GLOSSARY

The discipline and supporting technology used to establish digital identities and control who or what can access specific resources under defined conditions.

Effective IAM reduces unauthorised access, supports least privilege, enables secure collaboration, and provides evidence for audits and incident response. Weak identity controls are a common path to data exposure and operational compromise.

An organisation connects applications to a central identity provider, requires phishing-resistant MFA for administrators, automatically removes access when employment ends, and reviews privileged roles quarterly.

IAM does not eliminate insider threats, software vulnerabilities, or poor data governance. Centralisation can create a high-impact dependency, while excessive role complexity and stale entitlements can undermine otherwise strong authentication.

IAM covers identity proofing and onboarding, account lifecycle management, authentication, authorisation, federation, privileged access, access review, and audit. Policies evaluate subjects, resources, roles or attributes, authentication strength, device or contextual signals, and the requested action. IAM applies to people, services, workloads, APIs, and increasingly AI agents.