Key terms

this glossary outlines foundational terms used throughout the activate iam platform understanding these terms will help stakeholders and technical users navigate the product, architecture, and implementation materials with clarity identity a digital representation of a user (employee, contractor, service account, etc ) within an organization each identity is typically linked to a unique identifier, such as an email address or employee id provisioning the automated process of creating accounts and granting access to systems or applications based on a user’s role or attributes deprovisioning the removal or disabling of user accounts and access when they are no longer required — for example, when an employee leaves the organization entitlement a specific access right or permission within a system (e g , "read only access to salesforce reports") entitlements can be grouped into roles role a collection of entitlements assigned based on a user’s job function or department roles simplify access management and are often tied to policies (e g , "finance analyst role") rbac (role based access control) an access control model where users receive permissions based on assigned roles this model helps enforce least privilege abac (attribute based access control) an access control model that uses user, resource, or environment attributes (e g , department = "hr", location = "us") to make access decisions dynamically joiner–mover–leaver (jml) a common iam lifecycle model joiner new user onboarding mover role or department change leaver termination or offboarding identity source (system of record) the authoritative system from which identity data is imported (e g , hris like workday or sap successfactors) target system any downstream application or service where identities need access (e g , active directory, okta, salesforce) access request a user initiated process to gain access to new systems or roles, often requiring manager or system owner approval access certification / review a periodic process where managers or data owners validate that users still require their existing access — critical for compliance policy engine the component that defines and evaluates access rules (e g , who gets what access under which conditions) connector an integration module that enables activate to read/write data from external systems (e g , provisioning accounts in azure ad) audit trail a complete, immutable log of identity related events, including provisioning actions, access approvals, and policy evaluations