Glossary of IAM & AI Terminology

Identity and Access Management is an industry notorious for its acronyms. Use this glossary as a quick reference guide while reading.

Agentic AI: An advanced form of artificial intelligence that goes beyond simple chatbot interactions. Agentic AI can make autonomous decisions, chain API calls, and execute complex workflows on behalf of a user to achieve a high-level goal.

AiTM (Adversary-in-the-Middle): A sophisticated phishing attack where a hacker places a proxy server between the user and the legitimate login page. This allows the attacker to intercept live session tokens, effectively bypassing traditional SMS or App-based Multi-Factor Authentication.

ARC (Anytime Review Cycle): A modernized approach to continuous access certification. Instead of overwhelming managers with massive, annual spreadsheet audits, an ARC system triggers small, contextual access reviews precisely when an identity's risk profile changes.

DLS (Document-Level Security): The practice of applying strict Access Control Lists (ACLs) directly to individual files or data chunks, ensuring that search engines and AI models only retrieve information the querying user is legally permitted to see.

Ephemeral Token: A highly secure, dynamic credential that is generated on the fly, used for a single transaction (or a very short time window, like 5 minutes), and then mathematically self-destructs. The ultimate cure for hardcoded passwords.

FIDO2: An open authentication standard that enables passwordless, phishing-resistant logins using hardware security keys (like a YubiKey) or device-bound biometrics (like Apple TouchID or Windows Hello).

HITL (Human-in-the-Loop): A critical architectural guardrail for AI systems. It ensures that an autonomous agent can draft, investigate, and propose a high-risk action, but cannot execute it without a human administrator clicking "Approve."

IAM (Identity and Access Management): The overarching framework of policies and technologies ensuring that the right entities (humans, bots, or AI) have the right access to the right resources at the right time, for the right reasons.

IGA (Identity Governance and Administration): The policy engine of IAM. IGA tools manage the lifecycle of an identity, enforce Separation of Duties (SoD), and track compliance and audit trails.

JIT (Just-In-Time Access): A security protocol where administrative privileges are fundamentally revoked by default. Admins must "check out" elevated permissions for a specific task, which automatically expire after a few hours.

JML (Joiner, Mover, Leaver): The three fundamental phases of an employee's lifecycle. Automating JML processes ensures users get access quickly on Day 1 (Joiner), lose unnecessary access when changing roles (Mover), and are instantly locked out upon termination (Leaver).

NHI (Non-Human Identity): Any digital identity that does not belong to a flesh-and-blood person. This includes service accounts, API keys, CI/CD pipelines, background scripts, and AI agents.

OIDC (OpenID Connect): An identity layer built on top of the OAuth 2.0 protocol. It allows clients to verify the identity of an end-user based on the authentication performed by an Authorization Server.

Prompt Injection: A cyberattack unique to Large Language Models. An attacker embeds malicious instructions within user data, tricking the AI into ignoring its original safety guardrails and executing the attacker's commands instead.

RAG (Retrieval-Augmented Generation): An AI architecture where an LLM is connected to an external database (like internal corporate documents). When a user asks a question, the system retrieves relevant data and feeds it to the LLM to generate an accurate, company-specific answer.

RBAC (Role-Based Access Control): A traditional authorization model where access is granted based on the user's job function or title (e.g., "HR Manager"), rather than managing permissions on a file-by-file basis.

SoD (Separation of Duties): A governance principle ensuring that no single individual possesses enough permissions to execute a fraudulent or catastrophic action unilaterally. (e.g., The person who requests a financial payout cannot be the same person who approves it).

Vector Database: A specialized database designed to store unstructured data (like text chunks from corporate documents) as mathematical vectors, enabling rapid contextual searches for RAG pipelines.

ZTNA (Zero Trust Network Access): A modern security architecture that abandons the concept of a "trusted internal network." Instead of a VPN granting broad access, ZTNA forces every user and device to continuously authenticate and only grants micro-tunnels to specific, individual applications.