IGA (Identity Governance and Administration): The processes and software used to manage access to an organisation’s systems and record the decisions behind it. This includes requests, provisioning and periodic access reviews.
IAM (Identity and Access Management): The broader field of managing identities and their access, including authentication and authorisation.
Identity provider (IdP): A system that authenticates users and supplies identity information to applications. Its session and authentication controls are distinct from access-governance decisions.
Authentication and authorisation: Authentication checks an identity. Authorisation determines what that identity is allowed to do.
Provisioning: Creating or changing an account or permission in a destination system. An approved request still needs a successful execution result.
Deprovisioning: Removing or disabling access. Account changes and session revocation can require separate actions, depending on the application.
Entitlement: A specific permission, group membership or other unit of access in a system.
Role (RBAC): In role-based access control, a role groups permissions that can be assigned to an identity according to its responsibilities.
Assignment: A record linking an identity to a role or another object. The assignment record and the resulting access in a destination system must be checked separately.
Joiner-mover-leaver (JML): Processes for changes in a person’s relationship with an organisation. Joining creates access needs; a job change or departure also requires checking access that should end.
Birthright access: Access automatically assigned to a defined population under policy, such as basic employee access. Its scope still needs review.
Least privilege: Limiting access to what is needed for the assigned work. Reviews and time limits can help maintain that boundary.
Time-bound access: Access with a defined start or expiry. Verify that expiry changes the destination-system state as intended.
Access request: A request for a defined permission, with the business reason and any required duration. Approval follows the organisation’s configured policy.
Approval workflow: The configured steps that route a request to the responsible decision-makers and record the outcome.
Access review or certification: A check of whether existing access remains justified. A revoke decision must be followed through to the target-system result.
Certification campaign: A defined set of access reviews with a scope, reviewers and completion date.
Rubber-stamping: Approving a request or review without assessing it. Clear permission descriptions and relevant evidence help reviewers make an informed decision.
Separation of duties (SoD): Separating incompatible responsibilities, including access combinations that create a conflict. easyIGA shows configured midPoint exclusion-policy results at decision time; rule authoring and simulation in easyIGA are planned.
SoD override: An exception permitted by the organisation’s conflict policy. It needs an accountable decision and a recorded reason.
Toxic combination: A combination of permissions that creates an unacceptable conflict under the organisation’s policy.
Orphaned account: An account whose responsible identity or owner cannot be established. Investigate the reason before disabling it, as a service may depend on it.
Non-human identity (NHI): An identity used by software or a device rather than a person, such as a service account. Record its purpose and accountable owner.
Service account: An account used to run an application or automated process. Its credentials and permissions need lifecycle management.
Ownership and succession: Assigning responsibility for an account and transferring it when the owner changes or leaves.
Reconciliation: Comparing identity and account information between systems to detect differences and apply configured handling rules.
Effective access: The access an identity can actually exercise, including permissions inherited through groups or roles. A direct-assignment list may be incomplete.
Audit trail: Recorded events that help explain a request, decision or execution. The available history depends on which events were captured; missing records must remain explicit.
Attestation evidence: Records supporting an access-review decision, including the reviewed permission, reviewer, decision and date where captured.
midPoint: The open source identity governance engine developed by Evolveum that easyIGA runs on. Public midPoint references are distinct from easyIGA customer evidence.
Self-hosted: Software operated on your own infrastructure. This is the default easyIGA deployment; an EU-hosted deployment operated by our team is available on request.
Sovereignty: Control over where data is held and which operational and legal arrangements apply. Assess the infrastructure, operator and contracts together.
Privileged access: Permissions that allow sensitive actions such as administering a system. Review their scope and duration according to the organisation’s risks and applicable requirements.
Standing privilege: Elevated permissions retained beyond a particular task. Compare that need with a time-bound alternative.
Access creep: Accumulation of permissions that are no longer required, for example after changes in a person’s responsibilities.
Approval channel: The interface where a decision is made, such as a web application or Microsoft Teams. Verify which channels record approver provenance in the release being evaluated.
Campaign template: A reusable definition for an access review’s scope and workflow.
Simulation mode: A way to examine proposed changes without applying them. Check the exact behaviour and supported operations of the system being evaluated; this term does not imply that easyIGA’s planned SoD simulation has shipped.
Evidence export: A file containing recorded decisions or events. Check its coverage and missing-data handling against the source records.

IGA terms, in plain language.

Put the terms into practice