NHI and IAM Glossary: Identity Security Terms

Identity security has its own vocabulary, and the same word often means different things to IAM, security operations, developers and auditors. This glossary gives short, precise definitions of the core terms across non-human identity (NHI), identity and access management (IAM), identity governance (IGA), privileged access (PAM), authentication and identity verification. It is written for practitioners, architects and risk teams. Where a term is defined by a standard, we say which, and each term links to the guide that covers it in depth. For agent-specific terms, see the Agentic AI Glossary.

A

Access review (access certification): A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor. See the Access Reviews Guide.
Access token: A short-lived bearer credential issued after successful authorization that allows an application to call APIs on a user's behalf. In NHI governance terms, it is a reusable access artifact whose scope, expiry, and revocation path must be controlled like any other privileged credential. See the Token and Session Security Guide.
Account takeover (ATO): Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach. See the Identity Fraud Prevention Guide.
API key: A unique identifier used to authenticate a software application or service when calling an API. API keys are static, long-lived credentials and a major source of secrets sprawl. In 2024, over 50 million leaked API keys were found on the dark web. See the API Key Management Guide.
Attribute-based access control (ABAC): Attribute-Based Access Control is a policy model that grants or denies access using attributes such as user role, device state, location, and application context. It replaces purely static role assignment with a decision process that can adapt to current conditions, provided the underlying attributes are trustworthy and well-governed. See the Authorisation Models Guide.
Authentication: Authentication is the process of proving that an identity is genuine. In practice, it uses credentials, certificates, biometrics, or other factors to establish who or what is requesting access. For NHIs, the key issue is whether the proof is strong enough to resist theft, replay, or misuse. See the IAM and IGA Basics.
Authenticator assurance level (AAL): Authenticator assurance level is a measure of how strongly an identity event proves the claimant is genuine. In NIST 800-63B, higher levels require stronger factor evidence and tighter cryptographic protections, which makes the level a practical way to map identity controls to regulated access requirements. See the MFA Guide.
Authorisation: Authorization is the decision about what an authenticated identity is allowed to do. In NHI and IAM practice, it covers scope, duration, and allowable actions, and it is the layer that most directly controls blast radius when access is active. See the Authorisation Models Guide.
Authoritative source: An authoritative source system is the primary business system trusted to define a specific identity attribute or lifecycle event. HR, SIS, and CRM platforms often serve this role for different populations or fields. IAM should consume these records as truth, rather than overwriting them with local corrections. See the Identity Data Quality and Identity Fabric Guide.

B–C

Beneficial owner: Beneficial ownership identifies the person or entity that ultimately controls or benefits from an account, company, or asset. In EDD, it matters because nominal ownership can hide the real decision-maker, which is often the entity regulators and investigators need to understand. See the KYB Guide.
Biometric verification: Biometric face verification is a digital identity check that compares a live face to an identity document or trusted reference to confirm the person is who they claim to be. It is commonly used for remote onboarding because it can improve convenience, scalability, and assurance without requiring an in person branch visit. See the Biometrics Guide.
Break-glass account: An emergency credential used when normal access paths fail or become unavailable. These accounts are essential for recovery, but they are also high risk because they often bypass standard workflows, so they need tight vaulting, strong authentication, dual control, and continuous monitoring. See the Break-Glass Account Guide.
Business email compromise (BEC): A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls. See the Email Identity and BEC Guide.
Certificate authority (CA): Certificate Authority Services are the trust services that issue and manage digital certificates for users, applications, and machines. They anchor encrypted communication by proving identity and supporting certificate lifecycle controls such as issuance, renewal, revocation, and validation across enterprise systems. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Certificate lifecycle management (CLM): The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps. See the CLM Buyer's Guide.
CIAM (customer identity and access management): Customer identity and access management is the identity layer that supports customer-facing applications. It covers onboarding, authentication, consent, and account recovery, and it is tightly coupled to user experience and commercial outcomes because failures in CIAM directly affect trust, conversion, and retention. See the Customer IAM (CIAM) Guide.
CIEM (cloud infrastructure entitlement management): Cloud Infrastructure Entitlements Management is the discipline of analysing cloud permissions and entitlements to reduce excessive access. It focuses on who or what can do what in cloud environments, helping teams enforce least privilege and identify risky accounts, unused permissions, and entitlement sprawl. See the Cloud PAM and CIEM Guide.
Client credentials grant: An OAuth 2.0 grant type used for machine-to-machine authentication where an application authenticates directly using its own client ID and secret to obtain an access token. The standard pattern for service-to-service NHI authentication. See the OAuth 2.0 and OpenID Connect Guide.
Conditional access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour. See the Identity Provider and SSO Security Guide.
Credential stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away. See the Password Security Guide.

D–F

Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection. See the Deepfake and AI Impersonation Guide.
Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it. See the Joiner-Mover-Leaver Guide.
Device identity: Device identity is the cryptographic proof that a specific machine is the thing being accessed, independent of its IP address or current network. In fleet governance, it allows policy, audit, and revocation to follow the device across locations and transports. See the Device and IoT Identity Guide.
Digital identity wallet: A digital identity wallet is software that stores and presents credentials for a person or organisation. It is a portability layer, not an authorization system. The wallet moves verified proof between parties, while the relying party still has to decide whether the proof is sufficient for the requested action. See the Digital Identity Wallets Guide.
DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state. See the Email Identity and BEC Guide.
Dynamic secret: A secret generated on-demand for a specific task and automatically revoked after use or expiry. Dynamic secrets dramatically reduce the risk of credential exposure compared to static, long-lived secrets and are considered best practice. See the Secrets Management Guide.
Entitlement: An entitlement is the permission set that defines what a non-human identity can do after it authenticates. It is usually expressed through roles, policies or access assignments, and unmanaged entitlements are a common reason machine identities become over-privileged over time. See the IAM and IGA Basics.
Federation: A federation trust is a relationship that allows one identity provider or signing authority to assert identity for another system. In cloud environments, mismanaged trusts can become a high-value attack path because attackers may abuse certificates, tokens, or configuration changes to impersonate legitimate access. See the Identity Provider and SSO Security Guide.
FIDO2: FIDO2 is a passwordless authentication standard that uses public-key cryptography instead of shared secrets. A service stores the public key while the authenticator keeps the private key, allowing users to prove possession without sending reusable credentials over the network. See the Passwordless and Passkeys Guide.

H–I

Hardware security module (HSM): A hardware security module is a tamper-resistant device or service used to generate, store, and use cryptographic keys without exposing them directly to endpoints. For code signing, it reduces the chance that a compromised workstation or build server can steal the signing authority. See the Cryptographic Key Management Guide.
Human identity: A human identity is a verified person in an IAM system, such as an employee, contractor, or administrator. It is tied to interactive authentication, attributable actions, and access policies that can be reviewed and revoked by the organisation. See Human vs Non-Human Identity.
IAM (identity and access management): Identity and Access Management is the discipline that governs how identities are created, authenticated, authorised, and removed. It covers people, services, and devices, along with the policies that decide what each can access. Strong IAM is foundational to zero trust because identity becomes the primary control plane. See the IAM and IGA Basics.
Identity assurance level (IAL): IAL measures how confidently an organisation knows who the person was when the account was created or proofed. It belongs to registration and enrollment, not day-to-day sign-in. Strong IAL does not automatically mean strong authentication at session time. See the Identity Proofing and KYC Guide.
Identity fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other. See the Identity Data Quality and Identity Fabric Guide.
Identity governance and administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users. See the IAM and IGA Basics.
Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request. See the Identity Proofing and KYC Guide.
Identity provider (IdP): An identity provider is the system that authenticates a user or workload and issues the trust signal used by downstream applications. In federated environments, it becomes a high-value control point because compromise, misconfiguration, or over-trust at this layer can affect many services at once. See the Identity Provider and SSO Security Guide.
Injection attack (biometric): An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point. See the Biometrics Guide.
ISPM (identity security posture management): Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents. See the ISPM Guide.
ITDR (identity threat detection and response): Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it. See the ITDR Guide.
IVIP (identity visibility and intelligence platform): An Identity Visibility and Intelligence Platform is a layer that correlates identity data across multiple tools into one risk picture. It does not replace existing controls. It makes them more useful by connecting events, relationships, configuration, and posture so teams can prioritise what matters. See the What Is IVIP?.

J–L

Joiner-mover-leaver (JML): Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk. See the Joiner-Mover-Leaver Guide.
JSON Web Token (JWT): A JSON Web Token is a compact, signed token that carries claims between systems so they can verify identity or authorization without consulting a central session store. In practice, its safety depends on strict validation of the signature, issuer, audience, expiry, and algorithm before any trust decision is made. See the Token and Session Security Guide.
Just-in-time (JIT) access: A security approach that grants access permissions only for the duration needed to complete a specific task, then automatically revokes them. JIT access eliminates standing privileges for NHIs, dramatically reducing attack surface. See the JIT Access Guide.
Key management: Key management is the controlled lifecycle of cryptographic keys, from generation and storage through rotation, use, and retirement. In enterprise environments it is the governance layer that determines whether keys remain trustworthy across users, workloads, devices, and applications. See the Cryptographic Key Management Guide.
KYB (know your business): Know Your Business is the process of verifying that a company is legitimate, properly owned, and suitable for onboarding or continued trust. It goes beyond registration checks by testing beneficial ownership, sanctions exposure, and ongoing risk so organisations can defend why they accepted the relationship. See the KYB Guide.
KYC (know your customer): KYC is the process of verifying a customer’s identity and assessing whether the relationship is acceptable to the business. In AML/CFT programmes, it includes identity evidence, risk checks, and ongoing review, not just a one-time signup step. See the Identity Proofing and KYC Guide.
Least privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius. See the Authorisation Models Guide.
Liveness detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions. See the Biometrics Guide.

M–N

Machine identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Managed identity: A cloud-provider-managed identity assigned to a compute resource, allowing it to authenticate to cloud services without storing credentials in application code. See the Cloud Workload Identity Guide.
MFA fatigue (push bombing): MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access. See the MFA Guide.
Multi-factor authentication (MFA): Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types. See the MFA Guide.
Mutual TLS (mTLS): A form of mutual authentication where both parties in a network connection verify each other's identity using digital certificates. Commonly used for service-to-service authentication in microservices architectures and zero-trust networks. See the NHI Authentication Guide.
NHI governance: NHI governance is the set of policies and controls used to manage non-human identities across their lifecycle. It covers issuance, access scope, monitoring, rotation, and retirement so machine credentials do not become hidden, durable attack paths. See the NHI Governance Maturity Model.
Non-human identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times. See The Ultimate Guide to NHIs.

O–P

OAuth 2.0: The industry-standard authorisation framework enabling applications to obtain limited, scoped access to user accounts or services via access tokens, without exposing credentials. The preferred authentication standard for modern NHI integrations. See the OAuth 2.0 and OpenID Connect Guide.
OAuth app (connected app): A connected app is a third-party integration that is granted access to a SaaS platform through APIs and OAuth permissions. From a governance perspective, it is an identity-bearing access path that needs ownership, scoping, and periodic review like any other non-human identity. See the SaaS and OAuth App Governance Guide.
OpenID Connect (OIDC): OpenID Connect is an identity layer built on OAuth 2.0 that lets applications authenticate users with compact tokens and standardised key discovery. It is widely used for modern web, mobile, and API-driven systems because it reduces integration overhead compared with older federation patterns. See the OAuth 2.0 and OpenID Connect Guide.
Orphaned account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments. See the NHI Ownership Guide.
Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse. See the Passwordless and Passkeys Guide.
Password spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access. See the Password Security Guide.
Personal access token (PAT): A personal access token is a reusable credential that authenticates a user or service to an API without a password. In practice, it inherits the permissions of the owning identity, which makes it a high-value non-human identity when it is exposed, copied, or left valid after the original task is complete. See the CI/CD Pipeline Identity Security Guide.
Phishing-resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions. See the MFA Guide.
PKCE (Proof Key for Code Exchange): Proof Key for Code Exchange is a binding mechanism that links the authorization request to the later token exchange. It helps stop authorization code interception and injection by requiring proof that the same client that started the flow is the one completing it. See the OAuth 2.0 and OpenID Connect Guide.
Post-quantum cryptography (PQC): Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems. See the Post-Quantum Readiness Guide.
Privileged access management (PAM): Privileged Access Management (PAM) is the set of controls that secure, monitor and govern accounts and credentials with elevated rights, such as administrators, root and service accounts. It typically combines credential vaulting and rotation, just-in-time elevation, and session brokering and recording, so privileged access is granted only when needed and every use is attributable. See the Privileged Access Management Guide.
Provisioning: Access provisioning is the process of creating and assigning permissions to a person, application, or workload. In mature IAM and NHI programs, provisioning is not just account creation. It includes scope control, ownership, and a defined path for revocation when the access is no longer needed. See the SCIM Provisioning Guide.

R–S

Refresh token: A longer-lived credential that can mint new access tokens without forcing the user to authenticate again. Because refresh tokens can preserve access for extended periods, they are a major governance concern when malicious or over-scoped applications are granted consent. See the Token and Session Security Guide.
Relationship-based access control (ReBAC): Relationship-based access control grants access by evaluating paths through relationships between subjects, resources, and intermediary objects. It is useful when permissions depend on how things are connected rather than on simple roles alone, but its runtime cost depends heavily on graph shape and traversal strategy. See the Authorisation Models Guide.
Role-based access control (RBAC): A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants. See the Role Mining and Role Design Guide.
Rotation: The practice of regularly replacing secrets and credentials with new values to limit the window of exposure if a credential is compromised. Automated rotation, enforced by policy, is the security-optimal approach. See the Guide to NHI Rotation Challenges.
SAML: Security Assertion Markup Language is an XML-based federation protocol used to pass signed identity assertions between an identity provider and a relying party. It remains common in enterprise SSO, but its certificate-driven trust model can make configuration and rotation more operationally demanding. See the Identity Provider and SSO Security Guide.
SCIM: System for Cross-domain Identity Management is the standard used to exchange user and group lifecycle data between an identity provider and an application. In production, the protocol only solves part of the problem. The harder issue is whether the implementation preserves attributes, order, and tenant scope consistently across real directory sources. See the SCIM Provisioning Guide.
Secret sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web. See the Guide to the Secret Sprawl Challenge.
Secrets management: The discipline of securely storing, distributing, rotating, and auditing secrets across an organisation's systems and pipelines, typically implemented via a centralised secrets vault such as HashiCorp Vault, AWS Secrets Manager, or Akeyless. See the Secrets Management Guide.
Segregation of duties (SoD): Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes. See the Segregation of Duties Guide.
Service account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors. See the Service Account Security Guide.
Service principal: An application identity object in Microsoft Entra ID and Microsoft 365 that represents a specific app inside a tenant. It holds permissions, ownership, and configuration data that define what the application can do. In NHI governance, it is a high-value identity that should be reviewed like any other privileged account. See the Service Account Security Guide.
Session hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance. See the Token and Session Security Guide.
Single sign-on (SSO): Single Sign On is a login method that lets a user access multiple applications with one authenticated session. Technically, an identity provider issues a trusted authentication assertion or token after the user signs in, and connected services accept that proof instead of requiring separate passwords for each application. See the Identity Provider and SSO Security Guide.
SPIFFE: Secure Production Identity Framework for Everyone (SPIFFE) and its reference implementation SPIRE, an open standard for providing cryptographic identities to workloads in dynamic cloud environments without relying on network location. See the Guide to SPIFFE and SPIRE.
SSH key: A cryptographic key pair used to authenticate to servers and services via the Secure Shell (SSH) protocol. SSH keys associated with service accounts and automated pipelines are a common NHI attack vector and frequently found orphaned or unrotated. See the SSH Key Management Guide.
Standing privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access. See the JIT Access Guide.
Synthetic identity: A fabricated identity built from a mix of real and invented attributes, used to open fraudulent accounts. See the Identity Fraud Prevention Guide.

T–Z

Third-party access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability. See the Third-Party Access Guide.
Token binding (sender-constrained token): Token binding links a token to a specific device, certificate, or connection so it cannot be reused elsewhere without the bound proof. It reduces replay risk by making theft alone insufficient, although it does not remove the need for monitoring and revocation. See the Token and Session Security Guide.
Verifiable credential: A verifiable digital credential is structured identity data that can be checked cryptographically by a relying party. Instead of relying on visual inspection, the verifier validates issuer signatures and presentation rules, which gives the control a clearer trust basis than an image-based document. See the Digital Identity Wallets Guide.
Workload identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials. See the Cloud Workload Identity Guide.
Workload identity federation: A mechanism allowing workloads in one environment to authenticate to another using short-lived tokens rather than stored credentials, based on mutual trust between identity providers. See the NHI Authentication Guide.
Zero standing privilege (ZSP): A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access. See the JIT Access Guide.
Zero trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated. See the Zero Trust Identity Guide.

For AI agent terms, see the Agentic AI Glossary, and for the wider vocabulary the NHI Mgmt Group Glossary. Related resources: Ultimate Guide to NHIs · IAM and IGA Basics · Top 10 NHI Issues