> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/understanding-securepass/key-concepts-and-terminology.md).

# Key concepts and terminology

This section explains the identity and access concepts used throughout the documentation, the terms specific to SECUREpass, and the standard protocols the platform supports.

#### Identity and access fundamentals

#### SECUREpass-specific terms

| Term                       | Meaning                                                                                                        |
| -------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Risk Profile**           | A set of conditions — location, IP, device, time, behaviour — determining the authentication strength required |
| **Auth Mode**              | A configured authentication method. Applications can require primary, secondary and tertiary modes             |
| **Tenant**                 | An isolated customer or organization space within a multi-tenant deployment                                    |
| **Certification Campaign** | A scheduled access-review cycle in which reviewers approve or revoke access                                    |
| **Privileged Account**     | An account with elevated rights, managed and brokered through PAM                                              |
| **Session Recording**      | Capture of a privileged session — commands, video, queries — for audit and forensics                           |
| **Break-Glass**            | Emergency privileged access granted outside the normal approval path, fully audited                            |
| **Access Graph**           | The converged model linking identities, accounts, roles, permissions and resources                             |

#### 2.3 Protocols

| Protocol                       | What it does in SECUREpass                                                                    |
| ------------------------------ | --------------------------------------------------------------------------------------------- |
| **SAML 2.0**                   | XML-based federation for web SSO. SECUREpass can act as Identity Provider or Service Provider |
| **OpenID Connect / OAuth 2.0** | Token-based authentication and authorization for web, mobile and API access                   |
| **LDAP**                       | Directory access, used to read and synchronize users and groups                               |
| **RADIUS**                     | Network authentication for VPNs, Wi-Fi and network devices, with MFA challenge support        |
| **TACACS+**                    | Centralized AAA for network device administration                                             |
| **Kerberos and NTLM**          | Ticket-based authentication enabling agentless desktop SSO on Windows domains                 |
| **SCIM**                       | Standards-based provisioning and de-provisioning of identities                                |

#### Abbreviations

**DSC** Digital Signature Certificate · **KBA** Knowledge-Based Authentication · **SoD** Segregation of Duties · **JIT** Just-In-Time · **JEA** Just-Enough-Access · **TOTP** Time-based One-Time Password · **CIEM** Cloud Infrastructure Entitlement Management · **IdP** Identity Provider · **SP** Service Provider

***