> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/glossary.md).

# Glossary

Terms used across the SECUREpass documentation.

## A–C

**ABAC — Attribute-Based Access Control.** Access decided from attributes such as department, location, device or time of day, rather than from a role alone.

**Access graph.** The connected model of identities, accounts, roles, groups, permissions and resources, and the relationships between them. See *Converged identity and the access graph*.

**Adaptive authentication.** Raising or lowering the authentication requirement in response to risk signals, instead of applying the same requirement in every context.

**Birthright access.** The access granted automatically on joining, based on department or role, that nobody has to request.

**Break-glass.** Emergency access granted outside the normal approval path, fully audited.

**Certification.** See *Access review*.

**Checkout and check-in.** Requesting time-limited use of a vaulted credential, then returning it.

**Credential injection.** The gateway supplies a credential to the target system so the user never sees it.

## D–I

**Dormant account.** An account unused for longer than the configured threshold. SECUREpass can warn the user and then deactivate it automatically.

**DSC — Digital Signature Certificate.** A certificate used to authenticate and to digitally sign documents.

**Dual control.** A second person must approve before an action or session may proceed.

**Entitlement.** A fine-grained right inside an application or system — the level below a role.

**GRID card.** A personal grid of characters; the user answers a coordinate challenge against it.

**HOTP.** Counter-based one-time password algorithm, RFC 4226.

**IdP — Identity Provider.** The party that authenticates a user and asserts their identity to a service provider.

## J–O

**JEA — Just-Enough-Access.** Granting only the privileges an action actually needs, rather than a full administrative role.

**JIT — Just-In-Time access.** Elevating privilege only when needed, for a limited time, then revoking it automatically.

**Joiner, mover, leaver.** The three lifecycle events that change what access an identity should hold.

**KBA — Knowledge-Based Authentication.** Authentication from something the user knows, such as answers to pre-set questions.

**Kerberos.** Ticket-based authentication that enables seamless desktop SSO on Windows domains.

**LDAP.** Directory access protocol, used to read and synchronise users and groups.

**MFA — Multi-Factor Authentication.** Requiring more than one independent proof of identity.

**Non-human identity.** A service account, API key, token or workload — an identity that is not a person.

**OIDC — OpenID Connect.** Token-based authentication built on OAuth 2.0, for web, mobile and API access.

**Orphaned account.** An account with no identifiable owner.

## P–R

**PAM — Privileged Access Management.** Control over what an authenticated privileged user can do: which targets they reach, what happens in the session, what is recorded.

**PIM — Privileged Identity Management.** Control over who the privileged identities are: the entitlements they hold, and how those are reviewed and certified.

**PKI — Public Key Infrastructure.** Certificate-based identity, used here for authentication and for signing.

**Push notification.** An approve-or-deny prompt delivered to the SECUREpass Authenticator app.

**RADIUS.** Network authentication for VPNs, Wi-Fi and network devices, with support for an MFA challenge.

**RBAC — Role-Based Access Control.** Permissions bundled into roles, and roles assigned to users or groups.

**Risk profile.** A named set of conditions and their consequences, used to drive adaptive authentication.

## S–Z

**SAML 2.0.** XML-based federation for web single sign-on. SECUREpass can act as Identity Provider or Service Provider.

**Session recording.** Capture of a privileged session for audit and forensic review.

**SoD — Segregation of Duties.** Combinations of access that must never be held together by one person.

**SP — Service Provider.** The application that relies on an identity provider to authenticate its users.

**SSO — Single Sign-On.** Signing in once and reaching multiple applications without authenticating again.

**Step-up authentication.** Demanding an additional factor at the point a sensitive action is attempted.

**TOTP.** Time-based one-time password algorithm, RFC 6238.

**Trusted device.** A device the user has registered, which may face fewer checks than an unrecognised one.

**Vault.** Where privileged credentials are stored. Cryptographic protection at rest is delegated to an external HSM or key vault.