Enterprise IAM and Zero Trust Architecture

Identification

The act of presenting an identity claim, such as a username, account ID, or workload ID.

Authentication

Verifying that a requester controls an identity using one or more authenticators.

Authorization

Determining whether an authenticated identity may perform a requested action on a resource under policy.

Identity Provider (IdP)

A system that authenticates identities and commonly issues signed assertions or tokens for relying applications.

Directory

A store of identity records and attributes, such as groups, department, status, and device ownership.

Policy Enforcement Point

The component that applies an allow, deny, limit, or challenge decision at a resource boundary.

Authentication Assurance Level (AAL)

A measure of confidence that a claimant controls authenticators bound to an account. AAL selection should reflect the risk and impact of the service or transaction.

Step-up authentication

A request for stronger or fresher authentication when a user attempts a sensitive action or risk signals become elevated.

Phishing resistance

A protocol property that prevents an impostor service from obtaining authentication secrets or valid outputs without depending on the user to recognize the scam.

Passkey

A user-friendly public-key credential, commonly implemented with FIDO2/WebAuthn, that can authenticate to a specific relying party without a typed shared secret.

Authenticator binding

The process of associating a specific authenticator with a subscriber account so it can be used for that account.

Account recovery

A controlled process for regaining access after losing required authenticators. It is high-risk because it can be targeted for account takeover.

Identity Provider (IdP)

In SAML, the system that authenticates the user and issues assertions to Service Providers.

Service Provider (SP)

In SAML, the application that consumes a validated assertion and provides a service to the user.

OpenID Provider (OP)

In OpenID Connect, the provider that authenticates the end user and issues ID Tokens. It commonly acts as an OAuth authorization server.

Authorization server

The OAuth component that authorizes a client and issues tokens according to policy and user authorization.

Resource server

The API or service that protects resources and validates access tokens before fulfilling requests.

PKCE

Proof Key for Code Exchange: binds an authorization code to a client-generated verifier, reducing code interception and injection risk.

Authoritative identity source

The system trusted to provide a specific identity attribute, such as employment status or contractor end date.

Joiner-mover-leaver

A lifecycle model for creating, changing, and removing digital access as a person's relationship or role changes.

SCIM

A standards-track HTTP protocol and schema framework for managing identity resources such as users and groups across domains.

Birthright access

Baseline access automatically assigned because of a verified worker type, role, or organizational relationship.

Orphan account

An account that remains active but has no valid, active identity or approved business owner associated with it.

Reconciliation

A comparison between expected identity and access data and the actual accounts and entitlements found in target systems.

Default deny

A security posture in which access is denied unless a policy explicitly permits the request.

Least privilege

Granting only the minimum access needed to perform a legitimate task, for the minimum necessary time.

RBAC

Role-based access control: permissions are assigned to roles, and users gain permissions through role assignment.

ABAC

Attribute-based access control: policies evaluate attributes of the subject, resource, action, and environment.

ReBAC

Relationship-based access control: decisions depend on relationships such as owner, member, manager, or assigned reviewer.

PDP and PEP

The Policy Decision Point evaluates policy; the Policy Enforcement Point enforces the resulting decision near the protected resource.

Privileged account

An identity with elevated permissions that can administer systems, alter security controls, access sensitive resources, or affect many users.

Credential vaulting

Protecting privileged passwords, keys, tokens, or certificates in a managed store that can control retrieval and rotate secrets.

Just-in-time (JIT)

Granting elevated access only when needed and automatically removing it after a short approved period.

Just-enough administration (JEA)

Granting only the smallest set of permissions needed to complete a defined task.

Session monitoring

Recording and analyzing privileged activity during an administrative connection, often through a broker or proxy.

Command control

Allowing, alerting on, or blocking commands based on policy, task scope, and risk.

Workforce IAM

Identity and access management for employees and contractors, commonly integrated with employer-controlled onboarding, offboarding, devices, and security policy.

B2B federation

A trust arrangement in which one organization accepts authentication assertions from another organization's identity provider.

Delegated administration

Limited authority granted to an administrator to manage identities or access within a defined boundary, such as one partner organization.

CIAM

Customer identity and access management: self-service identity capabilities designed around customer experience, privacy, consent, scale, and fraud resistance.

Identity proofing

Collecting and validating evidence to establish confidence that a person is the claimed real-world identity. It is different from merely verifying control of an email address.

Workload identity

A verifiable identity for software such as a service, container, function, or virtual machine, used to authenticate machine-to-machine access.

Policy Engine

The logical component that evaluates policy and evidence to decide whether access should be allowed, denied, constrained, or challenged.

Policy Enforcement Point

The component that enforces an access decision near a resource, such as an application proxy, API gateway, database gateway, sidecar proxy, or endpoint agent.

Policy Information Point

A source of evidence for policy decisions, such as an identity provider, device-management system, endpoint security tool, SIEM, or data-classification service.

Device Posture

Security-relevant device state, such as management enrollment, encryption, patch level, endpoint detection status, and current risk score.

Workload Identity

A distinct, verifiable identity for software such as a service, container, job, or microservice. It replaces shared static credentials.

Least Privilege

Granting only the minimum access needed for a specific task, resource, and time period.