#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.
Showing 56 featured terms of 1,552 — filter by letter or domain, or search to filter the results
The definitive NHI reference glossary.
Every term is written for IAM practitioners, architects, and security professionals.
Covering Non-Human Identity, Agentic AI security, secrets management, workload identity, and the complete NHI governance landscape.
Maintained by the NHI Mgmt Group Editorial Knowledge Base and reviewed by Lalit Choda, Founder of NHI Mgmt Group.
Foundations & NHI Taxonomy
55 terms
Business-context layer
Foundations
A business-context layer turns technical classifications into concepts the organisation can act on. It sits above raw labels and helps teams decide what matt…
Business-native taxonomy
Foundations
A business-native taxonomy is a sensitivity model built around how an organisation actually defines value, risk, and protection needs. It maps internal meani…
Content-based classification
Foundations
Content-based classification inspects the information inside a file rather than relying on its name, metadata, or format. It is essential when common busines…
Healthcare Identity And Access Management
Foundations
Healthcare identity and access management is the discipline of controlling who or what can access patient data, clinical apps, and connected services. In int…
Identity maturity
Foundations
Identity maturity is the degree to which an organisation has turned identity from a deployment into a managed operating model. In practice, it covers visibil…
Observability
Foundations
Observability is the ability to understand the internal state of a system from the data it produces. In security and operations, that means combining logs, m…
Public-Facing Identity
Foundations
A person’s visible professional persona across social media, interviews, conferences, and branded communications. It becomes a security asset when others rel…
NHI Lifecycle Management
69 terms
AI Integration Offboarding
Lifecycle
The process of fully disconnecting an AI tool from enterprise systems, revoking credentials, removing permissions, and deleting retained data where possible.…
API Key Rotation
Lifecycle
API key rotation is the process of replacing a secret with a new value before or after risk emerges. In NHI governance, it is a lifecycle control that reduce…
Application-Local Identity
Lifecycle
An application-local identity is an account created and managed inside an application rather than through a central identity provider. These identities often…
Data and AI Lifecycle
Lifecycle
The Data and AI Lifecycle is the end-to-end set of processes used to prepare data, train models, deploy AI systems, and run them in production. It includes t…
Deprovisioning
Lifecycle
Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens…
Ephemeral Client
Lifecycle
An ephemeral client is a short-lived application or service client that should receive credentials only for the duration of a specific task or runtime window…
Identity Lifecycle Reconciliation
Lifecycle
Identity lifecycle reconciliation is the continuous comparison of identity source data, actual entitlements, and business purpose. It helps teams spot linger…
Authentication, Authorisation & Trust
241 terms
Access intelligence
Auth & Trust
Access intelligence is a runtime authorization approach that combines identity, context, and policy before granting or continuing access. It reduces the valu…
Authentication Coverage Gap
Auth & Trust
An authentication coverage gap is the difference between the identity policy an organisation claims to enforce and the platforms or user groups that remain o…
Certificate Authority For Access
Auth & Trust
A certificate authority for access is the trusted component that signs short-lived credentials after authentication and policy checks. In identity-led remote…
Federated Cloud Trust
Auth & Trust
Federated cloud trust is the arrangement where a cloud provider accepts an external token from an identity issuer and exchanges it for cloud credentials. It …
Identity-Bound Remote Access
Auth & Trust
Identity-bound remote access is a model where the login decision depends on a verified identity rather than a reusable secret stored on hosts. It reduces key…
Static Credential
Auth & Trust
A static credential is a long-lived secret such as an API key, password, token, or certificate that exists outside the moment of use. It creates persistent a…
Subject Claim
Auth & Trust
The subject claim is the identity string inside an OIDC token that tells the relying party who the token represents. In CI/CD federation, that string often e…
Architecture & Implementation
194 terms
Application-Centric IAM
Architecture
An identity model that treats the application, not only the human user, as the primary actor for authorization decisions. It recognises that most modern requ…
Break-glass Access
Architecture
Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate inte…
Credential Store
Architecture
A credential store is the system or datastore that holds secrets such as OAuth tokens, API keys, certificates, and access tokens. When it contains third-part…
Design Effectiveness
Architecture
Design effectiveness is the test of whether a control is built to address the risk it is meant to mitigate. A control can be well documented and still fail t…
Just-in-time permissions
Architecture
A control pattern that grants specific application or system entitlements only for the period they are needed, then removes them automatically. It reduces th…
Plugin-based Extension
Architecture
A software design pattern that lets custom logic be added to identity or authorization flows without changing the core platform. It is useful for specialised…
Privileged container
Architecture
A privileged container is a container granted elevated access to host resources beyond normal isolation. That access can include host filesystem paths, devic…
Governance, Ownership & Risk
516 terms
Federated identity governance
Governance
Federated identity governance distributes control across platforms and business units while keeping policy, evidence, and accountability aligned. It is used …
Findings Backlog
Governance
A findings backlog is the accumulation of discovered access issues that have not yet been remediated. It often becomes a governance failure signal when teams…
Licence Right-Sizing
Governance
Licence right-sizing is the process of matching user entitlement to real business need so organisations do not pay for access they do not use. In governance …
Namespace Reuse
Governance
Namespace reuse happens when a deleted or renamed repository, organisation, or workspace name becomes available for someone else to claim. In identity terms,…
Phantom Cloud Identity
Governance
A phantom cloud identity is a cloud role, service account, or federated access path that still exists after the upstream owner, project, or namespace has bee…
Privileged non-human identity
Governance
A privileged non-human identity is any service account, API key, token, certificate, workload, or AI agent that can reach sensitive systems and perform high-…
Structural friction
Governance
Structural friction is the delay or complexity introduced by governance controls that slows legitimate work. In identity programmes, too much friction encour…
Threats, Abuse & Incident Response
196 terms
Context-aware classification
Threats
Context-aware classification uses surrounding document meaning, not just keywords, to determine what a file or record represents. It reduces false positives …
Effective data reach
Threats
The actual datasets an identity or integration can access after accounting for roles, scopes, exports, and inherited trust. This is different from configured…
File lineage
Threats
A method of tracking how a file propagates through copies, downloads, uploads, edits, and derivatives across systems. It is useful because incident responder…
Heap memory disclosure
Threats
Heap memory disclosure occurs when a program reads data outside the intended buffer and returns whatever sits in process memory. In AI runtimes, that can exp…
Ownership-based Takeover
Threats
Ownership-based takeover is an attack pattern where control of an identity object lets an actor add credentials and then authenticate as that object. It is e…
Post-Authentication Abuse
Threats
Post-authentication abuse happens when an attacker uses valid credentials to perform actions after login rather than breaking authentication itself. For NHI …
Unauthenticated inference endpoint
Threats
An unauthenticated inference endpoint is an AI service that accepts requests without proving the caller's identity. It is especially risky when exposed on pu…
Agentic AI & Autonomous Identity
181 terms
Agent scope drift
Agentic AI
The gap between what an AI agent was approved to do and what it actually does once it starts operating. In practice, drift appears when tools, data sources, …
Agentic Data Traceability
Agentic AI
Agentic data traceability is the ability to connect each AI agent or other non-human identity to the exact data it accessed, the delegation path that allowed…
Delegation Revocation
Agentic AI
Delegation revocation is the process of removing access that was granted through an intermediate client, service, or delegated relationship. In NHI environme…
Investigation copilot
Agentic AI
An investigation copilot is an assistant that helps security teams query, summarise, and correlate security data in natural language. It can speed up analysi…
Non-Human Identity Runtime
Agentic AI
A production service that executes with its own credentials, tool access, and operational trust, even when it is not a traditional workload account. For AI s…
Permission Boundary
Agentic AI
A permission boundary is the enforceable limit on what an identity can do, regardless of how it behaves. For AI agents, this boundary matters more than sessi…
Question Budget
Agentic AI
Question budget is the finite amount of user patience and attention an AI agent can spend while gathering missing context. A well-designed workflow conserves…
NHI & Agent in the Broader IAM Ecosystem
22 terms
Dataverse Web API
IAM Ecosystem
Dataverse Web API is the interface used to query Copilot Studio and Power Platform data, including agent records and related components. For security teams, …
Prompt Leakage
IAM Ecosystem
The unintended exposure of user prompts, system prompts, or tool output from an AI runtime. In NHI terms, prompt leakage matters because those strings often …
Provenance
IAM Ecosystem
Provenance is the traceable history of where a software artifact came from, who approved it, and what controls were applied along the way. In container secur…
Runtime DLP
IAM Ecosystem
Runtime DLP is data loss prevention enforced during live AI interactions instead of only at rest or on paper. It inspects prompts, responses, and transfers i…
SCIM Provisioning
IAM Ecosystem
SCIM provisioning is a standardized way to sync identity information between systems. It helps automate account creation, updates, and removal across connect…
SMART on FHIR
IAM Ecosystem
SMART on FHIR is a healthcare interoperability pattern that combines the SMART app framework with HL7 FHIR data exchange. It lets applications request scoped…
Structured Questioning
IAM Ecosystem
Structured questioning is the practice of asking users to select from constrained, actionable options instead of typing free text. It reduces ambiguity, impr…
No terms match your search.
Clear search
Clear search
Deepen your NHI knowledge with the official certification course.
NHI Foundation Level Course → Browse FAQ → Discussion Forum →