Glossary

Terms as they are used on this site. Access control has an unusually large number of words that sound precise and are not; where a term is genuinely contested, the entry says so rather than picking a side quietly.

Zero trust

The most inconsistently used term in this vocabulary, and the one most worth being careful about. In the architectural literature it means a specific claim: network location grants no authority, and every access decision is made explicitly, per request, against a verified identity. In marketing it means almost anything sold to organisations that have said the phrase — remote access products, segmentation products, endpoint agents and identity suites all carry the label. The name is also misleading on its own terms: nothing has zero trust. The model relocates trust onto the issuer, the policy and the enforcement layer rather than removing it. When someone says a system “is zero trust”, the useful follow-up is which of those three they have actually built.

Attestation

Evidence about the state of a system, produced by a mechanism the system’s own software cannot freely rewrite — typically a measurement chain rooted in hardware. Distinguished from self-report, where the machine simply asserts its own condition. Used loosely to mean both, which is why the strength of a posture signal is often unclear from the word alone.

Attribute-based access control

Authorisation decided by evaluating attributes of the principal, the resource, the action and the context, rather than by looking up a fixed role. More expressive than role-based access control and considerably harder to reason about, since the effective permissions of a principal exist only as the output of evaluating the rules.

Bearer token

A credential that authorises whoever presents it, with no further check that the presenter is the party it was issued to. Simple, scalable, and the reason session theft works: the token is authentic in the attacker’s hands too. Sender-constrained tokens are the countermeasure.

Blast radius

What a single compromise reaches before something stops it. The practical output of segmentation and least privilege, and the thing both are ultimately measured by — not whether compromise occurred, but what it became.

Conditional access

Policy that varies the outcome of an authentication attempt according to context: device state, location, risk signals, the sensitivity of the resource. Sometimes used narrowly for the sign-in decision and sometimes for all runtime authorisation, which makes “we have conditional access” a statement of unclear scope.

Confused deputy

A privileged component induced to use its own authority on behalf of a less privileged caller. The characteristic failure of service-to-service architectures where the callee authorises the calling service rather than the original request.

Continuous verification

Re-evaluating an access decision over the life of a session rather than only at its start. Almost never continuous in the literal sense; in practice it means re-evaluation on a timer or on defined events, with a tolerated staleness window in between. The width of that window is the honest description of the control.

Credential lifetime

How long an issued credential remains acceptable. The main lever on how long a stolen one stays useful, and the main source of load on the issuing system — shortening it improves containment and increases issuance volume and re-authentication frequency.

Device posture

The assessed state of an endpoint at a point in time: managed, patched, encrypted, running expected controls. Usually reported by software on the device being assessed, which makes it a claim rather than an observation, and one that is least reliable in exactly the circumstances it exists for.

East–west traffic

Connections between systems inside an estate, as opposed to traffic crossing its boundary. The overwhelming majority of connections in most environments, and historically the least inspected, because the only access control sat at the boundary they never crossed.

Enrolment

The process by which a device or workload first acquires an identity. The point at which trust is established, and therefore the point worth attacking: every later credential derives its meaning from whatever was verified here.

Entitlement

A specific grant of access to a specific resource. Worth distinguishing from identity: who a principal is has a factual answer, whereas what it may do is a decision someone made. Implementations that merge the two — where a group both describes a person and grants access — make the grants invisible to review.

Federation

An arrangement in which one identity system accepts assertions issued by another. Removes duplicate accounts and moves the trust decision up a level: every federated issuer can mint principals your enforcement points will honour, so the list of configured issuers is a security boundary in its own right.

Just-in-time access

Privileges granted for a bounded window on request, rather than held permanently. Reduces the standing privilege available to a compromised account, at the cost of an approval path that has to work at the speed of the incident it is needed for.

Lateral movement

An attacker’s progression from an initial foothold toward something worth having. Not a technique so much as a consequence of reachability plus inherited trust; in a flat estate it is the network functioning as designed.

Least privilege

The principle that a principal should hold only the access its function requires. Universally endorsed and rarely implemented, because the cost of granting too much is invisible and the cost of granting too little is an outage with a name attached to it.

Microsegmentation

Enforcing access controls between systems inside an estate, at a finer granularity than traditional network zones. “Micro” is not defined by anyone, and in practice the segment ranges from a small group of related services to a single workload. The limiting factor is rarely enforcement capability and almost always whether the dependency graph is known well enough to write the rules.

Mutual TLS

TLS in which the client also presents a certificate, so both ends learn a verified identity for the other. Provides authentication of the caller; provides no authorisation on its own. A mesh with mTLS and no policy is one where every workload can prove who it is to every workload that will still talk to it.

Policy decision point

The component that evaluates policy and returns an allow or deny. Centralising it keeps the logic in one place and makes it a dependency of everything, which turns its availability into a security property.

Policy enforcement point

The component sitting in the request path that applies the decision — a proxy, gateway, sidecar, agent or library. Security-critical code that parses untrusted input; when it can be bypassed, the policy above it is a formality, and the bypass is invisible from the policy side because the decision point was never asked.

Principal

Whatever an access decision is about: a person, a service account, a workload, a device. Useful precisely because it does not assume a human, and most principals in a modern estate are not.

Privilege escalation

Acquiring authority beyond what was granted. Worth separating from lateral movement, though the two usually appear together — one increases what a position is worth, the other increases how many positions there are.

Revocation

Invalidating a credential before its natural expiry. Structurally harder than issuance in any system that validates by signature rather than by asking the issuer, because the whole point of that design is that verifiers do not call home. Every workable answer is a trade between promptness, load and complexity.

Sender-constrained token

A credential bound to the client that requested it — to a key it holds or the channel it was issued over — so that presenting it from elsewhere fails. The structural answer to bearer-token theft, and adoption is limited by needing both ends to support it.

Service account

An identity used by software rather than a person. Frequently long-lived, frequently over-privileged, and outside the joiner–mover–leaver processes that govern human accounts, because there is no leaver event when a workload stops existing.

Session

The period over which an authentication result continues to be honoured. The gap between the model’s ambition and its implementation lives here: verification happens at a moment, sessions persist, and everything that changes in between is invisible until the next evaluation.

Trust boundary

A point where data or requests cross between parties with different authority, and therefore where checking has to happen. In a perimeter architecture there was one and it was drawn on a map; in an identity-centric one there are many and they are defined by policy rather than topology.

Workload identity

A cryptographic identity belonging to a running workload rather than to a person or a machine, derived from verifiable platform context — which image, which namespace, which node — rather than from a secret placed inside it. Commonly expressed as a hierarchical, namespaced identifier so that policy can be written against prefixes instead of enumerations. The distinguishing property is that nothing had to be distributed for the workload to hold it.