Glossary
Plain-language definitions of the identity and access terms used throughout the Better IAM documentation.
Identity and access management has its own vocabulary, and Better IAM uses it precisely. Each term below is defined in one or two sentences with a link to the page that explains it in depth. Throughout the guides, terms shown with a dotted underline open the same definition on hover.
A
Access package
A named bundle of roles and group memberships that can be assigned in one step, requested by members, or granted automatically by a rule (birthright access).
Access request
A person asking for a role for a limited time, decided by a reviewer who must themselves be allowed to grant it.
Access window
A weekly schedule attached to a binding, such as weekdays 09:00 to 17:00, outside which the binding grants nothing.
Action
A named operation that can be allowed or denied, written as namespace:verb such as documents:write. Built-in administration actions start with iam: (for example iam:identities:create).
Activation
A time-limited use of an eligible binding. It ends by itself, can be ended early, and is audited from request to expiry.
Advisory decision
A decision used to shape a user interface, such as hiding a button. It is never enforcement: the server must still check with iam.require right before the protected operation.
Agreement
A versioned terms-of-use text that members accept. Policies can require acceptance through principal.agreements, and a new version asks everyone to accept again.
Assertion
A short-lived signed token that tells a downstream service who is calling and with which roles, so services can trust the caller without sharing sessions or a database.
Audit chain
The per-tenant audit log in which every event includes the SHA-256 hash of the previous one, so any edited, removed, or reordered event is detected by verification.
B
Binding
The record that gives a role to an identity or a group within a tenant. Bindings can expire, start in the future, apply only in an access window, or be eligible (activated just in time).
Birthright access
Access everyone matching a rule should have automatically, such as "everyone in the engineering department gets the Engineering package". Rules on access packages assign it and remove it again when a person stops matching.
Boundary
A policy that limits the maximum access something can have without granting any. Tenants, principals, sessions, and credentials can each carry one, and a request must be allowed by every boundary that applies.
C
Ceiling
An upper bound attached to a grant authority, a trust, or a credential. Whatever the role says, access through that path can never exceed the ceiling; like a boundary, it only takes access away.
Certification campaign
A periodic review in which reviewers confirm or revoke each person's access, with evidence of use, so access that is no longer needed gets removed.
Condition
An extra test inside a statement that compares a context value with expected values using an operator such as StringEquals, IpAddress, or DateBefore. A missing value never satisfies a condition.
Consent
A person's approval for an OAuth client application to act on their behalf with certain scopes. Consents are remembered, listed as connected apps, and can be revoked.
Credential
What a caller presents to prove who it is: a session cookie, an Authorization: Bearer token, an API key, or an assumed-role session. Server calls pass it as the first argument, { headers } or { token }.
Custom hostname
A hostname an organization controls, such as login.acme.com, verified with a DNS TXT record so it works as the organization's sign-in address. A verified hostname belongs to exactly one organization.
D
Delivery outbox
An encrypted, transactional queue of emails and SMS messages (invitations, codes, alerts). Messages are written in the same transaction as the change that caused them and delivered by a worker, so a rolled-back change never sends mail.
Deployment operation
A task that runs from your deploy scripts, a worker, or cron rather than from a web request, such as migrations, secret rotation, and the scheduled jobs. None of them are reachable over HTTP.
Doctor
The better-iam doctor command and iam.selfCheck(): a report of configuration and storage problems such as a schema that is behind, a weak secret, a missing email transport, or jobs that are not running.
DPoP
Demonstrating Proof of Possession (RFC 9449): the client signs each request with a private key, and the access token is bound to that key, so a leaked token is useless without it.
E
Eligible binding
A role binding that grants nothing until the person activates it for a bounded time, optionally with a justification, MFA, or an approver's decision. It replaces standing administrator access with just-in-time elevation.
Explicit deny
A matching deny statement. It overrides every allow, which makes deny statements the tool for exceptions such as "never delete without MFA".
G
Grant
An allow that comes from a role or policy bound to the principal. Grants form a union: one matching allow is enough, unless a deny or a boundary blocks it.
Grant authority
Who may hand out a role. A binding records the authority it was created under, and only someone holding that authority (or a higher one) may change or revoke it, which stops people from granting access they could not grant directly.
Group
A set of identities that receives every role bound to it. Changing group membership is the usual way to grant or revoke access for teams.
H
Home region
In a multi-region deployment, the region whose deployment serves an organization's sign-in: its own region, or its nearest ancestor's. Other regions answer WRONG_REGION with its sign-in URL there.
I
Identity
A person or service account inside one tenant. The same human who belongs to two organizations has two identities, which can be linked so they can switch between them.
Impact preview
A dry run of a change to a role, policy, or binding that shows who would gain or lose access, and which invariants would break, before you apply it.
Impersonation
An administrator viewing the product as a member ("view as") for support. It is audited, visible to policies, and never allows more than the administrator could do themselves.
Invariant
A guardrail that must stay true whatever roles and policies say, such as "contractors can never delete the payroll workspace". Invariants are checked on demand, in CI, and on a schedule.
O
OpenID Connect
The identity layer on top of OAuth 2.0 that lets people sign in with an external identity provider, and that Better IAM can also provide to your own applications.
Owner
An identity marked as an owner of its tenant, usually the person who accepted the organization's first invitation. Owners hold the protected Owner role, and policies can test principal.owner.
P
Passkey
A WebAuthn credential stored on a device or password manager that signs people in without a password and cannot be phished. It can also serve as the second factor.
Permission catalog
The list of every action that exists: built-in iam:* actions, the actions of your declared resource types, and tenant-defined actions. Roles and policies can only refer to actions in the catalog.
Plugin
An extension that adds resource types, context values, operation hooks, or endpoints to the same authorized, audited pipeline as built-in operations.
Policy
A versioned JSON document of statements that allow or deny actions on resources, optionally under conditions. Roles can be built from policies, and boundaries are policies too.
Policy variable
A placeholder like ${principal.id} inside a resource pattern or condition value, replaced with the caller's actual value before matching. Substituted values always match literally, so they cannot widen a pattern.
Principal
Whoever is making a request after the credential has been checked: the identity plus the session it is using. Policies read facts about it as principal.* context keys, such as principal.id or principal.mfa.
R
Recent authentication
Proof that the person signed in or re-authenticated a few minutes ago. Sensitive operations such as changing an email or creating a webhook require it, so a stolen long-lived session cannot perform them.
Reconciliation
The scheduled job that re-applies access-package rules: it gives packages to people who now match a rule and removes automatic assignments from people who no longer do.
Relationship
A tuple that says a person or group has a named relation, such as editor, to one resource. Policies read them as resource.relations, which is how per-document sharing works (relationship-based access control, ReBAC).
Resource
The thing an action is performed on, identified as type/id (for example document/doc_42). Resources are either resolved by your application at decision time or registered with IAM as managed resources with owners and parents.
Resource server
An API that accepts access tokens issued by Better IAM's OAuth provider and checks them itself, for example with createAccessTokenVerifier.
Resource type
A declared kind of resource with its actions, typed attributes, and relations. Types come from your configuration or are defined by a tenant at runtime.
Retention sweep
The scheduled sweep job that deletes expired sessions, devices, protocol artifacts, and old delivery records in short batches so the database does not grow without bound.
Reverse query
Asking which resources a person may act on, instead of whether they may act on one. listAccessible powers list pages; authorizeMany answers up to 50 checks at once for a UI.
Role
A named bundle of permissions (or of policy documents) that can be given to people, such as "Editor". A role grants nothing until it is bound to someone. Roles can inherit other roles.
Role assumption
A platform-controlled way to act in another tenant with a specific role through a trust, producing a session that carries only that role's grants.
Root tenant
The tenant at the top of the tree, created once by bootstrap. Its administrators operate the platform itself: they create organizations, set plan limits, and recover access. The root administrator must enroll MFA before doing anything else.
S
SAML
An XML-based single sign-on standard common in enterprises. Better IAM acts as the service provider, so organizations can sign in through their own identity provider.
SCIM
System for Cross-domain Identity Management (RFC 7643/7644): the standard API identity providers such as Okta and Entra ID use to create, update, and deactivate users and groups in your application automatically.
Separation of duties
A rule that one person must not hold two conflicting kinds of access, such as creating and approving payments. Grants that would break a rule fail with SOD_CONFLICT.
Service account
An identity for a machine rather than a person (kind: 'service'). It authenticates with API keys, never signs in interactively, and can be scheduled to deactivate.
Session
A signed-in period stored in your database. It records how the person authenticated (password, passkey, MFA), when, and from which device, and it can be revoked at any time, which takes effect on the next request.
Shared Signals
The OpenID Shared Signals Framework: signed security events, such as a session being revoked (CAEP) or an account being disabled (RISC), pushed to other applications so they can react immediately.
Sign-in address
An organization's own address for signing in, like an AWS account's sign-in URL: a subdomain built from its alias (acme.signin.example.com) or a custom hostname it verified. Requests on it are pinned to that organization.
Standing privilege
Powerful access that is always on, such as a permanent administrator role. It is convenient but risky, because a stolen account has that power all the time; eligible bindings replace it with elevation on demand.
Statement
One rule inside a policy: an effect (allow or deny), the actions and resource patterns it covers, and optional conditions. A statement matches when all three match the request.
Step-up authentication
Asking a signed-in person to authenticate again, or with MFA, right before a sensitive operation such as changing their email or deleting an account.
Storage adapter
The module that stores Better IAM's records in a database: PostgreSQL, SQLite, and libSQL are included, and the adapter contract lets you add others.
Synthetic session
The simulated session that access reviews such as whoCan and simulate evaluate an identity in, without anyone signing in. It has no client address and uses MFA only when you ask for it.
T
Tenant
An account that people sign in to: your platform's root, an organization, or a project inside one. Tenants form a tree; each has its own identity directory, roles, policies, and audit chain, and nothing crosses tenant boundaries unless a trust or a linked account says so.
Tenant access policy
Minimum rules for just-in-time elevation in one tenant, such as a maximum activation length or always requiring MFA, that individual bindings cannot weaken.
Trust
A root-created permission for identities of one tenant to assume a role in another tenant. The trust carries a ceiling that limits what the assumed role can do.
Trusted device
A browser or device remembered after a successful second factor ("remember this device"), so later sign-ins there skip MFA until the tenant's trusted-device window ends or the device is revoked.
W
Webhook
A signed HTTP callback that a tenant subscribes to receive audit events, with filters, retries, and redelivery.
Was this page helpful?
Last updated on