Glossary
Credential
A credential is proof, not identity and not authority. It is the thing a principal presents — a password, a private key, a signed token — to demonstrate that it is who it claims to be. The identity is the claim; the credential is the evidence for it; the authority is a separate grant that a system extends to that identity once admitted, and none of the three should be treated as interchangeable.
Systems that conflate the three tend to make an implicit, risky assumption: that possessing a credential automatically implies the full authority ever granted to the identity it belongs to. Scoped credentials — proof valid only for a specific action, target, or time window — avoid that assumption, at the cost of needing more of them.