[Home](https://easyiga.com/) / Glossary # IGA terms, in plain language. Use these working definitions when discussing who needs access and how to check it. For specific easyIGA capabilities, see the [product scope](https://easyiga.com/product). IGA (Identity Governance and Administration)The processes and software used to manage access to an organisation’s systems and record the decisions behind it. This includes requests, provisioning and periodic access reviews.IAM (Identity and Access Management)The broader field of managing identities and their access, including authentication and authorisation.Identity provider (IdP)A system that authenticates users and supplies identity information to applications. Its session and authentication controls are distinct from access-governance decisions.Authentication and authorisationAuthentication checks an identity. Authorisation determines what that identity is allowed to do.ProvisioningCreating or changing an account or permission in a destination system. An approved request still needs a successful execution result.DeprovisioningRemoving or disabling access. Account changes and session revocation can require separate actions, depending on the application.EntitlementA specific permission, group membership or other unit of access in a system.Role (RBAC)In role-based access control, a role groups permissions that can be assigned to an identity according to its responsibilities.AssignmentA record linking an identity to a role or another object. The assignment record and the resulting access in a destination system must be checked separately.Joiner-mover-leaver (JML)Processes for changes in a person’s relationship with an organisation. Joining creates access needs; a job change or departure also requires checking access that should end.Birthright accessAccess automatically assigned to a defined population under policy, such as basic employee access. Its scope still needs review.Least privilegeLimiting access to what is needed for the assigned work. Reviews and time limits can help maintain that boundary.Time-bound accessAccess with a defined start or expiry. Verify that expiry changes the destination-system state as intended.Access requestA request for a defined permission, with the business reason and any required duration. Approval follows the organisation’s configured policy.Approval workflowThe configured steps that route a request to the responsible decision-makers and record the outcome.Access review or certificationA check of whether existing access remains justified. A revoke decision must be followed through to the target-system result.Certification campaignA defined set of access reviews with a scope, reviewers and completion date.Rubber-stampingApproving a request or review without assessing it. Clear permission descriptions and relevant evidence help reviewers make an informed decision.Separation of duties (SoD)Separating incompatible responsibilities, including access combinations that create a conflict. easyIGA shows configured midPoint exclusion-policy results at decision time; rule authoring and simulation in easyIGA are planned.SoD overrideAn exception permitted by the organisation’s conflict policy. It needs an accountable decision and a recorded reason.Toxic combinationA combination of permissions that creates an unacceptable conflict under the organisation’s policy.Orphaned accountAn account whose responsible identity or owner cannot be established. Investigate the reason before disabling it, as a service may depend on it.Non-human identity (NHI)An identity used by software or a device rather than a person, such as a service account. Record its purpose and accountable owner.Service accountAn account used to run an application or automated process. Its credentials and permissions need lifecycle management.Ownership and successionAssigning responsibility for an account and transferring it when the owner changes or leaves.ReconciliationComparing identity and account information between systems to detect differences and apply configured handling rules.Effective accessThe access an identity can actually exercise, including permissions inherited through groups or roles. A direct-assignment list may be incomplete.Audit trailRecorded events that help explain a request, decision or execution. The available history depends on which events were captured; missing records must remain explicit.Attestation evidenceRecords supporting an access-review decision, including the reviewed permission, reviewer, decision and date where captured.midPointThe open source identity governance engine developed by Evolveum that easyIGA runs on. Public midPoint references are distinct from easyIGA customer evidence.Self-hostedSoftware operated on your own infrastructure. This is the default easyIGA deployment; an EU-hosted deployment operated by our team is available on request.SovereigntyControl over where data is held and which operational and legal arrangements apply. Assess the infrastructure, operator and contracts together.Privileged accessPermissions that allow sensitive actions such as administering a system. Review their scope and duration according to the organisation’s risks and applicable requirements.Standing privilegeElevated permissions retained beyond a particular task. Compare that need with a time-bound alternative.Access creepAccumulation of permissions that are no longer required, for example after changes in a person’s responsibilities.Approval channelThe interface where a decision is made, such as a web application or Microsoft Teams. Verify which channels record approver provenance in the release being evaluated.Campaign templateA reusable definition for an access review’s scope and workflow.Simulation modeA way to examine proposed changes without applying them. Check the exact behaviour and supported operations of the system being evaluated; this term does not imply that easyIGA’s planned SoD simulation has shipped.Evidence exportA file containing recorded decisions or events. Check its coverage and missing-data handling against the source records. ## Put the terms into practice The [IGA guide](https://easyiga.com/blog/what-is-iga) explains how these processes fit together. Bring a request or review from your organisation to an [easyIGA walkthrough](https://easyiga.com/demo) to discuss the relevant workflow.