The words, as we use them
Identity work carries a lot of vocabulary, some of it precise and some of it inherited from an audit template nobody remembers writing. These are the terms Alex works in, defined plainly.
Terms
Each definition leads with a direct answer, then says what it looks like in practice.
A
- Access review
- A periodic check that the people holding access still need it. The failure mode is well known and rarely admitted: a reviewer facing hundreds of entitlements they cannot individually assess approves the lot, and the exercise produces a clean audit record without any access actually changing.
- AI Digital Employee
- A named colleague that owns a bounded domain and drives complete workflows: plan, coordinate, execute, validate, document. The distinction from a copilot is scope of responsibility. A copilot speeds up a task you are already doing; a Digital Employee takes the workflow off your plate and reports back on it.
C
- Compound Learning
- Every completed action making the next one better informed. An access review that resolves an ambiguity records the answer, so the same question does not have to be asked again next quarter. Every action makes the system smarter.
- Continuous Security Execution
- Treating security work as something that runs continuously rather than in quarterly pushes. The point is not speed for its own sake. Work that happens continuously never forms a backlog, so the queue of half-finished identity tasks stops being the normal state of affairs.
- Control membrane
- The layer that decides what a Digital Employee may do alone, what it must ask about first, and what it may never touch. Membrane rather than wall, because it is permeable by design and adjustable as trust builds. Autonomy where you want it, control where you need it.
E
- Entitlement
- A single specific permission inside a system, as opposed to the role that bundles many of them together. Reviews and audits happen at role level because roles are readable; risk lives at entitlement level, which is why the two views disagree so often.
- Execution gap
- The distance between the security work a team knows it should do and the work it actually completes. Security teams are rarely short of findings, policies or tools. They are short of the hours to act on them, and the gap is where risk accumulates quietly while everyone stays busy.
H
- Human-in-the-loop
- A person approving the actions that warrant approval, before they take effect. It is a design decision about which work needs a human judgement and which does not, made deliberately per workflow rather than left to a global setting.
J
- Joiner, mover, leaver
- The three moments in an employment relationship where access should change: someone arrives, someone changes role, someone leaves. Movers are the hardest of the three, because new access is granted promptly and old access is rarely taken away.
K
- Knowledge Fabric
- The shared record of how your environment actually works: the systems, the owners, the exceptions and the reasons behind them. Most of this normally lives in the heads of a few long-serving people, which is why it walks out of the door when they do.
L
- Least privilege
- Holding exactly the access the job needs and nothing beyond it. It is easy to agree with and hard to maintain, because access accrues with every project and is almost never handed back. Least privilege is a practice rather than a setting.
O
- Orphaned account
- An active account with no current owner. It usually belongs to someone who left, a contractor whose engagement ended, or a service nobody claims. It keeps working, which is the problem, and it is invisible to any process that starts from a list of current employees.
S
- Segregation of duties
- Making sure no single person can both initiate and approve the same sensitive action. The rule is easy to state and hard to hold, because conflicts appear gradually through role changes rather than being granted outright on any single day.
T
- Toil
- Manual work that scales with the size of the estate and teaches you nothing new. Chasing approvals, re-running the same quarterly review, reconciling two systems by hand. Toil is worth naming because it is the part of the job most likely to be tolerated rather than fixed.