Reference

IAM glossary

Canonical definitions for the identity and access management terms used across this publication, from IAM and MFA to non-human identity and agentic identity.

Identity and access management (IAM): Identity and access management is the discipline and the tooling that ensure the right people can access the right resources at the right time. It covers authentication, authorization, directory services, and the lifecycle of an identity from joining to leaving.
Multi-factor authentication (MFA): Multi-factor authentication requires two or more independent authentication factors before granting access, typically something the user knows and something the user has. Factors verify that the returning account holder is the same party who enrolled, which is distinct from proving who that party is in the first place. MFA is one capability inside identity and access management, not a category of its own.
Phishing-resistant MFA: Phishing-resistant MFA uses cryptographic binding between the authenticator and the site being accessed, so a credential proven to one origin cannot be replayed against another. FIDO2, which combines the WebAuthn browser API with the CTAP device protocol, is the common modern implementation. Certificate-based authentication using smart cards remains widespread in government and regulated industries.
Single sign-on (SSO): Single sign-on lets a user authenticate once and reach multiple applications without re-entering credentials. The identity provider issues assertions, usually over SAML or OpenID Connect, that each application trusts.
Identity provider (IdP): An identity provider authenticates users and issues the assertions that applications trust, usually over SAML or OpenID Connect. An identity provider does not have to own a directory: it can federate to one it does not hold, which is how AD FS, PingFederate, and Shibboleth operate. Owning the directory determines who holds the source of truth, not whether the platform is an identity provider.
Identity governance and administration (IGA): Identity governance and administration covers access certification, policy enforcement, segregation of duties, and compliance-grade lifecycle provisioning. It answers who should have access, and proves it to an auditor.
Privileged access management (PAM): Privileged access management secures high-risk credentials such as administrator and root accounts through vaulting, session recording, and just-in-time elevation. It is a specialized layer, usually deployed alongside a workforce access platform.
Customer identity and access management (CIAM): Customer identity and access management handles authentication, registration, consent, and profile data for external users at consumer scale. It optimizes for conversion and privacy obligations rather than for internal governance.
Zero Trust: Zero Trust is a security model that removes implicit trust from network location and verifies every access request against identity, device posture, and context. Access is granted per session and per resource rather than once at the perimeter.
Non-human identity (NHI): A non-human identity is any identity that belongs to software rather than a person: service accounts, API keys, workloads, scripts, and AI agents. Non-human identities typically outnumber human ones and are more often over-permissioned and unowned.
Machine identity: A machine identity is the credential and certificate material that lets a workload, device, or service prove what it is to another system. Usage is not settled across the market: parts of the certificate-lifecycle industry treat machine identity as the umbrella term. This publication treats it as the infrastructure-facing subset of non-human identity.
Agentic identity: Agentic identity is the security practice of giving each AI agent its own trusted non-human identity, with least-privilege access and a named human owner. What distinguishes an agent from other non-human identities is that it selects its own actions, so it needs authorization decided per action rather than a fixed grant made once.
Security-first IAM: Security-first IAM is identity and access management built to defend the access point rather than only administer it, secure by default across the whole login journey. Traditional identity and access management was built for the administrator, with security capability added afterward and often priced as a premium tier.
Least privilege: Least privilege grants an identity only the permissions required for the task at hand. It is a property of scope rather than of duration: time-bounding access is a separate control, usually called just-in-time access. For non-human identities least privilege increasingly means authorization scoped per action or per tool call rather than per account.
Identity threat detection and response (ITDR): Identity threat detection and response monitors authentication and directory activity for attacks in progress, such as session hijacking, MFA flooding, adversary-in-the-middle phishing, and admin impersonation, and triggers a response. It is the detection layer of identity security, distinct from the posture layer that finds weaknesses before they are used.
Identity security posture management (ISPM): Identity security posture management continuously assesses an identity estate for weakness: missing or weak MFA, dormant accounts, excessive privilege, and configuration drift across providers. It answers where an organization is exposed, rather than what is happening right now.