Library · Glossary

Glossary

Short definitions. Each links to the longer essay where the concept is discussed in full.

← Back to the library

Access Control List (ACL): A list, attached to a resource, naming which identities may access it and how — the more common counterpart to capability-based access.
Access Review: A periodic, deliberate check of who currently holds which permissions, specifically to catch grants that have outlived the reason they were given.
Account Enumeration: Inferring which accounts exist by observing differences in how a system responds to valid versus invalid identifiers — information a well-designed response shouldn't leak.
Account Recovery: The process of regaining access to an account after losing its normal credential — often the weakest link in an otherwise strong authentication design, precisely because it exists to bypass it.
Account Takeover: An attacker gaining control of a legitimate user's account, typically through stolen or guessed credentials rather than a system vulnerability.
Admission Control: The check that decides whether a principal may be considered for a request at all, before any specific action is evaluated.
Air-Gapped Environment: A system deliberately kept off any external network, where a policy update can't simply be pushed — it has to be transported by some other means entirely.
Anonymous Access: Permitting a specific, limited action without requiring any established identity at all — deliberately scoped, rather than an oversight that happens to allow it.
API Gateway: A single edge chokepoint that all external API traffic passes through, where authentication and coarse-grained policy can be enforced once for every route behind it.
API Key: A simple, typically long-lived bearer secret used to authenticate API requests — easy to issue, but weaker than modern token-based schemes in most respects that matter.
Approval Chain: A sequence of required sign-offs, each an independent check, that a request must pass through before it proceeds — distinct from a single approval or a simultaneous dual check.
Assurance Level: A tiered rating of how much confidence a given authentication method actually provides — not every proof of identity is equally strong.
At-Least-Once Delivery: A messaging guarantee that a message will be delivered one or more times, never zero — which is exactly why the receiver has to be able to handle a duplicate safely.
Attacker Cost: The time, resources, and risk of detection an adversary must spend to succeed — a framing that treats security as raising that cost rather than promising an attack is impossible.
Attribute Freshness: How current an attribute used in a policy decision actually is at the moment it's evaluated — a live lookup and a stale cached value can both technically satisfy the same policy check.
Attribute-Based Access Control (ABAC): Granting permissions based on a policy evaluated against attributes of the request — who, what, when, and under what condition — rather than a fixed role.
Authorization Cache: A stored copy of a recent decision, reused to avoid re-evaluating policy for every request — at the cost of a window where a revoked permission may still appear valid.
Background Location Access: A location permission that continues while an app isn't actively in use — a meaningfully broader grant than access limited to moments the app is actually open.
Badge Credential: A physical or virtual token proving someone may pass a specific building access point, checked without any live network dependency in most installations.
Behavioral Biometrics: Verifying identity from patterns in how someone interacts — typing rhythm, mouse movement, touch pressure — rather than from a discrete credential presented once and then set aside.
Biometric Template: A stored mathematical representation of a biometric characteristic, derived from the raw scan but not reversible back into it — distinct from the raw fingerprint or face image itself.
Blameless Postmortem: An incident review focused on what allowed a failure to happen, rather than on which person to hold responsible for it.
Blast Radius: How much damage a single compromised credential, identity, or component can cause before it is contained.
Blocklist: A list of specific identifiers explicitly denied, checked before or alongside ordinary policy — a targeted exception layered on top of a system's general access rules.
Bootstrap Trust: The initial, unavoidable act of trusting something before any authorization system exists yet to check it — every system has exactly one moment like this.
Bot Detection: Classifying whether a request originated from a human, an automated script, or an autonomous agent — a judgment authorization increasingly has to make explicitly.
Break-Glass Account: A credential set aside strictly for emergencies, meant to remain unused until every ordinary path to access is unavailable.
Bug Bounty Scope: The explicit boundary defining exactly what a security researcher is authorized to test — the difference between a legitimate, invited probe and an actual attack.
Bulk Export: Retrieving a large volume of data in one action — categorically riskier than an equivalent number of individual reads, because it concentrates exposure into a single event.
Canary Deployment: Rolling a change out to a small subset first, so a problem shows up on a limited scale before it reaches everyone — applicable to policy changes as much as to code.
Canonical Request: The exact, normalized representation of a request that actually gets signed — so the signer and the verifier agree precisely on what was signed, with no ambiguity between them.
Canonicalization: Normalizing an input to one standard form before evaluating it against policy — without it, different components can interpret the same input differently and disagree on what it means.
Capability: An unforgeable token that both names a specific resource and grants the right to use it, as opposed to a permission checked against an identity's separately stored access list.
Captive Portal: A web page a network redirects a newly connected device to before granting it real network access — the gate a guest network uses to check something before letting traffic through freely.
Certificate Revocation List: A published list of certificates that have been revoked before their stated expiry — a verifier is supposed to check it before trusting a certificate that would otherwise still look valid.
Chaos Engineering: Deliberately injecting infrastructure failures into a running system to verify it actually degrades the way it's designed to, rather than assuming the design holds without ever testing it under real failure.
Circuit Breaker: A pattern that stops calling a failing dependency after repeated failures, giving it room to recover instead of piling on more requests it can't handle.
Clock Skew: The difference between two systems' clocks — small and usually harmless, but capable of causing a valid token to be rejected or an expired one to still be accepted.
Code Signing: Cryptographically signing a software release so its origin and integrity can be verified before it runs — proof it came from who it claims to, unmodified since signing.
Complete Mediation: The principle that every single access to a resource must be checked, every time, with no shortcut that skips the check because a prior request was already approved.
Concurrent Write Conflict: Two principals attempting to modify the same resource at nearly the same time — a situation whose resolution policy is itself an authorization question, not just a technical one.
Configuration Drift: The gradual divergence between a system's documented, intended configuration and what's actually running — accumulating from direct changes that bypass the normal process.
Confused Deputy: A privileged component tricked into misusing its own authority on behalf of a less-privileged caller who could not have used that authority directly.
Consent: A user's explicit, informed agreement to a specific use of their access or data — distinct from a default or an assumption on the system's part.
Consent Receipt: A durable, independently verifiable record that a specific consent was actually given — distinct from a mutable checkbox state in a database that a later dispute has no way to independently confirm.
Consequential Action: An action whose effect matters outside the process that requested it — a deployment, a payment, a change to policy or keys — as distinct from routine, low-stakes operations.
Constrained Device: A device with limited processing power, memory, or battery — often too limited to run the same cryptographic operations a server-class system uses routinely.
Content Moderation: Judging whether content is appropriate to keep visible — a different question from authorization, which judges whether an action was permitted to happen at all.
Continuous Authentication: Ongoing, passive verification of identity throughout a session, rather than a single discrete check at login that's then trusted for however long the session happens to last.
Credential: What an identity presents to prove itself — a password, a certificate, a signed token — distinct from the identity itself or the authority it implies.
Credential Autofill: A password manager automatically inserting a stored credential into a form it determines matches the site — a convenience whose safety depends entirely on how accurately that match is determined.
Credential Stuffing: An attack that tries username/password pairs leaked from one breach against many other unrelated services, betting on password reuse.
Cross-Origin Resource Sharing (CORS): A browser mechanism that controls which web origins may read a response — a client-side safety rail, not an authorization decision about the request itself.
Crypto Agility: A system's ability to swap out its underlying cryptographic algorithms without a fundamental redesign — the property that makes migrating to new algorithms feasible instead of a from-scratch rebuild.
Data Deletion Request: A request to permanently remove a specific principal's data — an action irreversible enough that verifying the requester's identity deserves more scrutiny than an ordinary access request.
Data Exfiltration: The unauthorized removal of data from a system's controlled boundary — a category with many paths, not just the network-based ones access control usually focuses on.
Data Lineage: A traceable record of where a piece of data came from and what transformations produced it — necessary for deciding what access rules a derived copy should actually inherit.
Data Minimization: Collecting, retaining, and exposing only the data a system actually needs for its stated purpose — reducing what a future compromise could expose.
Data Residency: Where data is physically stored and processed, and by extension who and what may access it from where — a constraint layered on top of ordinary access control.
Data Sharing Agreement: The explicit terms governing what one organization shares with another, for what purpose, and under what restrictions — the policy layer a technical access grant should actually reflect.
Default Credential: A preset username or password shipped with a device or account, meant to be changed before real use begins — and frequently never changed at all.
Default Deny: A posture where nothing is permitted unless a rule explicitly allows it, as opposed to default allow, where anything not explicitly blocked is permitted.
Defense in Depth: Layering multiple, independent controls so that one failing doesn't leave a resource fully exposed — no single control is asked to be the entire defense.
Deferred Action: An action requested now but executed later — whose authorization needs re-verification at the moment it actually runs, not just at the moment it was originally scheduled.
Delegation: One principal granting another the ability to act on its behalf, within an explicitly bounded scope — distinct from impersonation, which hides who is really acting.
Derived Credential: A device-bound credential provisioned from a stronger, original credential, so the original never has to leave its secure location to be usable elsewhere.
Derived Data: Data computed or transformed from other data — whose own access rules don't automatically follow from the source's, and have to be reasoned about independently.
Device Attestation: A device cryptographically proving its own identity and integrity to a server, rather than simply presenting a credential a copy could equally present.
Device Binding: Tying a credential or session to a specific device, so that a stolen copy is considerably less useful to whoever stole it on any device but the original.
Device Posture: The current security state of the device making a request — patched, encrypted, managed — factored into whether a request is trusted with a given level of access.
Differential Privacy: Adding carefully calibrated statistical noise to query results so that no single individual's data meaningfully changes the answer, regardless of how many queries are run.
Dual Control: Requiring two separate parties to act together before a consequential action completes — neither one alone is sufficient.
Economy of Mechanism: The design principle that a simpler system is easier to verify correct — complexity itself is a source of exploitable gaps, independent of any specific flaw.
Electronic Signature: A recorded indication of a specific person's intent to sign a document — distinct from a cryptographic code-signing signature, which proves a software artifact's origin and integrity rather than a person's consent.
Emergency Broadcast Authority: The specific, tightly held permission required to send a message to an entire user base at once — a low-frequency action whose blast radius is the largest a system offers.
Enforcement Point Consistency: The property that every place a policy is enforced applies the same decision logic — without it, the same request can get different answers depending on where it happens to land.
Entitlement: What a principal is actually allowed to use or access right now — distinct from the transaction or purchase that originally granted it.
Entitlement Creep: The gradual accumulation of access beyond what a role currently requires, as permissions are added for past tasks but rarely removed.
Environment Isolation: Keeping development, staging, and production genuinely separate — distinct credentials, distinct data, distinct access — so a mistake in one can't reach the others.
Ephemeral Credential: A credential issued for a single, short-lived unit of work — a function invocation, a job run — and discarded rather than reused across invocations.
Escalation Path: Where an approval chain routes when the primary approver is unavailable — a necessary answer, or the entire chain simply stalls until they return.
Escrow: A neutral third party holding something — funds, a key, a credential — pending a defined condition, so neither original party controls it alone in the meantime.
Event Ordering Guarantee: A system's promise, or lack of one, about whether events are processed in the order they actually occurred — a decision an authorization check that depends on sequence can't safely ignore.
Federated Identity: Trusting an identity assertion issued by a separate organization's identity system, rather than maintaining a duplicate identity record locally.
Field-Level Authorization: Checking permission for each individual field or attribute a request asks for, rather than granting or denying access to an entire endpoint as one unit.
First-Use Trust: Accepting a credential's claimed identity the first time it's seen, with no independent way to verify it, then holding it to that same identity on every subsequent use.
Free/Busy Visibility: Revealing only whether a block of time is available, without revealing the underlying event's actual details — a distinct, narrower grant than full calendar access.
Fuzzing: Automated testing that feeds a system malformed, unexpected, or randomized input to find behavior its designers didn't anticipate.
Graceful Degradation: A system's designed, less-capable-but-still-functioning behavior when a dependency it needs becomes unavailable, rather than failing completely or hanging indefinitely.
Guest Checkout: Completing a transaction without creating a persistent account — a deliberate tradeoff that lowers friction at the cost of the ongoing relationship an account would provide.
Hardware Provenance: A verifiable record of a physical component's origin and custody before it reaches deployment — distinct from software supply-chain trust, since a physically substituted or tampered component defeats any amount of software-level verification running on top of it.
Hardware Security Module: A dedicated physical device for generating, storing, and using cryptographic keys, designed so the key material never has to leave it in usable form.
Honeytoken: A fake credential or piece of data, deliberately planted, that has no legitimate use — any attempt to use it is itself a reliable signal of unauthorized access.
Household Account: A shared account structure for a small group of semi-trusted members, each usually with their own distinct profile, rather than one fully shared identity.
Idempotency Key: A client-generated value attached to a request so that resending it after a network failure repeats nothing, rather than executing the same consequential action twice.
Identity Proofing: Verifying that the real-world person behind a new account is who they claim to be, at the moment the account is created — separate from authenticating them later.
Identity Provider (IdP): The system of record that authenticates a principal and vouches for its identity to everything else that needs to trust it.
Identity Reconciliation: Merging or matching identity records from two systems being combined, so no single person ends up with duplicated, conflicting, or unintentionally combined access as a result.
Identity Verification Provider: An external service a system relies on to perform identity proofing on its behalf, rather than verifying real-world identity itself.
Immutable Infrastructure: Infrastructure replaced wholesale rather than modified in place — removing the specific opportunity for an unauthorized, undetected change to accumulate quietly over time.
Impersonation: Acting as another identity in a way that hides which principal is really performing the action, as opposed to delegation, which records both.
Implicit Grant: A permission that exists because nothing explicitly denied it, rather than because anyone explicitly assigned it — the pattern fail-safe defaults are designed to avoid.
Infrastructure as Code: Defining infrastructure in versioned, reviewable configuration rather than through manual changes — which also means whoever can change that configuration can change the infrastructure itself.
Insider Threat: Risk from someone who already holds legitimate access — through malice, coercion, or simple carelessness — as distinct from an external attacker breaking in.
Install-Time Permission: A broad set of access granted all at once when an extension or application is installed, rather than requested incrementally as each capability is actually needed.
Just-in-Time (JIT) Access: Granting a permission only when it's actively needed for a specific task, and withdrawing it automatically afterward, instead of holding it indefinitely.
K-Anonymity: A guarantee that any individual record in a released dataset is indistinguishable from at least a set number of others, so no single person can be pinpointed from it alone.
Key Rotation: Replacing cryptographic keys on a schedule or after a suspected compromise, so a key's useful lifetime — and the damage from its loss — stays bounded.
Kiosk Mode: A locked-down device configuration that restricts what any user of it can do, regardless of who they are — the device's own configuration is part of the access-control boundary.
Knowledge-Based Authentication: Verifying identity through something the person knows — a security question, a memorable date — which is weaker than it looks because that knowledge is often discoverable.
Least Astonishment: The principle that a system's authorization behavior should match what a reasonable person would expect it to do — a surprise, even a safe one, is itself a kind of defect.
Least Common Mechanism: Minimizing what different users or processes share, because a shared mechanism is also a potential path for one to affect or observe another that shouldn't be able to.
Liveness Detection: Verifying that a biometric sample comes from a live person actually present at the sensor, rather than a photo, recording, or synthetic reproduction.
Local Credential Store: Where a developer's tools cache tokens, keys, or session credentials on their own machine — a surface easy to overlook because it lives outside any server the organization directly controls.
Maintainer Account: The credential controlling publish access to an open-source package — whose compromise can propagate a malicious update to every project that depends on it, often automatically.
Model Extraction: Reconstructing a model's behavior by systematically querying its inference endpoint — a risk specific to exposing a model as a queryable service rather than distributing it directly.
Model Inversion: Attempting to reconstruct or infer specifics of a model's training data from the trained model's own behavior — a companion risk to model extraction, aimed at the data rather than the model.
Multi-Factor Authentication (MFA): Requiring two or more independent kinds of proof to establish identity, so a single stolen credential is not enough on its own.
Mutual TLS (mTLS): A connection where both sides present and verify a certificate, so each end of a service-to-service call can confirm the other's identity, not just encrypt the traffic.
Non-Repudiation: A property of a record strong enough that the party who took an action cannot credibly deny having taken it.
Nonce: A value used once and never reused, specifically so a captured, otherwise-legitimate request can't simply be resubmitted later to repeat its effect.
Notification Spoofing: Forging the appearance of a legitimate alert or notification, exploiting the trust a real one would carry to manipulate the recipient into acting.
OAuth 2.0: A framework for granting an application limited, revocable access to a resource on a user's behalf, without the user handing over their actual credentials.
OCSP (Online Certificate Status Protocol): A live, real-time check of a single certificate's revocation status, rather than downloading and searching an entire revocation list to answer the same question.
Offline Authorization Cache: A locally stored authorization decision a disconnected device relies on when it can't reach the authoritative policy source at all — not merely slow to reach, but unreachable.
On-Behalf-Of Context: The original caller's identity, carried through a chain of internal service calls, rather than each hop seeing only its immediate predecessor and losing track of who actually initiated the request.
On-Call Elevation: Temporary, broader access granted to whoever is currently on call, scoped to the duration of their rotation — access earned by the role currently held, not by permanent standing grant.
Open Design: The principle that a system's security should rest on the strength of its keys and mechanisms being verifiably sound, not on the design itself staying secret.
Open Relay: A mail system that forwards messages on behalf of anyone, without verifying the sender is authorized to send through it — a historically common and costly authorization failure.
Opt-Out Default: Enrolling a principal in something by default, requiring an explicit action to leave it — the reverse of requiring an explicit action to join.
Out-of-Band Management: An administrative access path kept separate from a system's ordinary user-facing traffic, so it isn't exposed to the same risks as the surface it manages.
Out-of-Band Verification: Confirming a request through a channel entirely independent of the one it arrived on — so that compromising one channel alone isn't enough to fake both the request and its confirmation.
Over-Fetching: A query returning more data than the caller actually needed for its purpose — a functional inefficiency that becomes an authorization concern when the extra data is sensitive.
Pairing Ceremony: The process — a PIN entered, a code confirmed, a tap performed — by which two devices establish an initial shared trust before anything else they exchange can be trusted at all.
Passkey: A credential based on a key pair rather than a shared secret, so there's no password stored on a server for an attacker to steal in bulk.
Plugin Sandboxing: Isolating a third-party extension's capabilities from the host application's own, so an extension can add functionality without inheriting the host's full access by default.
Policy Decision Point (PDP): The component that evaluates a request against policy and returns a decision, without itself carrying out the action.
Policy Enforcement Point (PEP): The component that sits in front of a consequential action and actually stops or permits it, based on a decision made elsewhere.
Policy Portability: The ability to express and enforce the same authorization policy consistently across different, heterogeneous platforms, rather than reimplementing it separately for each.
Policy Version: The specific, identifiable revision of a policy that was in force when a particular decision was made — necessary for that decision to be re-verified later.
Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against an adversary with a sufficiently powerful quantum computer — a threat that doesn't exist practically yet, but that some encrypted data needs to survive regardless.
Presigned URL: A time-limited link that grants temporary, direct access to a specific storage object without requiring the holder to authenticate separately.
Principle of Least Privilege: Grant an identity only the access it needs for its current task, for only as long as it needs it — not the broadest access that would be convenient.
Privilege Bracketing: Elevating to a higher privilege only around the exact operation that needs it, then dropping back immediately afterward — narrowing the window of elevated access to as small as possible.
Privilege Escalation: A principal ending up with more access than they were originally granted — through a bug, a misconfiguration, or a deliberate attack chaining smaller flaws together.
Privileged Access Management (PAM): The set of controls specifically applied to the smaller number of identities that hold elevated access — administrators, break-glass accounts, service accounts with broad reach.
Profile Switching: Moving between distinct identities within one shared account without a full re-authentication — convenient, and dependent on each profile's own boundaries actually being enforced.
Proof of Possession: Demonstrating control of a private key or secret without transmitting it, typically by signing something the verifier can check.
Provenance: A verifiable record of where something came from and what happened to it since — an artifact, a decision, or a piece of evidence.
Pseudonymization: Replacing an identifier with a substitute that can be reversed only by whoever holds the mapping — distinct from anonymization, which is meant to be irreversible.
Psychological Acceptability: The principle that a security mechanism people find too burdensome will get routed around — making it, in practice, no mechanism at all.
Quarantine: Isolating a principal or artifact pending review, without necessarily revoking its authority outright — a holding state between trusted and confirmed-compromised.
Rate Limiting: Bounding how often a caller may act in a given period, regardless of whether any individual call is authorized.
Re-Identification: Recovering a specific individual's identity from data that was supposed to be anonymized — often possible by combining the anonymized data with other, seemingly unrelated information.
Reconciliation: The process of resolving decisions made from an offline authorization cache against the authoritative source once connectivity returns — confirming what was allowed offline should have been.
Recording Consent: Confirmed agreement from every participant in a conversation before it's captured — an authorization question distinct from who may later access the resulting recording.
Red Team: A group that deliberately attempts to break a system's defenses, using an attacker's methods, to find what a design review alone would miss.
Refresh Token: A long-lived credential used to obtain new short-lived access tokens, without requiring the user to re-authenticate each time the old one expires.
Release Condition: The specific, predefined event that triggers an escrow holder to release what it's holding — and the entire practical value of an escrow arrangement rests on how precisely that condition is actually defined.
Remote Immobilization: The ability to remotely disable a shared vehicle's operation — a specific, high-consequence capability whose own access needs to be at least as tightly controlled as the vehicle access it governs.
Replay Attack: Resubmitting a captured, legitimate request to repeat its effect — an attack that needs no understanding of the request's contents, only a copy of it.
Reputation-Gated Permission: A permission that expands automatically as a principal accumulates a track record on a platform, rather than being granted all at once at signup — access earned incrementally, not assumed upfront.
Request Signing: Cryptographically signing an entire request so its authenticity and integrity can be verified independent of the transport channel it traveled over.
Resource Quota: A cap on total consumption over a period — distinct from a rate limit, which bounds how often a caller may act rather than how much they may consume in aggregate.
Revocable Link: A share link that can be individually disabled after the fact, rather than one whose only real control is not creating it in the first place.
Revocation: Withdrawing previously granted authority or trust before its normal expiry, so it stops being honored immediately rather than waiting for a scheduled end.
Risk Score: A computed estimate of how suspicious a given request appears, used to modulate an authorization decision rather than to replace the underlying rule entirely.
Role Assumption: Temporarily adopting a different set of permissions in another account or context, rather than holding standing credentials there permanently.
Role-Based Access Control (RBAC): Granting permissions based on a named role a principal holds, rather than assigning permissions to each identity individually.
Route-Level Policy: A policy applied at a specific route or endpoint within a gateway, rather than uniformly across every route behind it — the granularity that keeps a shared chokepoint from becoming all-or-nothing.
Runtime Permission Request: Asking for a specific capability only at the moment it's actually needed, rather than bundling every possible capability into one upfront, all-or-nothing request.
SameSite Cookie Attribute: A cookie setting controlling whether it's sent along with a request originating from a different site — a narrow, specific control on session-cookie exposure, not a general access-control mechanism.
Sandboxed Execution Environment: An isolated context for running arbitrary code, scoped to limit what that code can reach — distinct from restricting a specific extension's declared permissions.
Scope: A named, bounded permission requested and granted as part of a delegated-access flow — narrower than 'full access to this account.'
Scoped Admin Role: An administrative role whose authority is deliberately limited to a specific subset of an organization, rather than the organization as a whole — administration with its own boundary, not a synonym for total control.
Scoped Permission: A permission bounded to a specific target, operation, and set of conditions — as opposed to a general grant that covers more than a given task requires.
Search Index: A separate, derived copy of data structured for fast querying — which means it can drift out of sync with the access permissions on the original data it was built from.
Secrets Management: The discipline of storing, distributing, and rotating credentials themselves — a different problem from deciding who is allowed to use them.
Secure Multi-Party Computation: Computing a joint result from several parties' private inputs without any party seeing another's raw data — changing the authorization question from 'who may see the data' to 'who may see the result.'
Security Through Obscurity: Relying on attackers not knowing how a system works as the actual protection — a strategy that fails completely and silently the moment the design becomes known.
Security Trimming: Filtering search or index results down to what the specific searcher is actually authorized to see, rather than showing everything the index technically contains.
Selective Disclosure: Revealing only the specific parts of a record relevant to a particular recipient, rather than handing over the entire record and trusting them not to look at the rest.
Send-As Permission: The specific, separately grantable authority to send a message that appears to come from another identity or address, distinct from any other access that identity holds.
Sender Domain Authentication: Verifying that a message's claimed sending domain actually authorized it to be sent — email has no built-in guarantee of this, which is exactly what made forging a sender's domain so easy for so long.
Separation of Duties: A control that requires more than one distinct party to complete a sensitive action, so no single person or role can both initiate and approve it.
Separation of Privilege: The general principle that granting access should depend on satisfying more than one independent condition — the abstract idea that dual control and split knowledge both put into practice in different ways.
Server-Side Request Forgery: Tricking a server into making a request on the attacker's behalf, to a destination the attacker couldn't reach directly — a specific, common instance of the confused deputy problem.
Service Account: An identity used by a piece of software rather than a person, typically for automated or scheduled work that runs without anyone present to authenticate interactively.
Service Mesh: An infrastructure layer that handles service-to-service traffic uniformly — including, often, authentication and policy enforcement — separately from each service's own code.
Session Fixation: An attack where an attacker sets a known session identifier before a victim authenticates, so the attacker can use that same identifier afterward as if they were the victim.
Session Handoff: Transferring an authenticated session from one device to another — a deliberately supported convenience that also opens a specific window for interception if done carelessly.
Session Hijacking: Stealing or otherwise obtaining a valid session identifier and using it to act as the session's legitimate owner, without needing their original credentials.
Session Token: A short-lived credential issued after authentication, used in place of re-entering primary credentials for every subsequent request.
Share Link: A URL that grants access to a specific resource to whoever holds it, independent of who they actually are — convenient, and only as secure as the link itself staying private.
Shared Channel: A communication space where identities from two or more separate organizations coexist under one shared context — access control has to account for two different organizations' worth of members, not just one.
Shared Responsibility Model: An explicit division of security duties between a platform and the organizations that build on it, so neither side assumes the other is covering a given control.
Single Point of Failure: Any component whose failure or compromise disables or bypasses the whole system around it — worth identifying deliberately rather than discovering during an incident.
Single Sign-On (SSO): Authenticating once with a central identity provider and using that single session across many separate services, instead of logging into each one individually.
Single Sign-Out: Ending a session in every federated application at once, not just the one where logout was triggered — the less commonly built counterpart to single sign-on.
Sneakernet Update: Physically carrying an update — on removable media, by hand — into an environment that has no network path for it to arrive any other way.
Software Bill of Materials (SBOM): A structured inventory of every component that makes up a piece of software, so its origins and known issues can be checked without reverse-engineering the artifact itself.
Split Knowledge: Dividing a secret so that no single person holds the complete version — reconstructing it requires multiple people to act together.
Standing Access: Access that persists whether or not it is currently being used, as opposed to access granted only for the duration of a specific task.
Standing Consent: Agreement given once that continues to authorize a recurring action indefinitely, until explicitly withdrawn — a durable grant, not a one-time approval.
Step-Up Authentication: Requiring stronger proof of identity at the moment a request becomes higher-stakes, rather than applying the same verification bar to every action.
Tailgating: Following an authorized person through a badge-controlled door without presenting a credential of one's own — a purely physical bypass of an otherwise correctly functioning access-control system.
Tamper-Evident Log: A record structured so that any after-the-fact alteration is detectable, even by someone who has since gained access to the log itself.
Tenant Isolation: Ensuring that one customer or organization sharing a multi-tenant system cannot reach another tenant's data or affect its operations.
Threat Model: An explicit description of who might attack a system, what they're capable of, and what they'd be after — used to decide which defenses are actually worth building.
Token Binding: Tying a token to the specific connection or key that requested it, so a copy of the token alone is not enough to use it from somewhere else.
Token Exchange: Converting one credential into a different, more narrowly scoped one for a specific downstream call, rather than passing the original credential further than it needs to travel.
Tokenization: Replacing a sensitive value with a non-sensitive reference usable everywhere except the one system that can reverse it back to the original — narrowing where the real value ever has to appear.
Training Data Access: The specific permission to use a dataset as input for training a model — a different question from who may later query the model that results from it.
Transaction Hold: Provisionally reserving authority for a financial action before it's finally confirmed, so the funds or authorization aren't left fully committed during the window a check might still reverse it.
Trust Root: The anchor point from which all authority and cryptographic trust in a system derives. If the root is compromised, every downstream trust decision is suspect.
Trusted Timestamp: A cryptographically verifiable assertion of when a specific piece of data existed, issued by a party independent of whoever created the data — proof of timing that doesn't rely on the creator's own clock.
Typosquatting: Publishing a malicious package under a name deceptively similar to a popular one, hoping for an accidental install from someone who mistyped or misremembered the real name.
Uniqueness Proof: Proving a principal hasn't already participated, without necessarily revealing who they are — authorization based on 'not yet counted' rather than on a verified identity.
Vendor Access: Access granted to a party outside the organization, typically for a bounded purpose, that needs different oversight than an employee's own account.
View-As Mode: Support tooling that lets staff see a system through a specific user's account, without becoming that user in every other respect — a narrow, closely scoped form of impersonation.
Voice Authentication: Verifying identity through vocal characteristics — convenient for a hands-free interface, but weaker and more spoofable than most other biometric or possession-based methods.
Waiting Room Admission: A host-controlled gate requiring explicit approval before a participant joins a call — distinct from merely holding a valid meeting link, which proves knowledge of the meeting, not permission to join it.
Watermark: A marker embedded in shared content, visible or hidden, that lets a specific leaked copy be traced back to whichever recipient it was originally given to.
WebAuthn: The web standard underlying passkey-based authentication, letting a browser talk to a device's key hardware to prove possession without a password.
Webhook: An inbound HTTP callback one system sends to another to report an event — a request whose sender must be verified, not simply assumed genuine.
WebSocket: A long-lived, bidirectional connection between client and server — authorized once at the start, but potentially open far longer than a typical request.
Workload Identity: An identity a running piece of software is dynamically issued by its own platform, rather than a long-lived secret embedded in its configuration ahead of time.
Zero Trust: An architectural stance that assumes no request is trustworthy by default, regardless of where it originates, and verifies every one explicitly.
Zero-Knowledge Proof: A way to prove a fact is true without revealing the underlying data that makes it true — the verifier ends up certain, but no better informed about anything beyond the fact itself.