#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.
Showing 56 featured terms of 1,416 — filter by letter or domain, or search to filter the results
The definitive NHI reference glossary.
Every term is written for IAM practitioners, architects, and security professionals.
Covering Non-Human Identity, Agentic AI security, secrets management, workload identity, and the complete NHI governance landscape.
Maintained by the NHI Mgmt Group Editorial Knowledge Base and reviewed by Lalit Choda, Founder of NHI Mgmt Group.
Foundations & NHI Taxonomy
51 terms
Cloud Identity
Foundations
A cloud identity is any account, role, token, or credential used to access cloud services and resources. In practice, it includes both human and non-human id…
Healthcare Identity And Access Management
Foundations
Healthcare identity and access management is the discipline of controlling who or what can access patient data, clinical apps, and connected services. In int…
Human Identity
Foundations
A human identity is a verified person in an IAM system, such as an employee, contractor, or administrator. It is tied to interactive authentication, attribut…
Infrastructure Inventory
Foundations
The authoritative record of what systems exist, where they run, who owns them, and what business function they support. In identity terms, inventory only mat…
Observability
Foundations
Observability is the ability to understand the internal state of a system from the data it produces. In security and operations, that means combining logs, m…
Public-Facing Identity
Foundations
A person’s visible professional persona across social media, interviews, conferences, and branded communications. It becomes a security asset when others rel…
Software provenance
Foundations
Software provenance is the evidence that shows where an artifact came from, who created it, and whether it was altered before use. For security teams, it mea…
NHI Lifecycle Management
66 terms
AI Integration Offboarding
Lifecycle
The process of fully disconnecting an AI tool from enterprise systems, revoking credentials, removing permissions, and deleting retained data where possible.…
API Key Rotation
Lifecycle
API key rotation is the process of replacing a secret with a new value before or after risk emerges. In NHI governance, it is a lifecycle control that reduce…
Data and AI Lifecycle
Lifecycle
The Data and AI Lifecycle is the end-to-end set of processes used to prepare data, train models, deploy AI systems, and run them in production. It includes t…
Deprovisioning
Lifecycle
Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens…
Dynamic Identity File
Lifecycle
A dynamic identity file is a credential file that can be reloaded from disk when the underlying identity changes. It is useful for automation that must keep …
Orphaned Role
Lifecycle
An orphaned role is a permission set or privileged identity that no longer has a clear owner or active business justification. These roles often persist afte…
User Provisioning
Lifecycle
User provisioning is the process of creating, changing, and removing access rights across systems. In practice, it includes account creation, role assignment…
Authentication, Authorisation & Trust
224 terms
Automounting
Auth & Trust
Automounting is the default Kubernetes behaviour that places a service account token into a pod when the workload starts. It is convenient, but it can expose…
Claim Validation
Auth & Trust
Claim validation is the process of checking whether token fields such as issuer, audience, subject, and expiry match the expected security context. It is the…
Claim-bound trust
Auth & Trust
Claim-bound trust means a target system only grants access when a token carries approved issuer, audience, and subject claims. It is the mechanism that makes…
Json Web Token
Auth & Trust
A JSON Web Token is a compact, signed token that carries claims between systems so they can verify identity or authorization without consulting a central ses…
Machine-to-Machine Authentication
Auth & Trust
Machine-to-machine authentication is the process of proving the identity of one system to another before data or commands are exchanged. In practice, it must…
Projected Volume Token
Auth & Trust
A projected volume token is a Kubernetes credential delivered into a pod with a bounded lifetime rather than stored indefinitely as a Secret. It supports a m…
Token Revocation
Auth & Trust
Token revocation is the ability to invalidate a credential before its natural expiry when it is exposed, misused, or no longer needed. For JWTs and other NHI…
Architecture & Implementation
181 terms
Admission Controller
Architecture
An admission controller is a Kubernetes control that validates or changes workload requests before the cluster admits them. It acts as a deployment-time poli…
Container Image Layer
Architecture
A container image layer is one step in the stacked filesystem that makes up an image. Layers can preserve files, secrets, and configuration from earlier buil…
Dynamic Trust
Architecture
Dynamic trust is a model where access is re-established based on current context rather than assumed from a previously issued credential. For machine identit…
Observability layer
Architecture
The observability layer is the translation point between raw security findings and decision-ready context. It deduplicates alerts, groups them by owner or pr…
Pre-commit Hook
Architecture
A pre-commit hook is an automated local check that runs before code is written into git history. It is especially useful for catching secrets, because once a…
Secure-by-Design
Architecture
Secure-by-design means security requirements are built into the development process rather than added after release. The practical aim is to define minimum a…
Security Gate
Architecture
A security gate is an enforceable checkpoint in a delivery pipeline that prevents software from advancing until it satisfies a defined control. In DevSecOps,…
Governance, Ownership & Risk
448 terms
CI/CD identity surface
Governance
The CI/CD identity surface is the set of credentials, tokens, roles, and trust relationships used by build and deploy automation. It is a non-human identity …
Consent Fatigue
Governance
Consent fatigue happens when users approve application access quickly without understanding the permissions they are granting. In SaaS environments, repeated…
Generative AI Tool Governance
Governance
The set of policies and operational controls used to approve, monitor, and revoke access for AI tools that process enterprise data. It treats the tool as a n…
Lifecycle Drift
Governance
Lifecycle drift is the gap between the intended state of an identity and the access that remains active in systems after the business context changes. It oft…
OT to IT communication
Governance
OT to IT communication is the exchange of data or commands between operational technology and enterprise information systems. It creates a governance challen…
Risk-Based Recertification
Governance
Risk-based recertification is a review approach that focuses attention on access with the highest potential impact. Instead of treating every entitlement equ…
User Access Management
Governance
User access management is the set of policies, workflows, and controls used to decide who or what can access systems, applications, and data. It covers grant…
Threats, Abuse & Incident Response
185 terms
Behavioural Analytics
Threats
Behavioural analytics compares current activity against normal patterns to detect anomalies that may indicate abuse or compromise. In identity programmes, it…
DevSecOps vulnerability management
Threats
DevSecOps vulnerability management is the process of finding, ranking, and fixing security issues inside software delivery workflows. It combines scanners, o…
Identity Threat Taxonomy
Threats
A structured way to group identity-related attack behaviours into related stages and patterns. It helps defenders understand how fraud unfolds across enrolme…
Impersonation Runbook
Threats
A predefined response procedure for handling fake accounts, synthetic media, or false claims attributed to a real person or organisation. It should cover val…
New Account Fraud
Threats
New account fraud is the creation or takeover of a fresh identity during enrolment so an attacker can establish trust and later abuse it. It often exploits w…
Reachability analysis
Threats
Reachability analysis checks whether a vulnerability can actually be exploited in the application’s real code paths and dependency graph. It helps teams dist…
Software Composition Analysis
Threats
Software composition analysis is the inspection of dependencies and packages to identify known vulnerabilities in third-party or transitive code. It compleme…
Agentic AI & Autonomous Identity
163 terms
Adversarial AI Explainability
Agentic AI
A research approach that uses model-introspection and behavioural analysis to understand how adversarial prompts affect an LLM. It is not a security control …
Agent Governance
Agentic AI
Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool acces…
AI Agent Builder
Agentic AI
An AI agent builder is a platform or framework used to create autonomous software that can plan, call tools, and complete tasks on behalf of a user or system…
AI Runtime Operations
Agentic AI
AI runtime operations are the live execution processes that let a model respond to prompts, process inputs, and interact with data or tools. This phase matte…
AI Runtime Security
Agentic AI
AI runtime security is the set of controls that inspect, constrain, and respond to model behavior while the application is live. It includes detection, maski…
AppSec MCP Server
Agentic AI
A context-sharing interface that connects application security tools, IDEs, CI pipelines, and policy systems through the Model Context Protocol. In practice,…
MCP
Agentic AI
Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integra…
NHI & Agent in the Broader IAM Ecosystem
20 terms
AI-native classification
IAM Ecosystem
AI-native classification is the use of contextual models to identify sensitive data more accurately than static pattern matching alone. It adapts to business…
Dataverse Web API
IAM Ecosystem
Dataverse Web API is the interface used to query Copilot Studio and Power Platform data, including agent records and related components. For security teams, …
Provenance
IAM Ecosystem
Provenance is the traceable history of where a software artifact came from, who approved it, and what controls were applied along the way. In container secur…
Runtime DLP
IAM Ecosystem
Runtime DLP is data loss prevention enforced during live AI interactions instead of only at rest or on paper. It inspects prompts, responses, and transfers i…
SCIM Provisioning
IAM Ecosystem
SCIM provisioning is a standardized way to sync identity information between systems. It helps automate account creation, updates, and removal across connect…
SMART on FHIR
IAM Ecosystem
SMART on FHIR is a healthcare interoperability pattern that combines the SMART app framework with HL7 FHIR data exchange. It lets applications request scoped…
Vehicle-to-everything
IAM Ecosystem
Vehicle-to-everything, or V2X, is the communication model that allows vehicles to exchange data with other vehicles, infrastructure, networks, and related sy…
No terms match your search.
Clear search
Clear search
Deepen your NHI knowledge with the official certification course.
NHI Foundation Level Course → Browse FAQ → Discussion Forum →