Glossary

BalkanID’s unified identity intelligence layer that maps relationships between identities, applications, accounts, roles, permissions, and usage signals. This graph powers discovery, risk insights, governance campaigns, and automation.

A governance process where managers or system owners periodically confirm whether users still require their assigned access.

Automation that ensures identities receive appropriate access during onboarding, role transitions, and offboarding events.

A modern governance model where identity workflows are executed by intelligent agents capable of discovering risk, recommending actions, and performing automated remediation.

Automated governance workflows that orchestrate lifecycle events, access remediation, risk response, and policy enforcement.

A natural language interface that enables administrators to query identity data, investigate risks, and trigger governance actions conversationally.

Any SaaS service, cloud platform, on-premise system, or internal application containing identities and permissions.

A user or machine identity that exists within an application.

A defined group of identities, roles, or permissions that form the scope of an access certification campaign.

A next-generation identity governance model where identity discovery, risk detection, review prioritization, and remediation operate automatically with minimal manual intervention.

The total potential impact of a compromised identity or credential, including the systems, data, and resources it can access(directly or indirectly).

An identity governance approach where access risk is monitored and remediated continuously instead of through periodic compliance reviews.

A security model where identity discovery, risk detection, access certification, and remediation operate continuously across the enterprise.

A secret or key used to authenticate and authorize access.

The ability to govern legacy or internal applications without APIs using automation, agents, or workflow-based controls.

The process of collecting identity, account, and permission data from enterprise systems and mapping them into a unified identity model.

A unified representation of a human or machine identity constructed from multiple enterprise systems.

A specific permission granted to an identity within an application.

The uncontrolled accumulation of permissions across multiple systems.

A normalized object within BalkanID representing identities, applications, accounts, groups, roles, or permissions.

The practice of attaching logs, approvals, and artifacts to identity governance decisions to support audits and compliance.

A detected identity risk such as excessive privileges, unused permissions, or policy violations.

A structured process where reviewers validate user access to ensure it remains appropriate.

A collection of users or accounts used to assign permissions collectively.

An API-first identity governance architecture that integrates into existing IAM ecosystems without requiring system replacement.

Connecting BalkanID to HR systems such as Workday or BambooHR to synchronize employee data and drive lifecycle automation.

BalkanID’s analytics engine that continuously evaluates identity relationships to detect security risks and policy violations.

A digital representation of a person, machine, service account, or automation agent interacting with systems.

A BalkanID capability that continuously detects identity risks and automatically triggers governance workflows to remediate them.

The process of identifying and mapping all identities across enterprise systems.

A unified architecture that connects identity governance, authentication, authorization, and analytics into a single control plane.

Insights derived from analyzing identity relationships, privilege assignments, and access usage patterns.

An analytical model that maps identity relationships and privilege pathways to identify potential attack paths and risk exposure.

An organization’s overall exposure to identity-related security risks.

A centralized layer where identity visibility, governance, automation, and analytics operate across all applications and infrastructure.

The uncontrolled growth of identities and accounts across applications and environments.

A discipline focused on managing identity lifecycle, access permissions, and compliance.

An emerging category of platforms focused on providing deep visibility into identity relationships and access risk across enterprise systems.

A model where access is granted temporarily for a specific purpose and automatically revoked when the task is completed.

Lifecycle events that trigger access provisioning, modification, or removal.

A security practice and process of periodically changing cryptographic keys or credentials to minimize the risk of unauthorized access.

A principle where identities receive only the access necessary to perform their tasks.

Policy-driven workflows that adjust permissions when identity attributes change.

An open-source standard that enables AI applications to connect to and interact with external systems.

Machine identities such as service accounts, API tokens, integrations, automation bots, and AI agents.

An active account that no longer has an associated identity owner.

A condition where identities possess more permissions than required for their role.

A specific capability granted within an application or system.

Elevated permissions that allow administrative control over systems and infrastructure.

A dashboard that highlights high-risk access items during review campaigns to help reviewers focus on critical decisions.

The business justification provided when requesting access.

A model where permissions are assigned to roles instead of directly to users.

A gradual divergence between defined role policies and real-world access assignments.

The process of correcting identity risks by removing permissions, disabling accounts, or adjusting policies.

A collection of permissions grouped together for simplified access management.

Analyzing access patterns to identify least-privilege roles.

A governance model where review and remediation activities are prioritized based on risk signals.

A provisioning bridge that enables lifecycle automation for systems that do not support SCIM natively.

Policies designed to prevent users from holding conflicting permissions that could enable fraud or abuse.

A non-human identity used by applications or automation processes.

Unmanaged identities created outside formal governance processes.

Permissions granted indefinitely rather than temporarily.

A set of permissions that violate segregation-of-duties policies when assigned together.

A consolidated representation of identities and access relationships across enterprise systems.

The process of reviewing and certifying that users have appropriate access to applications and systems.

Analytics showing whether permissions are actively used or unnecessary.

A model where users hold no permanent elevated permissions and must request temporary access when needed.

A security framework where every access request must be verified based on identity, context, and risk.

An inactive account that still retains access permissions.