of access risk when done manually or late.
Joiner-Mover-Leaver (JML): The standard lifecycle framework for managing identity changes: a Joiner gets provisioned, a Mover has access adjusted for a role change, a Leaver gets fully deprovisioned. Automating JML is usually the highest-leverage first step in an IAM program.
Identity Provider (IdP): The system of record that authenticates users and issues the tokens other applications trust, for example Microsoft Entra ID, Okta, or Google Workspace. Usually the hub that SSO and federation are built around.
Directory Service: A centralized store of identity data, such as usernames, group memberships, and attributes, that applications query to authenticate and authorize users. Active Directory is the most common on-premises example; cloud directories serve the same role.
Access Certification: A periodic review where a manager or system owner confirms that each person's access is still appropriate, revoking anything that isn't. The primary evidence auditors look for that access isn't just granted once and forgotten.
Entitlement: A specific permission or right granted within a system: a role, a group membership, a file share, an admin flag. Access certification reviews entitlements, not just whether someone has "access" broadly.
Federation: Trust established between organizations or systems so an identity authenticated in one domain is accepted in another, without a separate account. It's the mechanism behind "Sign in with [company]" and B2B SSO.
SCIM (System for Cross-domain Identity Management): An open standard for automatically provisioning and deprovisioning user accounts between an identity provider and downstream applications, keeping them in sync without manual admin work.

AI & non-human identity

The newest frontier in IAM.

Non-Human Identity (NHI): Any identity that isn't a person: a service account, an API key, a workload, or an AI agent. Most organizations now have significantly more non-human identities than human ones, and they're often over-privileged, long-lived, and missing from standard access-certification processes.
Machine Identity: The credentials (certificates, keys, tokens) that let a system, service, or device authenticate to other systems without a human present. A subset of non-human identity focused specifically on infrastructure-to-infrastructure trust.
Service Account: A non-human account used by an application or automated process to authenticate and run scheduled or system-level tasks. A common source of standing, over-broad privilege because it's created once and rarely revisited.
Workload Identity: An identity assigned to a specific running workload (a container, a function, a cloud service) rather than a static, long-lived credential, which allows access to be scoped and rotated automatically as workloads start and stop.
Agentic AI: AI systems that can take autonomous, multi-step action on a user's or organization's behalf, such as calling APIs, modifying data, or triggering downstream processes, rather than only generating text in response to a prompt. Agentic AI is what turns "AI identity" from a theoretical concern into an operational one.
AI Agent Identity: The credentialed, accountable identity assigned to a specific AI agent so its actions can be scoped, monitored, and attributed, the same way a human employee's actions are tied to their account, instead of the agent running under a shared or anonymous service credential.
AI Agent Access Governance: Applying the same core IAM disciplines (lifecycle management, access certification, least privilege) to AI agents and the credentials they use, so agent access is provisioned deliberately, reviewed on a schedule, and retired when the agent's task or purpose ends.
Passkey: A passwordless credential built on public-key cryptography: a private key stored on the user's device that never leaves it, paired with a public key the server holds. Removes the shared secret a password represents, which removes phishing and credential-stuffing as viable attacks.
FIDO2 / WebAuthn: The open standards passkeys are built on. FIDO2 defines the overall authentication framework; WebAuthn is the browser API that lets websites request and verify a cryptographic credential instead of a password.
MCP (Model Context Protocol): An open standard that lets an AI agent connect to outside tools, such as a database, a CRM, or a file system, through a common interface instead of a custom integration per tool. Removes integration friction, which also removes the friction that used to force someone to think about access scope.
Agent-to-Agent Authentication: The mechanisms by which one AI agent verifies the identity and authorization of another agent before accepting a request or acting on its behalf, increasingly necessary as agents call other agents directly rather than only calling tools.
Agent Accountability: The property that every autonomous action an AI agent takes can be traced back to an owned, identifiable agent identity, a responsible person or team, and a record of what authorized the action.
Provenance: A record of what triggered a given action, what policy authorized it, and what data or systems it touched, kept alongside the identity that performed it. The context that turns a log entry into something an investigation can actually use.
Identity Verification: The process of confirming that someone requesting access, approving a transaction, or completing onboarding is actually who they claim to be. Increasingly complicated by generative AI tools capable of producing convincing fake voices, video, and documents.
Deepfake Fraud: Fraud carried out using AI-generated audio or video that convincingly impersonates a real person, used to authorize fraudulent transactions or bypass identity checks that rely on recognizing a voice or face.
Out-of-Band Verification: Confirming a request through a separate, independent channel from the one it arrived on, for example calling back a known phone number rather than replying to the message that made the request. Defeats most impersonation and deepfake fraud by design.

Have a question this doesn't answer? See the FAQ, or get in touch directly.

Let's talk

Find out where your identity program actually stands.

Start an assessment today