# Glossary (/docs/reference/glossary) > Plain-language definitions of the identity and access terms used throughout the Better IAM documentation. Identity and access management has its own vocabulary, and Better IAM uses it precisely. Each term below is defined in one or two sentences with a link to the page that explains it in depth. Throughout the guides, terms shown with a dotted underline open the same definition on hover. ## A [#a] ### Access package [#access-package] A named bundle of roles and group memberships that can be assigned in one step, requested by members, or granted automatically by a rule (birthright access). [Learn more](/docs/features/privileged-access/access-packages) ### Access request [#access-request] A person asking for a role for a limited time, decided by a reviewer who must themselves be allowed to grant it. [Learn more](/docs/authorization/temporary-access) ### Access window [#access-window] A weekly schedule attached to a binding, such as weekdays 09:00 to 17:00, outside which the binding grants nothing. [Learn more](/docs/authorization/temporary-access) ### Action [#action] A named operation that can be allowed or denied, written as `namespace:verb` such as `documents:write`. Built-in administration actions start with `iam:` (for example `iam:identities:create`). [Learn more](/docs/authorization/catalog) ### Activation [#activation] A time-limited use of an eligible binding. It ends by itself, can be ended early, and is audited from request to expiry. [Learn more](/docs/features/privileged-access/elevation) ### Advisory decision [#advisory-decision] A decision used to shape a user interface, such as hiding a button. It is never enforcement: the server must still check with `iam.require` right before the protected operation. [Learn more](/docs/authorization/queries) ### Agent [#agent] An identity of kind `agent` for an automated actor driven by a model. Like a service account it holds API keys and never signs in; unlike one, it always has a sponsor, its `boundary` policy caps everything it does, and it can act for a person through a delegation. [Learn more](/docs/features/ai-agents) ### Agreement [#agreement] A versioned terms-of-use text that members accept. Policies can require acceptance through `principal.agreements`, and a new version asks everyone to accept again. [Learn more](/docs/features/governance/agreements) ### Assertion [#assertion] A short-lived signed token that tells a downstream service who is calling and with which roles, so services can trust the caller without sharing sessions or a database. [Learn more](/docs/reference/api/assertions) ### Audit chain [#audit-chain] The per-tenant audit log in which every event includes the SHA-256 hash of the previous one, so any edited, removed, or reordered event is detected by verification. [Learn more](/docs/concepts/events/audit-chain) ## B [#b] ### Binding [#binding] The record that gives a role to an identity or a group within a tenant. Bindings can expire, start in the future, apply only in an access window, or be eligible (activated just in time). [Learn more](/docs/authorization/roles) ### Birthright access [#birthright-access] Access everyone matching a rule should have automatically, such as "everyone in the engineering department gets the Engineering package". Rules on access packages assign it and remove it again when a person stops matching. [Learn more](/docs/features/privileged-access/automatic-assignment) ### Boundary [#boundary] A policy that limits the maximum access something can have without granting any. Tenants, principals, sessions, and credentials can each carry one, and a request must be allowed by every boundary that applies. [Learn more](/docs/authorization/policies) ## C [#c] ### Ceiling [#ceiling] An upper bound attached to a grant authority, a trust, or a credential. Whatever the role says, access through that path can never exceed the ceiling; like a boundary, it only takes access away. [Learn more](/docs/authorization/roles) ### Certification campaign [#certification-campaign] A periodic review in which reviewers confirm or revoke each person's access, with evidence of use, so access that is no longer needed gets removed. [Learn more](/docs/features/governance/certifications) ### Collection [#collection] The kind of a stored record, such as `identities` or `sessions`. Every record lives in the one `iam_records` table, tagged with its collection, so new features never need new tables. [Learn more](/docs/databases/schema#collections) ### Condition [#condition] An extra test inside a statement that compares a context value with expected values using an operator such as `StringEquals`, `IpAddress`, or `DateBefore`. A missing value never satisfies a condition. [Learn more](/docs/authorization/conditions) ### Consent [#consent] A person's approval for an OAuth client application to act on their behalf with certain scopes. Consents are remembered, listed as connected apps, and can be revoked. [Learn more](/docs/federation/oauth-provider) ### Credential [#credential] What a caller presents to prove who it is: a session cookie, an `Authorization: Bearer` token, an API key, or an assumed-role session. Server calls pass it as the first argument, `{ headers }` or `{ token }`. [Learn more](/docs/reference/api) ### Custom hostname [#custom-hostname] A hostname an organization controls, such as login.acme.com, verified with a DNS TXT record so it works as the organization's sign-in address. A verified hostname belongs to exactly one organization. [Learn more](/docs/operations/deployment/hosts-and-regions#custom-hostnames) ## D [#d] ### Delegated session [#delegated-session] A short session (a `biam_dlg_...` token) an agent opens with its API key under a delegation. Its identity is the person, capped by the delegation's scope, the agent's boundary, and the key's limits; every use re-checks the whole chain. [Learn more](/docs/features/ai-agents#open-a-delegated-session) ### Delegation [#delegation] A person's permission for one agent to act for them, within a scope (an action list or a policy) and until it expires or is revoked. The agent uses it to open delegated sessions; it never gives the agent more than the person has. [Learn more](/docs/features/ai-agents#letting-an-agent-act-for-a-person) ### Delivery outbox [#delivery-outbox] An encrypted, transactional queue of emails and SMS messages (invitations, codes, alerts). Messages are written in the same transaction as the change that caused them and delivered by a worker, so a rolled-back change never sends mail. [Learn more](/docs/operations/jobs) ### Deployment operation [#deployment-operation] A task that runs from your deploy scripts, a worker, or cron rather than from a web request, such as migrations, secret rotation, and the scheduled jobs. None of them are reachable over HTTP. [Learn more](/docs/operations/jobs) ### Doctor [#doctor] The `better-iam doctor` command and `iam.selfCheck()`: a report of configuration and storage problems such as a schema that is behind, a weak secret, a missing email transport, or jobs that are not running. [Learn more](/docs/databases/operations) ### DPoP [#dpop] Demonstrating Proof of Possession (RFC 9449): the client signs each request with a private key, and the access token is bound to that key, so a leaked token is useless without it. [Learn more](/docs/federation/oauth-resource-servers) ## E [#e] ### Eligible binding [#eligible-binding] A role binding that grants nothing until the person activates it for a bounded time, optionally with a justification, MFA, or an approver's decision. It replaces standing administrator access with just-in-time elevation. [Learn more](/docs/features/privileged-access/elevation) ### Explicit deny [#explicit-deny] A matching `deny` statement. It overrides every allow, which makes deny statements the tool for exceptions such as "never delete without MFA". [Learn more](/docs/authorization/policies) ## G [#g] ### Grant [#grant] An allow that comes from a role or policy bound to the principal. Grants form a union: one matching allow is enough, unless a deny or a boundary blocks it. [Learn more](/docs/authorization) ### Grant authority [#grant-authority] Who may hand out a role. A binding records the authority it was created under, and only someone holding that authority (or a higher one) may change or revoke it, which stops people from granting access they could not grant directly. [Learn more](/docs/authorization/roles) ### Group [#group] A set of identities that receives every role bound to it. Changing group membership is the usual way to grant or revoke access for teams. [Learn more](/docs/reference/api/groups) ## H [#h] ### Home region [#home-region] In a multi-region deployment, the region whose deployment serves an organization's sign-in: its own region, or its nearest ancestor's. Other regions answer WRONG\_REGION with its sign-in URL there. [Learn more](/docs/operations/deployment/hosts-and-regions#regions) ## I [#i] ### Identity [#identity] A person or service account inside one tenant. The same human who belongs to two organizations has two identities, which can be linked so they can switch between them. [Learn more](/docs/concepts/tenants-and-identities) ### Impact preview [#impact-preview] A dry run of a change to a role, policy, or binding that shows who would gain or lose access, and which invariants would break, before you apply it. [Learn more](/docs/features/governance/change-safety) ### Impersonation [#impersonation] An administrator viewing the product as a member ("view as") for support. It is audited, visible to policies, and never allows more than the administrator could do themselves. [Learn more](/docs/authentication/impersonation) ### Invariant [#invariant] A guardrail that must stay true whatever roles and policies say, such as "contractors can never delete the payroll workspace". Invariants are checked on demand, in CI, and on a schedule. [Learn more](/docs/features/governance/change-safety) ## M [#m] ### Meter [#meter] Something billed by usage, such as API calls, seat-days, or AI inference. The root tenant defines platform meters billed to every organization; an organization or project can define chargeback meters for its own subtree. [Learn more](/docs/features/billing#meters-and-prices) ## O [#o] ### OpenID Connect [#openid-connect] The identity layer on top of OAuth 2.0 that lets people sign in with an external identity provider, and that Better IAM can also provide to your own applications. [Learn more](/docs/federation/oauth-sign-in) ### Owner [#owner] An identity marked as an owner of its tenant, usually the person who accepted the organization's first invitation. Owners hold the protected Owner role, and policies can test `principal.owner`. [Learn more](/docs/concepts/tenants-and-identities) ## P [#p] ### Passkey [#passkey] A WebAuthn credential stored on a device or password manager that signs people in without a password and cannot be phished. It can also serve as the second factor. [Learn more](/docs/authentication/passkeys) ### Permission catalog [#permission-catalog] The list of every action that exists: built-in `iam:*` actions, the actions of your declared resource types, and tenant-defined actions. Roles and policies can only refer to actions in the catalog. [Learn more](/docs/authorization/catalog) ### Plugin [#plugin] An extension that adds resource types, context values, operation hooks, or endpoints to the same authorized, audited pipeline as built-in operations. [Learn more](/docs/concepts/extensions) ### Policy [#policy] A versioned JSON document of statements that allow or deny actions on resources, optionally under conditions. Roles can be built from policies, and boundaries are policies too. [Learn more](/docs/authorization/policies) ### Policy variable [#policy-variable] A placeholder like `${principal.id}` inside a resource pattern or condition value, replaced with the caller's actual value before matching. Substituted values always match literally, so they cannot widen a pattern. [Learn more](/docs/authorization/policies) ### Principal [#principal] Whoever is making a request after the credential has been checked: the identity plus the session it is using. Policies read facts about it as `principal.*` context keys, such as `principal.id` or `principal.mfa`. [Learn more](/docs/authorization) ## R [#r] ### Rate card [#rate-card] The prices of the meters: per unit, graduated or volume tiers, packages, a free allowance, and negotiated prices for individual organizations. A plan's usage items replace it for the plan's subscribers. [Learn more](/docs/features/billing#meters-and-prices) ### Recent authentication [#recent-authentication] Proof that the person signed in or re-authenticated a few minutes ago. Sensitive operations such as changing an email or creating a webhook require it, so a stolen long-lived session cannot perform them. [Learn more](/docs/authentication/sessions) ### Reconciliation [#reconciliation] The scheduled job that re-applies access-package rules: it gives packages to people who now match a rule and removes automatic assignments from people who no longer do. [Learn more](/docs/features/privileged-access/automatic-assignment) ### Relationship [#relationship] A tuple that says a person or group has a named relation, such as `editor`, to one resource. Policies read them as `resource.relations`, which is how per-document sharing works (relationship-based access control, ReBAC). [Learn more](/docs/authorization/relationships) ### Resource [#resource] The thing an action is performed on, identified as `type/id` (for example `document/doc_42`). Resources are either resolved by your application at decision time or registered with IAM as managed resources with owners and parents. [Learn more](/docs/concepts/resources-and-catalog) ### Resource server [#resource-server] An API that accepts access tokens issued by Better IAM's OAuth provider and checks them itself, for example with `createAccessTokenVerifier`. [Learn more](/docs/federation/oauth-resource-servers) ### Resource type [#resource-type] A declared kind of resource with its actions, typed attributes, and relations. Types come from your configuration or are defined by a tenant at runtime. [Learn more](/docs/authorization/catalog) ### Retention sweep [#retention-sweep] The scheduled `sweep` job that deletes expired sessions, devices, protocol artifacts, and old delivery records in short batches so the database does not grow without bound. [Learn more](/docs/operations/jobs) ### Reverse query [#reverse-query] Asking which resources a person may act on, instead of whether they may act on one. `listAccessible` powers list pages; `authorizeMany` answers up to 50 checks at once for a UI. [Learn more](/docs/authorization/queries) ### Role [#role] A named bundle of permissions (or of policy documents) that can be given to people, such as "Editor". A role grants nothing until it is bound to someone. Roles can inherit other roles. [Learn more](/docs/authorization/roles) ### Role assumption [#role-assumption] A platform-controlled way to act in another tenant with a specific role through a trust, producing a session that carries only that role's grants. [Learn more](/docs/reference/api/trust) ### Root tenant [#root-tenant] The tenant at the top of the tree, created once by `bootstrap`. Its administrators operate the platform itself: they create organizations, set plan limits, and recover access. The root administrator must enroll MFA before doing anything else. [Learn more](/docs/concepts/tenants-and-identities) ## S [#s] ### SAML [#saml] An XML-based single sign-on standard common in enterprises. Better IAM acts as the service provider, so organizations can sign in through their own identity provider. [Learn more](/docs/federation/saml) ### SCIM [#scim] System for Cross-domain Identity Management (RFC 7643/7644): the standard API identity providers such as Okta and Entra ID use to create, update, and deactivate users and groups in your application automatically. [Learn more](/docs/federation/scim) ### Separation of duties [#separation-of-duties] A rule that one person must not hold two conflicting kinds of access, such as creating and approving payments. Grants that would break a rule fail with `SOD_CONFLICT`. [Learn more](/docs/authorization/separation-of-duties) ### Service account [#service-account] An identity for a machine rather than a person (`kind: 'service'`). It authenticates with API keys, never signs in interactively, and can be scheduled to deactivate. [Learn more](/docs/reference/api/service-accounts) ### Session [#session] A signed-in period stored in your database. It records how the person authenticated (password, passkey, MFA), when, and from which device, and it can be revoked at any time, which takes effect on the next request. [Learn more](/docs/authentication/sessions) ### Session JWT [#session-jwt] A temporary credential issued as a signed JWT instead of an opaque token (`format: 'jwt'` on `sts.getSessionToken`, `roles.assume`, or `sts.assumeRoleWithWebIdentity`), so other services can verify it offline against the published JWKS. Needs `sts.jwt`; user sessions and API keys are never JWTs. [Learn more](/docs/authentication/tokens#session-jwts) ### Shared Signals [#shared-signals] The OpenID Shared Signals Framework: signed security events, such as a session being revoked (CAEP) or an account being disabled (RISC), pushed to other applications so they can react immediately. [Learn more](/docs/federation/shared-signals) ### Sign-in address [#sign-in-address] An organization's own address for signing in, like an AWS account's sign-in URL: a subdomain built from its alias (acme.signin.example.com) or a custom hostname it verified. Requests on it are pinned to that organization. [Learn more](/docs/operations/deployment/hosts-and-regions) ### Sponsor [#sponsor] The person accountable for an agent or a guest (`sponsorId`): an active, unexpired member of the same organization. An agent's credentials work only while its sponsor is active, so no agent outlives the person answerable for it. [Learn more](/docs/reference/api/agents#sponsors-and-standing) ### Standing privilege [#standing-privilege] Powerful access that is always on, such as a permanent administrator role. It is convenient but risky, because a stolen account has that power all the time; eligible bindings replace it with elevation on demand. [Learn more](/docs/features/privileged-access) ### Statement [#statement] One rule inside a policy: an effect (`allow` or `deny`), the actions and resource patterns it covers, and optional conditions. A statement matches when all three match the request. [Learn more](/docs/authorization/policies) ### Step-up authentication [#step-up-authentication] Asking a signed-in person to authenticate again, or with MFA, right before a sensitive operation such as changing their email or deleting an account. [Learn more](/docs/authentication/mfa) ### Storage adapter [#storage-adapter] The module that stores Better IAM's records in a database: PostgreSQL, SQLite, and libSQL are included, and the adapter contract lets you add others. [Learn more](/docs/databases/operations) ### Synthetic session [#synthetic-session] The simulated session that access reviews such as `whoCan` and `simulate` evaluate an identity in, without anyone signing in. It has no client address and uses MFA only when you ask for it. [Learn more](/docs/authorization/reviews) ## T [#t] ### Tenant [#tenant] An account that people sign in to: your platform's root, an organization, or a project inside one. Tenants form a tree; each has its own identity directory, roles, policies, and audit chain, and nothing crosses tenant boundaries unless a trust or a linked account says so. [Learn more](/docs/concepts/tenants-and-identities) ### Tenant access policy [#tenant-access-policy] Minimum rules for just-in-time elevation in one tenant, such as a maximum activation length or always requiring MFA, that individual bindings cannot weaken. [Learn more](/docs/features/privileged-access/elevation) ### Token exchange [#token-exchange] The OAuth grant (RFC 8693) by which an API trades the access token it received for a new token to call another API as the same person. The new token's `act` claim names the exchanging client, so the downstream API sees both. [Learn more](/docs/federation/token-exchange) ### Trust [#trust] A root-created permission for identities of one tenant to assume a role in another tenant. The trust carries a ceiling that limits what the assumed role can do. [Learn more](/docs/reference/api/trust) ### Trusted device [#trusted-device] A browser or device remembered after a successful second factor ("remember this device"), so later sign-ins there skip MFA until the tenant's trusted-device window ends or the device is revoked. [Learn more](/docs/authentication/mfa) ## W [#w] ### Webhook [#webhook] A signed HTTP callback that a tenant subscribes to receive audit events, with filters, retries, and redelivery. [Learn more](/docs/concepts/events/webhooks)