Identity & Access Management Language

Role-Based Access Control (RBAC) is a model where permissions are assigned to roles rather than directly to individual users, and users are then granted those roles. Engineers describe it as "assigning a role to a principal", "granting least-privilege access", and "enforcing role boundaries" to prevent privilege escalation.

OAuth 2.0 is an authorisation framework that allows a client to obtain scoped access to a resource on behalf of a user. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication: it issues an ID token (a JWT) that asserts who the user is, not just what they are permitted to do.

SAML (Security Assertion Markup Language) is an XML-based standard used to exchange authentication and authorisation data between an identity provider (IdP) and a service provider (SP). Teams describe SSO implementations with phrases like "configuring the IdP metadata", "setting up SP-initiated login", and "mapping SAML attributes to application roles".

The principle of least privilege states that every user, process, or service should be granted only the minimum permissions needed to perform its function. In practice, this means "scoping IAM policies to specific resources", "avoiding wildcard permissions", and "performing periodic access reviews to revoke unused entitlements".

JWTs (JSON Web Tokens) are discussed in terms of their three parts — header, payload, and signature. Common phrases include "the token is signed with RS256", "the claim contains the subject (sub) and expiry (exp)", "the token is validated against the JWKS endpoint", and "short-lived tokens reduce the blast radius of a compromise".

Identity federation allows users from one organisation (the identity provider) to authenticate to services in another organisation (the relying party) without separate credentials. Engineers say "we've federated our Azure AD with the vendor's Okta tenant" or "the trust relationship is established via SAML metadata exchange".

Zero trust is a security model that assumes no implicit trust based on network location — every request must be authenticated, authorised, and continuously verified. It introduces vocabulary such as "verify explicitly", "micro-segmentation", "device posture checks", "continuous authentication", and "never trust, always verify".

Multi-Factor Authentication (MFA) requires users to present two or more verification factors — typically something they know, have, or are. Passwordless authentication eliminates the password factor entirely, replacing it with "FIDO2 passkeys", "biometric attestation", or "magic links", with teams noting improved UX alongside reduced phishing risk.

A service account is a non-human identity used by applications, scripts, or microservices to authenticate to other services. Security best practices discussed by engineers include "rotating service account credentials", "binding workload identity to a Kubernetes service account", and "avoiding long-lived static API keys in favour of short-lived tokens".

Modern applications integrate with identity providers, enforce fine-grained access controls, and must meet compliance requirements such as SOC 2 and ISO 27001. Developers who understand IAM vocabulary can read security specifications accurately, participate in architecture reviews, and communicate access control decisions clearly to security and compliance teams.