Identity and access management
IAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
Identity and access management (IAM) covers the management of digital identities and their access rights. It includes deciding who receives an account, which tasks it may perform and when permissions must change or be withdrawn.
More than signing in
In a hypothetical business, someone moves from sales to the warehouse. Their account can remain while old sales permissions are removed and required warehouse permissions are assigned. Simply adding another role would represent the change of duties incompletely.
Signing in verifies identity; the subsequent permission decision concerns a specific action and resource. Central IAM can make this administration easier, but does not guarantee that every connected application enforces all rules correctly.
Sources
Related terms
- Role-based access controlRBAC connects permissions to roles and assigns people to those roles. The data scope must be clear alongside the role name.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- Multi-factor authenticationMFA uses different types of authentication factors. Asking for the same factor type several times does not create a multi-factor check.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.