Free & open · no paywall, ever

IntegrAuth Academy

Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.

Choose your program Browse the 20 tracks

20 tracks 241 lessons 242 hands-on labs 230+ diagrams 100% free

OAuth 2.1OpenID ConnectPasskeys / WebAuthnJWT & DPoPSAML 2.0SCIM 2.0OpenFGA / ReBACMCP securityCIBAToken ExchangemTLS & SPIFFECAEP / Shared SignalsFAPI 2.0Zero TrustAPI securityKerberos & ADHow LLMs workPromptingCoding assistantsAI automationPrompt injectionRAGCoding with AIOAuth 2.1OpenID ConnectPasskeys / WebAuthnJWT & DPoPSAML 2.0SCIM 2.0OpenFGA / ReBACMCP securityCIBAToken ExchangemTLS & SPIFFECAEP / Shared SignalsFAPI 2.0Zero TrustAPI securityKerberos & ADHow LLMs workPromptingCoding assistantsAI automationPrompt injectionRAGCoding with AI

English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.

How?

Chrome on phone: ⋮ menu → Translate
Chrome on computer: right-click → Translate to …
Edge: the translate icon in the address bar

FOUNDATIONS · LESSON 12

A–Z glossary — every term in one place

Every word and acronym from the Identity program, in A–Z order, with a short plain meaning. Hover over a dotted word in any lesson to see it here. Type in the box to find one. The lessons tell the full story.

A

A2A: Agent2Agent protocol: an open standard that lets agents from different vendors find each other and work together.
AAL2: Authentication Assurance Level 2, from NIST: the user proves two different factors at sign-in.
ABAC: Attribute-based access control: permissions come from facts about the user and the situation. Examples are department, device or time.
Absolute timeout: A session ends a fixed time after sign-in, even if the user is still active. It caps how long a stolen session can work.
Acceptable use policy (AI): A short set of workplace rules for AI. It covers approved tools, what data may go where, what needs human review and who owns results.
Acceptance criteria: Clear, checkable statements of what "done" means for a change. They help you judge a coding agent's plan and write tests that prove the work.
Access certification campaign: A planned round of access reviews. Owners say keep or revoke for every grant in scope.
Access control list (ACL): A list on a resource that says who may do what with it.
Access key: A long-lived ID and secret pair that lets code call a cloud. If it leaks, anyone can use it until someone turns it off.
Access package: A ready-made bundle of access for a job or a partner type. You request and approve it as one unit.
Access review / attestation: A regular check where a human owner confirms that people (and bots) still need their access.
Access token: The wristband: a short-lived token you show to an API to prove what you may do.
Access token / refresh token / ID token: The wristband you show to an API. / The voucher that gets a new wristband. / The note that says who signed in.
Account: A login record in one system. One person (one identity) can have many accounts.
Account enumeration: Finding out which emails or usernames have accounts, from different replies to a login or reset request. Give the same reply every time.
Account linking: Joining two logins that belong to the same person into one account.
Account lockout: A timed block after too many failed tries. The account is fine. The customer just waits or unlocks it.
Account recovery: The ways a person gets back into an account, like "Forgot password?" or a lost-device process.
Account takeover: An attacker gets into someone else's account and uses it as the owner.
ACME: Automatic Certificate Management Environment (RFC 8555). It lets software prove it controls a domain, then get and renew certificates with no human.
acr: A claim in a token that says how strong the login was, using assurance levels.
acr / amr: Two token claims. acr says how strong the login was. amr says which methods were used.
Acronym: A short name made from the first letters of several words, like IAM or MFA.
Active Directory: Microsoft's directory for Windows networks (AD DS). It speaks LDAP and handles Windows sign-in and Group Policy. Open equivalents include OpenLDAP, FreeIPA and Samba AD.
Actor claim (act): The act claim in a token (RFC 8693). It names the party that really makes the call, while sub still names the person.
Adaptive MFA: MFA that asks for a second factor only when a sign-in looks risky. It stays quiet when the sign-in looks normal.
Admin tiering: Sorting accounts, machines and tools into tiers. Tier 0 controls identity. Control flows only down. High-tier credentials never touch low-tier machines.
AES: Advanced Encryption Standard: a strong, modern cipher. Kerberos should use it instead of RC4.
Agent card: An AI agent's one-page passport in the registry: owner, purpose, tools, risk tier and review date.
Agent framework: A library that runs the agent loop for you. It calls the model, runs the tools it asks for and feeds results back. Examples as of September 2026 include the Claude Agent SDK and LangGraph.
Agent hook: A script the coding tool runs at a fixed point in an agent session, such as before a tool call. It runs every time. A before-tool hook can block the action.
Agent memory: Notes an AI agent saves and reads again in later chats, so it can remember what you like. The agent trusts what is saved, so treat every note as input, not as truth.
Agent plugin: An installable package that bundles extras for a coding agent, such as commands, skills, hooks and MCP servers. Installing one means running someone else's code with your permissions.
Agent sandbox: A boundary that limits which files an AI agent's commands can change and which network hosts they can reach. The network limit stops a fooled agent from sending data out.
Agent skill: A packaged folder of know-how (a SKILL.md plus optional scripts) that an agent loads only when a task needs it.
AGPL: GNU Affero General Public License: a strong open-source license. If you change the code and offer it over a network, you must share your changes.
AHO / AO / ATO: Account handover (the owner gives the account away). / Fraudulent account opening. / Account takeover (a criminal gets in).
AI agent: Software that uses an AI model to choose its own next step and use tools. It loops until the goal is done or a limit stops it.
AI API: A provider's doorway to a model for programs. Your code sends the whole conversation in each HTTPS request and pays per token.
AI inventory: A list of every AI tool and use in an organization. Each entry has an owner, the data it touches, its risk level and its next review date.
AI tutor mode: An assistant setting that teaches with questions, hints and quizzes instead of giving answers. Examples are ChatGPT's study mode, Claude's learning mode and Gemini's Guided Learning.
AI watermark: An invisible signal woven into AI-generated content when it's made (Google DeepMind's SynthID is one). Only a tool that knows that watermark can detect it, so finding none proves little.
AiTM: Adversary-in-the-middle: an attacker's server sits between you and the real site. It passes your login through and steals the session.
Algorithmic bias: When an automated system treats people unfairly because of who they are, such as sex, race, age or disability. It is usually learned from data, not programmed on purpose.
Allocational harm: Harm when a system hands out jobs, loans, housing or medical care unfairly. Compare representational harm.
Allow-list: A list of the only things that may run or connect. Anything not on it is refused.
Allowlist: A list of what is allowed. Anything not on it is refused.
AML: Anti-money-laundering: rules that make banks check customers and watch for criminal money.
amr: A claim in a token that lists which login methods were used, such as a passkey or a password.
API: Application Programming Interface: a list of requests one program lets another program make. It works like a menu, and the answer is data.
API gateway: The front door for your APIs. Every call passes it, and it checks tokens, scopes, rate limits and message shape.
API key: A long secret code an app sends with each API request to show who is calling. Keep it secret.
API server: The front door of Kubernetes. Every request goes to it to be authenticated and authorized.
Append-only: A log you may only add to. You never edit or delete entries that are already there.
Approval fatigue: When people must approve too many harmless things, they click yes without reading. Then the one dangerous request slips through.
Argon2: A password-hashing method made to be slow on purpose. It makes guessing passwords cost a thief a lot of time and memory.
Artificial intelligence: The broad field of getting computers to do tasks that seem to need intelligence. It ranges from hand-written rules to machine learning.
AS-REP roasting: An attack on accounts that have Kerberos pre-authentication turned off. The attacker guesses their password offline.
Assertion: A signed message from an IdP that says who the user is and how they signed in. SAML calls it an assertion.
Assume: To take on a role for a short time. The cloud checks the trust rules, then hands back temporary credentials for that role.
Assurance level: A score for how sure we are about a proof. NIST SP 800-63 defines IAL (identity), AAL (login) and FAL (federation). A higher number means stronger proof.
Assurance level (IAL/AAL/FAL): Trust scores from NIST SP 800-63. IAL is for identity proofing, AAL for the login, and FAL for a login passed between organizations.
Asymmetric encryption: Encryption with a pair of keys: a public key you can share and a private key you keep. What one locks, the matching one opens.
At-least-once: A delivery promise: a message arrives one time or more, never zero. The same one can arrive twice, so the receiver must cope.
Attention (LLM): The step inside a model where each token looks back at earlier tokens and weighs which ones matter. Longer text means more to look back at, so it is slower.
Attestation: A check that proves what a program really is (right code, right place) before it gets an identity.
Attribute: A fact used in an access rule, such as department, device, time or how sensitive a file is.
Audience: The API that a token is meant for. The aud claim holds its name. An API must refuse a token meant for another service.
Audit trail: A record of who did what and when, kept so it can be checked later.
Auditor: A person who checks that your rules are followed. They ask for proof, such as logs and reports.
Augmented LLM: A language model given retrieval, tools and memory: the basic building block of AI workflows and agents.
auth_time: A claim with the time when the user last signed in, with a person present. A refresh does not change it.
Authentication: Proving who you are, for example with a password, a fingerprint or a passkey. Also called AuthN.
Authentication context: The facts about how and when a user proved who they are, carried in the token. They are the method, the strength and the time.
Authenticator app: A phone app that shows a code which changes every 30 seconds. You type the code as your second factor.
AuthN / AuthZ: Authentication ("who are you?") and authorization ("what may you do?").
Authority amplification: Permissions that grow at each hop of a delegation chain. In the end an agent can do more than the user ever allowed.
Authorization: Deciding what a known person or program may do. Also called AuthZ.
Authorization code: A short-lived, one-time code that the browser carries back to the app. The app swaps it for real tokens on the back channel.
Authorization header: The standard HTTP header that carries credentials, for example Authorization: Bearer <token>. Keep credentials here, not in URLs, and hide it in logs.
Authorization model: In OpenFGA, the list of object types, their relations and how relations imply each other. It is the grammar for tuples.
Authorization server: The server that gives out tokens after it checks who you are and what you may do.
Auto-linking: Joining a new sign-in to an existing account without asking for proof, for example because the emails match. It is unsafe without checks.
Automation bias: Trusting an automated system's suggestions too much. You follow a wrong one, or you miss a problem it did not flag.
Autoregressive: Writing output one token at a time, where each token depends on all the ones before. This is how LLMs write.

B

B2B: Business-to-business: one company dealing with another, such as a partner company and its staff.
B2C / B2B / B2E: Business-to-consumer (customers) / business-to-business (partners) / business-to-employee (staff).
Back-channel: Messages sent directly from one server to another, without the browser. This is more reliable and harder to tamper with.
Backend: The part of an app that runs on a server, out of the user's sight. It keeps secrets that the browser must never see.
Backend-for-frontend: A small server beside a web app that holds its tokens. The browser never sees them and keeps only a session cookie.
Base64: A way to write any data as plain letters and numbers so it can travel safely. Anyone can undo it, so it is not secret.
Batch API: Sending many model requests at once and collecting the results later, within about a day. It costs roughly half price.
Batch job: Work done in one big group at a set time, such as every night.
bcrypt: A password-hashing method that is slow on purpose, so guessing passwords takes a thief a long time.
Bearer token: A token that works for whoever holds it, like cash (RFC 6750). Keep it short-lived and out of URLs and logs.
Big-bang cutover: Moving all users to the new system at the same moment. Faster, but every bug hits every user together.
Binding message: A short, readable text about one deal, such as BUY-4821 · $25. It is shown on both screens so the person approves exactly that deal.
Biometrics: Your body as proof: fingerprint, face or voice. A liveness check stops photos and fakes.
Birthright access: Access you get automatically by policy, just for who you are or the job you have.
Blast radius: How much damage one break-in, or one key leak, can reach. Good design keeps it small.
BM25: The classic keyword ranking. It scores a text by how often the query's words appear and how rare they are. It is cheap, but it does not know synonyms.
BOLA: Broken object level authorization: the API checks the token but not who owns the object. Changing an ID then shows another person's data.
Bot: A program that does a job on its own. A login bot types sign-in tries much faster than a person can.
Bot detection: Software that spots automated visitors by their speed, tools and network address, and then challenges or blocks them.
Botnet: A large group of hacked computers that an attacker controls together. For example, it can be used to try stolen passwords.
Bound service account token: A signed Kubernetes token that expires and is tied to one pod and one audience. If the pod is deleted, the API server rejects the token (the Kubernetes lesson).
Bound token: A ServiceAccount token tied to one pod and one audience. It expires, and it stops working soon after the pod is deleted.
Branch: In git, a separate line of commits where you can try changes safely. You can merge it back or throw it away.
Breach dump: A file of stolen passwords or other data, leaked or sold after a company is hacked.
Break-glass account: A sealed emergency admin account for when normal sign-in is down. Any use sets off an alarm.
Bridge model: A mix of pool and silo. The app and some tables are shared. Sensitive data is split out per tenant.
Browser: The program on your device that fetches web pages and shows them to you. Chrome, Firefox and Safari are browsers.
Brute force: Trying guess after guess, very fast, until one works.
Bucket: A named container in cloud storage that holds files, called objects. Policies decide who may read or write them.
BYOD: Bring your own device: personal phones and laptops used for work. Companies often manage only the work app and its data, or allow browser-only access.

C

Cache: A short-term memory of an earlier answer, kept to save time. It can be out of date.
Cache-Control: A header that tells browsers and proxies whether they may keep a copy of a reply, and for how long.
CAEP: Continuous Access Evaluation Profile: standard event words, like "session revoked", that security systems send each other (OpenID).
Canary release: Sending a new version to a small share of traffic first. You compare its results with the current version, then roll it out to everyone or roll it back.
Canonical request: A strictly formatted summary of an HTTP request: method, path, sorted query, chosen headers and a hash of the body. Sender and receiver both build it, so they sign the same bytes.
CAPTCHA: A small test that a person can pass and a script cannot, such as picking pictures. It is used to stop bots.
Cash-out: The step where an attacker turns a stolen account into money. For example, they spend stored value, move points or change a payout address.
CCPA / CPRA: California's consumer-privacy laws: rights to know, delete and opt out.
Certificate: A signed statement that links a public key to a name, issued by a certificate authority. It is public. Only the matching private key proves anything.
Certificate authority: An organization or system that issues certificates by signing them. A root CA is self-signed and sits in trust stores. An intermediate CA, signed by a root, issues everyday certificates.
Certificate Transparency: Public logs of issued TLS certificates. Entries can only be added. Browsers require proof of logging. A wrongly issued certificate for your domain becomes visible, but is not blocked.
Challenge: A random one-time value that a site sends so your device can sign it. A new challenge each time means an old signature is useless.
Challenge-response: A way to prove a secret without sending it. The server sends a random challenge, and the client sends back a calculated answer.
Chat assistant: An app you talk to in everyday language, built around an AI model. The app adds chat history, file reading, web search, voice and memory.
Check: The yes-or-no question a relationship engine answers: "Can this subject do this to that object?"
Chunking: Splitting documents into the pieces a retrieval system stores and returns. Search can only return whole chunks, so where you cut decides what can be found.
CI: Continuous integration: a system that builds and tests code automatically, and often deploys it. A pipeline is one run of its steps.
CIAM: Customer identity and access management: sign-up and login for a company's customers.
CIAM / EIAM: Customer IAM (for customers) and enterprise IAM (for a company's staff). These are the two big groups an identity provider serves.
CIBA / decoupled auth: Client-Initiated Backchannel Authentication: you approve on a different device from the one that made the request.
CIEM: Cloud Infrastructure Entitlement Management: tools that find unused and risky permissions across cloud accounts and suggest cuts.
Claim: One fact inside a token, such as who it is about (sub) or when it expires (exp).
Claims / scopes: Facts inside a token / permissions it gives.
Clean source principle: Everything a system depends on for security must be at least as trustworthy as the system. So whatever manages Tier 0 is Tier 0.
Client: The program that asks for something. A browser is a client when it asks a server for a web page.
Client assertion: A short signed message that a client sends to prove who it is, instead of a secret. RFC 7523 defines it.
Client credentials: An OAuth way for a program to get a token for itself, with no user. It signs in with its own secret or key.
Client ID: The public name of an app at the identity provider. An ID token names it in aud.
Client ID Metadata Document: A JSON file at an HTTPS address. That address is the app's client_id. The server fetches the file to learn who the app is.
Client secret: A password that an app uses to prove itself to the token server. Keep it out of code and logs.
Closed-loop remediation: Every finding gets a fix that is checked and closed. An example is an automatic disable or a ticket that must be closed.
Cloud account: A separate area of a cloud with its own resources, credentials and bills. Some clouds call it a project or subscription.
Cloud agent: A coding agent that runs on a vendor's hosted machine. It is also called a background agent. It works on a copy of your repository and hands back a pull request.
CNCF: Cloud Native Computing Foundation: a non-profit that hosts open-source cloud projects, such as Kubernetes.
Code execution: An assistant feature where the model writes a small program and a sandbox runs it on your data. Numbers are calculated, not guessed. The code can still answer the wrong question, so read the method.
Code verifier: The secret that goes with a PKCE code_challenge. The app keeps it and shows it only when it swaps the code for tokens.
Coding agent: An AI model working in a loop with tools to read, edit and run code in a project. It does more than suggest text. It can run in a terminal, an editor or the cloud.
Commit: In git, a saved snapshot of a project with a message describing the change. You can always return to it.
Compaction: Summarizing a long conversation so work can continue in a fresh context window. Some detail is lost.
Composition rules: Rules that force certain character types in a password, such as one capital, one digit and one symbol.
Computed relation: A relation that follows from a stronger one. Owner implies editor, and editor implies viewer, so you store only the owner.
Computer use: Letting a model operate a screen. The app sends screenshots, and the model replies with clicks and keystrokes. It is slow and risky. Use an isolated machine and human confirmation.
Condition: An extra test in a policy that must be true before access is allowed. An example is a matching external ID or repo name.
Conditional access: If-then access rules checked at sign-in. User, device, place, app and risk decide: allow, ask for more, limit or block.
Confidence score: A number for how sure the system is that a sign-in really comes from the owner. Low confidence triggers a challenge.
Confidential client: An app that runs on a server and can keep a secret safe. A single-page app cannot.
Confused deputy: Tricking a more powerful service into using its power for you. A condition such as an external ID stops it.
Consent: The user's clear yes to a request for access, given on a consent screen.
Consent (privacy law): A person freely agreeing to the use of their data for one stated purpose. You must be able to prove it, and the person can withdraw it.
Consent phishing: Tricking a user into clicking Allow for a harmful app. The app gets access, and no password is stolen. Also called an illicit consent grant.
Consent receipt: Auditable record of what a person agreed to, per purpose.
Consent screen: The page that shows what an app asks to do and lets the user allow or deny it.
Consent theater: An approval screen that looks careful but hides what you really approve. The real action is wider than the screen shows.
Constant-time comparison: Comparing two values in the same time, whatever matches. It stops an attacker from guessing a tag one piece at a time.
Containers: Packaged apps that run in isolation with everything they need. Many containers can share one machine.
Content Credentials (C2PA): A signed record attached to a file. It says what made the file and which edits followed. It shows where a file came from, not that it is true. A missing one proves little, because it is often stripped.
Content Security Policy: A response header (CSP) that tells the browser which sources a page may load content from. It is a strong backstop against XSS, but not a fix.
Context: The signals around a request: who is asking, on what device, from where and when. Also how risky the request looks.
Context engineering: Choosing what goes into a model's context window, and in what order. The goal is the smallest set of relevant text that gets the result you want.
Context window: Everything a model can see in one request, input and output together, measured in tokens. It is the model's entire working memory.
Context-based access policy: Allow / step-up / deny decided from who, what, where, when and risk.
Contextual tuple: A fact sent with one access check and never stored. An example is "this request comes from the office network".
Continuous access evaluation: Judging a live session again whenever the context changes, not only at login.
Cookie: A small note a website stores in your browser. The browser sends it back with every request, so the site can recognize you.
Cooling-off period: A short delay before a sensitive change, like account recovery, takes effect. It gives the real owner time to notice and stop it.
Cooling-off window: A short pause between a request to delete and the real deletion. The request can still be canceled during it.
Copilot: An AI assistant that works beside a person, inside an app. It reads their data and can act for them.
Copyright: The right an author gets automatically over original creative work, such as text, images, music and code. It covers the work, not ideas or facts. In the US it needs a human author.
Correlation ID: A shared tag linking one event's trail across many systems' logs.
CORS: Cross-origin resource sharing: a way for a server to tell browsers that chosen other sites may read its replies. It works only in browsers.
Cosine similarity: How closely two embeddings point the same way. 1 means the same meaning, 0 means unrelated and -1 means opposite.
Counterfactual test: A bias check that changes one detail that should not matter, such as a name. Everything else stays the same. If the result changes, the system uses that detail. Also called a swap test.
Credential: Something you show to prove it is you: a password, a passkey, a code or a fingerprint. Keep it secret.
Credential Guard: A Windows feature that keeps stored sign-in secrets in a protected area. Attackers on the machine cannot take them.
Credential issuer: The party that knows a fact about you and signs it into a verifiable credential. Examples are a government, bank or university.
Credential stuffing: Replaying username-and-password pairs leaked from other sites against yours, betting on password reuse. Stopped by breached-password checks, unique passwords and MFA.
CRL: Certificate revocation list: a signed list of revoked certificate serial numbers. The CA publishes it and clients download it. Public CAs have had to publish one since March 2024.
Cross-origin resource sharing (CORS): The standard way a server lets specific other origins read its responses in a browser. It works only in browsers. It is not authentication.
Cross-tenant access: One customer reaching another customer's data in a shared system. It is BOLA across the tenant line.
Crypto-shredding: Deleting data for good by destroying the key that locks it. Without the key, the leftover bytes cannot be read.
Cryptoperiod: The planned time during which a key is used for new work. After that, the key is retired or rotated.
CSRF: Cross-site request forgery: a fake page makes your browser send a request to a site where you are signed in.
CSV: Comma-separated values: a table saved as plain text, one row per line, with commas between the columns.
CTAP: Client to Authenticator Protocol: how a browser talks to a security key or a phone. It is the second half of FIDO2.
Customer IdP: The identity provider for a company's customers.
Cutover: The moment live traffic switches from the old system to the new one.

D

Dark pattern: A screen design that tricks or pushes people into a choice. Examples are a pre-ticked box or a hidden decline button.
Data minimization: Collecting and keeping only the data you really need, and deleting it when you no longer need it.
DBSC: Device Bound Session Credentials: a browser feature that ties a session to a key in the device. A stolen cookie then fails elsewhere.
Decision log: A record of every allow or deny that a policy engine gave. It shows who asked, about what, and the answer.
Decision model: A fast model that answers typed questions (choice, yes/no, score) in one pass. It returns probabilities over set options, not free text.
Decoding: Turning a token's text back into readable parts. Anyone can do it, and it proves nothing about the token.
Deep learning: Machine learning with large neural networks that have many layers. It powers speech-to-text, translation and generative AI.
Deep research: An assistant mode where an AI agent plans a task, runs many searches and reads dozens of pages. It writes a long, cited report. You still need to check the key claims.
Deepfake: Video, audio or an image made or changed with AI. It shows a real person saying or doing something they never did.
Defense in depth: Using several layers of protection, so that when one layer fails, the next one still holds.
Delegated administration: A partner manages its own users, inside limits we set.
Delegation: Acting for someone and saying so. The token shows both the person and the helper, so the record stays honest.
Delegation chain: A request that passes through several agents, each acting for the one before. The user stays named at every hop.
Delimiter: A clear marker around a piece of data in a prompt, such as <ticket>...</ticket> tags. It helps the model tell data from instructions. It is not a security boundary. Injection can still get through.
Denial of service: An attack that makes a service or an account unusable for the people who need it.
Denial of wallet: Running up a pay-per-use AI or cloud bill until the cost itself becomes the outage. An attacker or a runaway loop can cause it. Usage and step limits help stop it.
Deny-list / revocation marker: The "banned wristbands" list that APIs check. It makes them refuse tokens that were cancelled but have not expired.
Dependency: Someone else's code package that your project pulls in and runs. A package manager such as pip or npm installs it from a registry.
Deprovisioning: Removing accounts and access when they are no longer needed.
Detection engineering: Writing and tuning rules that turn logs into alerts for real attacks, with as few false alarms as possible.
Detective control: A control that finds a problem after it has happened, such as a scan for risky pairs of rights.
Device compliance: Whether a managed device meets company rules: updated, encrypted, screen-locked, protected and not jailbroken. The result goes to the identity provider.
Device fingerprint: A set of traits of a browser and device, such as its settings and version. Sites use it to spot a known device or a bot.
Device flow: The OAuth way (RFC 8628) to sign in a gadget with no keyboard. The gadget shows a code, and you approve it on your phone.
Diff: The line-by-line difference between two versions of a file. Lines starting with - were removed. Lines starting with + were added.
Diffusion model: A generative model that learned to remove noise from images step by step. To make an image, it starts from random noise and cleans it up, guided by the text prompt.
Digital signature: A seal made with a private key. Anyone with the public key can check who made it and that nothing was changed.
Digital wallet: An app on your phone that holds your verifiable credentials and shows them only when you agree.
Directory: The address book of an organization: a list of people, devices and their details.
Directory / LDAP: The address book of an organization / the old standard for asking it questions.
Directory Information Tree (DIT): The tree an LDAP directory stores its entries in. Every entry is a node named by its distinguished name.
Directory virtualization: One live "lens" over many identity stores, without moving data.
Discovery document: A JSON file at /.well-known/openid-configuration. It lists a login service's addresses, its issuer and where its keys are.
Disposable email: A throwaway inbox from a temporary-mail service. It disappears after minutes, so it is often used for fake signups.
Distillation: Training a small "student" model to copy a large "teacher" model. A cheaper model can then do one job nearly as well.
Distinguished name (DN): The full, unique name of an LDAP entry. It is the path from the entry up to the root, with one piece per level.
Distribution group: An AD group that is only an email list. It cannot grant access.
DNS: Domain Name System: the internet phone book. It turns a name like travel.example into the number of the computer that runs it.
Domain: The name of a website, like travel.example. It tells you whose computer you are talking to.
Domain controller (DC): A Windows server that runs the Active Directory copy for a domain and answers sign-in requests.
Dormant account: An account that nobody has used for a long time. It still holds data. Old passwords and old phone numbers make it an easy target.
Double opt-in: A person signs up, then must confirm by email or code. Only then is the account active or any marketing sent.
DPDP Act: India's Digital Personal Data Protection Act, 2023. The DPDP Rules 2025 bring its duties into force in steps from November 2025.
DPoP: Demonstrating Proof-of-Possession (RFC 9449). The client signs each request with a key, and the token is tied to that key.
DPoP / sender-constrained token: Ties a token to the holder's key (DPoP, RFC 9449) or certificate (mTLS). A stolen copy does not work without it.
DSAR: Data subject access request. A person asks what data a company holds on them, or asks to fix or erase it.
Dual control: Two different people must agree before a risky action runs. Also called four eyes.
Durable execution: Saving an agent's or workflow's progress at checkpoints. A run that crashes or pauses for approval then continues where it stopped, without repeating actions.
Dwell time: How long an attacker stays inside before anyone notices.
Dynamic Client Registration: An app registers itself with an authorization server while it runs (RFC 7591). MCP now calls this deprecated.
Dynamic secret: A secret made on demand for one workload that expires in minutes. Nothing long-lived is left to steal.

E–G

.env file: A plain text file of NAME=value lines that holds settings and secrets such as API keys. The app or a tool must load it. Keep it in .gitignore so it is never committed.
East-west traffic: Calls between services inside your system, such as the booking service calling the pricing service.
Edge: The outer front of your system, such as the API gateway. Outside requests arrive here and are checked first.
Effort level: A setting (low, medium, high) for how much a reasoning model thinks before it answers. More thinking is better on hard tasks, but slower and costs more tokens.
Egress: Traffic going out of a system. Egress limits let an agent talk only to approved places.
eIDAS 2.0 / EUDI wallet: The EU's rules for trusted digital identity. Each member state must offer citizens a wallet, the EUDI wallet. Dates vary by country.
eKYC: Electronic identity proofing: ID document, selfie, liveness check and official records.
Email OTP: A one-time code sent by email. You type it in to sign in, instead of clicking a link.
email_verified: An ID token claim. It says whether the provider checked that the person controls that email address. Do not link accounts without it.
Embedding: A list of numbers that places a piece of text in a "meaning space". Texts about similar things land close together.
Encoding: Changing data into another shape so it can travel, like Base64. It is not a secret, and anyone can undo it.
Encryption: Scrambling data with a key so only someone with the right key can read it. Without the key, it is useless nonsense.
Endpoint: One item on an API menu: a path you can send a request to, like GET /flights.
Enrollment ticket: A one-time link, often a QR code, that ties a phone to a user's account and starts the key setup.
Enterprise SSO: A company login that lets its staff sign in to many apps with their own corporate identity provider.
Entitlement creep: Access that piles up as people change jobs and projects, and never gets removed. It is the same idea as privilege creep.
Entity ID: In SAML, the unique name of a party, usually a URL. It plays the role that the issuer plays in OIDC.
Envelope encryption: Lock the data with a fresh data key. Then lock that key with a key-encryption key that never leaves the KMS. Keep the locked data key next to the data.
Environment variable: A named value the operating system hands to each program it starts, such as MODEL_API_KEY. Keeps secrets out of code, but any program you run can read it.
Ephemeral (task-scoped) identity: An identity made for one task and deleted with it, so nothing lasting is left to steal.
Entitlement: One specific permission held in a system. Entitlement management runs the catalog of them.
Escaping: Writing a special character in a safe form. It is then read as plain text, not as part of a command.
EU AI Act: The EU's risk-based AI law. It has banned uses, duties for high-risk systems and transparency rules, phased in from 2025 to 2028.
Eval: A repeatable test for an AI feature. It has fixed cases, expected outcomes, a scoring method and a number to compare between versions.
Evaluator-optimizer: A workflow pattern. One model call writes a draft. Another checks it against clear criteria. The draft is revised in a loop until it passes or a round limit is hit.
Event-driven: Reacting to each change the moment it happens, instead of checking on a timetable.
Excessive agency: OWASP's name (LLM06:2025) for giving an AI agent more functions, permissions or freedom than its task needs. A mistaken or manipulated model can then do real damage.
Excessive data exposure: A flaw where the API reply holds more fields than the client needs, such as a password hash.
Exfiltration: Moving data out to someone who should not have it. Ways include email, a web request, a link or an image that loads by itself.
exp: The claim with the time when a token expires. After that time, an API must refuse the token.
Exponential backoff: A retry method. Wait after a failed call, then about double the wait after each failure, up to a cap. Add random jitter. Retry only errors that can succeed later.
External ID: A unique value a service picks for each customer. The assume-role request must carry it. It is not a password.
Fail-closed: When something breaks, refuse the risky action instead of allowing it. Safe actions, such as reads, may still run.
Failover: Switching to a standby copy when the main system stops working, so users can keep going.
Fair use: A US copyright defense that allows some unlicensed uses, decided case by case. Judges weigh the purpose, the type of work, the amount used and the market effect. It is central to AI training lawsuits.
False positive: An alert for something harmless. Too many of them tire the team out, so real alerts get missed.
FAPI: Financial-grade API: a strict OAuth profile from the OpenID Foundation, used for banking and payments. FAPI 2.0 has been final since February 2025.
Federated token vault: One custodian, run by your IdP, that keeps third-party refresh tokens. Agents ask it for short-lived access tokens and never hold the refresh token.
Federation: Two organizations trust each other's logins by agreement.
Few-shot prompting: Putting a few worked examples of input and ideal output in the prompt, so the model copies the pattern.
FGA: Fine-grained authorization: deciding access for one person and one specific thing, such as this invoice, from stored relationships.
FIDO2: The FIDO Alliance standards for logging in with a key on your device instead of a password. Passkeys use them.
FIDO2 / WebAuthn: The standards (FIDO Alliance and W3C) behind passkeys. They resist phishing.
File path: A file's address. An absolute one starts from the top, like /Users/priya/notes.md. A relative one starts from the current folder, like notes.md or ../notes.md.
Fine-tuning: Training an existing model further on your own examples to change its default behavior. It is good for style and format, but poor for facts.
Fixed window: Counting requests in each clock minute, then resetting to zero. Simple, but bursts at the boundary can double the limit.
Forest: One or more Active Directory domains that share the same rules and settings. It is the real security boundary.
Fork: A personal copy of someone else's code repository. Its owner can run their own pipelines on it.
Forward pass: One trip of the text through all of a model's layers to get the odds for the next token. Reading a prompt takes one pass. Writing takes one pass per new token.
Forward secrecy: A result of one-time keys, as in TLS 1.3. If someone steals the server's long-term private key later, they still cannot read traffic they recorded earlier.
Four-fifths rule: A US hiring rule of thumb. A group's selection rate below 80% of the highest group's rate may show unfair impact. It is a warning line, not a verdict.
Friction: Anything that slows a customer down, like an extra form field or step. More friction means fewer people finish signup.
Front-channel: Messages that travel through the user's browser, by redirects or hidden frames. The user's browser carries them.
GDPR: The EU's General Data Protection Regulation. Personal data needs a lawful reason and protection, and can be deleted on request.
Generative AI: AI that creates new content, such as text, images, audio, video or code. It does more than give a label or a score.
Git: A free version-control tool. It records snapshots (commits) of a project folder, so you can see what changed and go back.
Git worktree: An extra working folder for the same git repository, with its own branch. It shares history but not untracked files such as .env. One per agent keeps parallel agents apart.
Golden customer record: One cleaned-up profile of a customer that all systems agree on.
Golden set: The fixed collection of real test cases, with expected outcomes, that an eval runs against.
Golden ticket: A forged Kerberos TGT made with a stolen krbtgt key. It gives the attacker control of the whole domain.
Graceful degradation: When one part fails, the rest keeps working in a reduced way, instead of everything stopping.
Granular consent: Asking for a separate yes or no for each purpose, such as marketing or analytics. It is not one big "Accept all".
Granularity: How big or small each permission is. Fine-grained permissions are small and precise. Coarse ones are big.
Graph: Data drawn as dots (people, things) joined by lines (relationships). Good for spotting links.
GraphQL: A way to ask an API for exactly the fields you want, in one request. It needs limits on depth and cost.
Greedy decoding: Always picking the single most likely next token. The result is repeatable but flat.
Groundedness check: An output check that every claim in an answer is supported by the retrieved sources.
Grounding: Tying an AI answer to sources you supply. The model should stay within them, quote them and say when the answer is not there.
Group Managed Service Accounts (gMSA): Windows service accounts whose long random passwords the domain makes and changes by itself, every 30 days by default. No weak human password is left to guess.
Group Policy: Active Directory settings that are pushed to many computers and users at once.
Guardrails: Safety checks around AI agents: screening for injections, hiding personal data and limiting what goes out.

H–I

Hallucination: Confident-sounding AI output that is false or unsupported, such as an invented fact, quote or citation.
Handshake: The first messages of a TLS connection. They agree on keys and check the server's identity before any data flows.
Hard swap: Rotating by switching off the old secret and switching on the new one at the same moment. Services that still hold the old value fail.
Hash: The short, fixed-size fingerprint that hashing makes from some data. You cannot turn it back into the original.
Hash chain: A log where each entry includes the hash of the entry before it. Changing an old entry breaks every later one.
Hashing: Turning data into a short fingerprint in one direction only. The same input gives the same fingerprint, and you cannot go back.
Header: An extra note sent with a request or a response, like the notes on the outside of an envelope.
Headless browser: A web browser that runs without a screen. Scripts use it to act like a person on a website.
Headless mode: Running a coding agent from a script or CI pipeline. One prompt goes in and a result comes out. Nobody approves actions, so set its allowed tools in advance.
Health check: A small test that runs again and again. It asks a system, "Are you working?" Traffic can then move away from a broken one.
Help desk: The team that people call when they cannot sign in. Attackers phone it and pretend to be the user.
HITL: Human-in-the-loop: a person approves before a machine does something risky.
HMAC: Hash-based message authentication code. A short tag made from a shared secret and a message. Anyone with the secret can check it. Any change to the message breaks it.
Holder: The person who keeps verifiable credentials in a wallet and chooses what to show to whom.
Home-realm discovery: Finding the right IdP for a user from the domain in their email. The user never picks from a menu.
Hosted login page: A sign-in page that the identity provider runs for you. Your app sends users there and gets them back signed in.
HSM: Hardware Security Module: a tamper-proof device that keeps cryptographic keys safe.
HTTP: HyperText Transfer Protocol: the ask-and-answer language that browsers and servers use to talk. HTTPS is the private version.
HTTP 403 Forbidden: The status code for "I know who you are, but you may not do this".
HTTP 429 Too Many Requests: The status code for a caller who sent too many requests. It should carry a Retry-After header. Unlike 403, it means "try again later".
HTTP Basic authentication: An HTTP scheme that sends username:password, Base64-encoded, on every request (RFC 7617). Base64 is not encryption, so use Basic only inside TLS.
HTTP Message Signatures: RFC 9421: a standard way to sign chosen parts of an HTTP message. It uses a shared secret (HMAC) or a private key. The checker must still test for replays.
HttpOnly: A cookie flag. It stops JavaScript from reading the cookie, so a script attack cannot steal it.
HTTPS: The private version of HTTP. The "s" stands for secure. Your connection to the site is scrambled so others cannot read it.
Human authorship: The US rule that only works made by a human can be copyrighted. AI output alone is not protected. A person's own contributions, selection and edits can be.
Human principal: A person who signs in to a cloud, for example to the console. Compare with a workload principal.
Human-in-the-loop: A person must approve an action before it happens. The machine proposes and the person decides.
Hybrid search: Running keyword search and vector search together and merging their ranked results. Both exact terms and meaning then count.
IaC: Infrastructure-as-code: all configuration written as scripts and kept under version control.
IAL: Identity assurance level: how strongly someone was identity-proofed when they signed up. NIST defines IAL1 to IAL3.
IAM: Identity and access management: the whole field of who people are and what they may do.
IAM / IGA / PAM: Identity and access management (the field). / Identity governance (who has what, and why). / Privileged access management (the most powerful accounts).
iat: Issued-at: the claim with the time when a token was made. APIs compare it with a cut-off or a freshness window.
ID token: A token that says who just signed in. It is for the app, not for calling APIs.
Idempotency key: A unique id that a client sends with a request. If the same id comes again, the server returns the first result and does nothing twice.
Idempotent: Safe to repeat. Doing the same request twice gives the same result as doing it once, with no duplicate.
Identifier: A label that points at one person or thing, such as an email address or an employee ID. It names you but does not prove it is you.
Identity: A digital record that stands for a person or a thing, such as Maya as our systems know her.
Identity 360: One live view of a person's identity across every system.
Identity drift: Over time, an app's accounts stop matching the official directory. Missed events and manual changes cause it.
Identity fabric: A layer that connects all your identity systems into one view, one policy and one audit trail.
Identity platform: A ready-made product that handles sign-in, accounts, MFA and tokens for your apps. It can be managed for you or run by you.
Identity proofing: Checking that the real person behind an account is who they claim to be. Banks call it KYC.
Identity-based policy: A policy attached to a principal or role. It says what that identity may do.
Idle timeout: A session ends after a set time with no activity. This shortens the time a stolen session works.
IDOR: Insecure direct object reference: an older name for BOLA, where changing an ID in a request shows someone else's data.
IdP: Identity provider: the system that checks who you are and issues tokens.
IDV: Identity verification: proving that a real person is who they claim to be. An example is an ID document and a selfie.
Iframe: A web page inside another web page. A hidden one can load another site's address in the background.
IGA: Identity governance and administration: tracking who has what access, who approved it and whether it is still right.
Illicit consent grant: Another name for consent phishing: the user is tricked into giving a rogue app access to their data.
Impersonation: Acting as someone else, so nobody can tell you apart. This is forbidden for agents. On-behalf-of is the safe way.
Implicit grant: An old OAuth flow that returned tokens in the browser address bar. They leak easily. RFC 9700 says not to use it.
Impossible travel: Logins from two places too far apart for one person to have traveled between them in that time.
Improper output handling: OWASP's name (LLM05:2025) for passing model output to a browser, database or shell without checking it. Text an attacker steered then becomes script, queries or commands.
Inbound provisioning: Another system pushes accounts into your app before anyone signs in. The app does not wait for a first login.
Incident: A real problem that harms a system or threatens to, such as an outage or a breach. A team handles it with a set plan.
Incremental consent: Asking for the minimum access at first, and asking for more only when a feature really needs it.
Indirect prompt injection: Orders hidden in content an AI reads for you, such as a web page, email or document. They are not typed into the chat.
Infostealer: Malware that copies saved passwords, cookies and other secrets from a computer and sends them to the attacker.
Inherited relation: A relation passed from one object to another, such as a folder's viewers also being viewers of the files inside.
Inpainting: Editing just a marked area of an image. The model redraws only inside the mask and blends it with the rest. Outpainting extends an image past its edges.
Input guardrail: A check that runs before the model sees a message. It can block attacks, hide personal data and limit the topic or the length.
Input tokens: Everything sent to the model in a request: system prompt, history, files and your message. It is billed at the input price.
InResponseTo: A SAML field in the reply that holds the ID of the request it answers. It lets the SP match the reply to its own request.
Instance metadata service: A special address inside a cloud virtual machine (169.254.169.254). It describes the machine and often hands out temporary credentials. It is a favorite SSRF target, so use its strictest mode.
Instruction file: A plain-text file such as AGENTS.md that an AI tool loads into every session as standing house rules.
Introspection: Asking the issuer if a token is still valid (RFC 7662). The reply says active true or false, plus a few facts.
Invitation: A one-time link that adds a person to an organization with a set role. It is tied to an org, a role and an email.
IP address: The number that identifies a computer on the internet, like 203.0.113.7.
IP indemnity: A provider's written promise to defend a customer and pay the costs if the output leads to an IP claim. It is usually limited to paid plans.
ISF: Identity Security Fabric: the layer that connects identity and security tools (the personas lesson).
ISO 27001 / SOC 2: Audited security certificates: ISO 27001 for the security management system, SOC 2 for operating controls.
ISO/IEC 42001: The international standard for an AI management system (published December 2023). Unlike the NIST AI RMF, organizations can be certified against it by accredited auditors.
ISPM: Identity security posture management: the hygiene inspector that finds risky settings before attackers do.
Issuer: The system that made and signed a token. The iss claim holds its name. An API accepts only the issuer it expects.
ITDR: Identity threat detection and response: the burglar alarm that spots identity attacks as they happen.

J–L

Jagged frontier: The uneven, invisible edge between tasks AI does well and tasks it quietly fails. Both can look equally hard to a person (Dell'Acqua et al., 2023).
Jailbreak: Talking an AI model into ignoring its own safety rules.
JAR: JWT-Secured Authorization Request (RFC 9101): the whole OAuth request packed in a signed JWT. Nobody can change it unseen.
JIT elevation: Just-in-time elevation: you get admin rights only when you ask and are approved, and only for a short time.
JIT provisioning: Just-in-time provisioning: making an account the first time it is needed, usually at the first login, not in advance.
Jitter: A small random wait added to retries, so many clients do not all retry at the same moment.
JML: Joiner, mover, leaver: the life of someone's access, from first day to last.
JSON: JavaScript Object Notation: a simple text format for data. It has "key": value pairs in curly braces and lists in square brackets.
JSON Schema: A standard way to describe what valid JSON looks like. It is used to define and check tool inputs and structured outputs.
jti: A claim with a unique ID for a token or a proof. APIs remember it so that they can refuse a second use.
Jump server: A server that admins sign in to first, so they can reach other servers from there.
JWE: JSON Web Encryption: an encrypted token. It hides the claims from the holder, but it does not stop someone from replaying it.
JWKS: JSON Web Key Set: a web page where an issuer publishes its public keys, so APIs can check its tokens.
JWT: JSON Web Token (say "jot"): a signed token with three parts joined by dots: header, payload and signature.
k-anonymity: A way to check a password against breach lists. You send only the first few letters of its fingerprint, never the password.
Kerberoasting: An attack where a user asks for a service ticket and guesses the service account's password offline.
Kerberos: The ticket-based sign-in protocol behind Windows-domain single sign-on. Your password proves you once to a central KDC. Short-lived tickets do the rest.
Key: A secret value used to lock or unlock data. Without the right key, scrambled data cannot be read.
Key Distribution Center (KDC): The trusted Kerberos authority, on every Active Directory domain controller. It issues TGTs and service tickets.
Key pair: Two linked keys: a public key you share and a private key you keep. What one locks, the other opens.
Key rotation: Replacing a signing key with a new one on a schedule. Old and new keys overlap, so nothing breaks.
kid: Key ID: a header value that tells the API which key in the JWKS made the signature.
Kill switch: One trigger that cuts an identity's access everywhere at once, and proves it worked.
KMS: Key management service. It makes and keeps keys inside itself. It signs, decrypts or wraps on request, checks a policy and logs every use. It never gives out the key.
Knowledge cutoff: The date a model's training data ends. It knows nothing later unless fresh information comes with the question.
krbtgt: The KDC's own account. Its key protects every TGT. Whoever steals it can forge tickets for any account, so after a leak its password is reset twice.
Kubelet: The agent on each Kubernetes node. It starts pods and asks the API server for their tokens.
Kubernetes: Open-source software that runs containers on many machines and keeps them running. A group of machines it controls is a cluster.
Kubernetes ServiceAccount: A Kubernetes object that gives the software in a pod its identity, with a username like system:serviceaccount:<namespace>:<name>. Humans are not stored in Kubernetes at all.
KV cache: Notes a model keeps on every token it has already processed, so it does not redo the work. Prompt caching keeps these notes between requests with the same start.
KYC: Know Your Customer: checking who a customer really is, as banks must do.
KYC / KYP / KYE: Know Your Customer, Partner or Employee: checking who each kind of person really is.
KYE: Know Your Employee: checking who a new hire really is, plus background checks.
KYP: Know Your Partner: checking a partner company and the people who work for it.
Large language model: LLM: a program trained on huge amounts of text to predict the next piece of text. It is the engine inside chat assistants.
Lateral reading: Judging a source by leaving it and checking what other, independent sources say about it. Professional fact-checkers use this habit.
Lazy migration: Moving users at their first login. The new system checks the password with the old system, then saves its own hash.
Lazy provisioning: Syncing access only when the user logs in. It gives no day-one access, no retries and no attribute sync. JML automation replaces it.
LDAP: Lightweight Directory Access Protocol: an old, widely used standard for looking things up in a directory.
LDAP bind: The LDAP step that says "prove who you are on this connection". A simple bind sends a DN and a password.
LDAP filter: The rule in an LDAP search that says which entries match, such as (uid=priya). Parentheses wrap each part.
LDAP injection: Pasting untrusted input into an LDAP filter so a crafted value changes the query. A typed * can turn an exact lookup into "match everyone". Escaping prevents it.
LDAPS: LDAP wrapped in TLS, so the traffic is private. It normally uses port 636.
Leaky bucket: A rate-limit method. Requests join a queue and leave at a fixed speed. If the queue is full, new ones are dropped.
Learning mode: A new control that only watches at first and does not block. You can test it before turning it on.
Least privilege: Give only the access that is needed, and only for as long as it is needed.
Leeway: A few seconds of grace after a refresh. The old token may be sent once more, in case the reply was lost.
Length-extension attack: A trick against a simple hash-with-secret tag. The attacker adds data and still makes a valid tag. HMAC prevents it.
Lethal trifecta: Private data, untrusted content and a way to send data out, all in one AI session. This mix lets prompt injection steal data (Simon Willison, 2025). Remove any one and the leak stops.
Liar's dividend: The benefit liars get once fakes are common. They can dismiss real recordings as "deepfakes".
Library drift: An agent or server runs an old copy of the shared governance library. It lacks a control that was added later.
Link scanner: Security software that opens every link in your email to check it. It can use up a single-use link before you click.
Linter: A tool that scans code for suspicious patterns, such as unused variables, without running it. Examples are ESLint and Ruff. It cannot tell if the logic does what you meant.
Liveness: A check that a face or fingerprint comes from a live person, not a photo or a deepfake.
LLM-as-judge: Using a model to grade another model's answers against a rubric. It scales well, but it favors long answers, one position and its own model family.
LoA: Level of assurance: another name for the assurance scores, often carried as a token claim.
Local logout: The app ends only its own session and cookie. The IdP session stays alive, so single sign-on can sign the user straight back in.
localStorage: A box in the browser where a site saves data. Any script running on that page can read it.
Lock-in: How hard it would be to leave a tool or vendor. Measure it before you depend on it.
Lockfile: A file that pins the exact version of every dependency, often with a hash. Each install then matches the one you reviewed.
Login hook: Code that the IdP runs during sign-in. It can look up facts, such as a plan, and add them to the token.
Login log: The record of every sign-in try: who, when, from where and whether it worked.
Logit: The raw score a model gives each possible next token before softmax turns the scores into probabilities.
Logout token: A signed JWT that an IdP sends to an app's server to say "end this user's session". It is not an ID token.
Long-term memory: Notes or records stored outside an AI model and loaded into its context later. The model's weights never change.
Look-alike page: A fake page that copies a real site so well that you cannot tell the difference. Its web address is a little different.
LoRA: Low-Rank Adaptation: fine-tuning that freezes the model and trains a small, swappable add-on instead.

M–O

Machine learning: Software that learns patterns from examples instead of following hand-written rules.
Magic link: A sign-in link sent by email. Clicking it logs you in, so the password is replaced by your inbox.
Markdown image exfiltration: A prompt-injection trick. The model is made to write an image link whose address carries private data. The chat window loads the image, and the data leaves.
Mass assignment: A flaw where the API copies every field of a request into a record. A caller can then set fields they should not, such as role.
MCP: Model Context Protocol: an open standard that connects AI agents to tools and data. Each server is a doorway to one system.
MDM: Mobile device management: enrollment that lets a company set up a device and read its state.
Memorization: When a model repeats parts of its training data almost word for word, such as lyrics, code or articles. It is a source of copyright risk.
Memory poisoning: Planting a false or hostile note in an agent's memory. It keeps steering the agent in later chats, after the page or message that carried it is gone.
Merge conflict: What git reports when two branches changed the same lines and it cannot choose. Someone must combine the changes by hand, and the result needs a new review.
Metadata service: A local address on a cloud machine that gives code details and credentials. Pods that reach it may borrow the node's identity.
Metadirectory: An older design: one hub directory that copies and merges identity data between systems.
MFA: Multi-factor authentication: signing in with two or more different kinds of proof.
MFA fatigue: Another name for push fatigue. An attacker sends approval prompts again and again until a tired user taps Approve.
Microservice: One small service that does one job. A big app can be built from many of them that call each other.
Microsoft Entra ID: Microsoft's cloud directory and sign-in service. It was called Azure Active Directory until 2023.
MITRE ATT&CK: A public catalog of how attackers work. Each technique has a number, such as T1110 for brute force.
Mix-up attack: A trick where a hostile authorization server makes an app send a code or token to the hostile server. It was meant for an honest one.
Mixture of experts (MoE): A model design with many small experts in each layer. A router wakes only a few for each token. The model is big in memory but does less work per token.
Model card: A fact sheet about an AI model. It says what the model is for, how it was trained, its known limits and how to use it.
Mule: An account (often a real customer's) used to move criminal money.
Multi-tenancy: Many customers, called tenants, share one running system. Each tenant's data must stay apart from the others.
Mutation testing: Testing your tests. A tool plants small bugs in the code, such as changing > to >=. It reports each one the tests failed to catch.
Mutual authentication: Both sides prove who they are. The client checks the server, and the server checks the client.
Mutual TLS: TLS where both sides show a certificate and check the other. Short for mTLS.
Mutual TLS (mTLS): TLS where both sides show a certificate and prove they hold its private key. It is used between services (RFC 8705 for OAuth).
Namespaces: Named sections of a Kubernetes cluster. Most objects and permissions belong to exactly one namespace.
Native app: An app installed on a phone or computer, as opposed to a website that runs in a browser.
Negotiate: A Windows setting that picks the best sign-in method. It tries Kerberos first and uses NTLM only if it must.
Neural network: Layers of simple arithmetic whose connection strengths (weights) are learned from data. It is loosely inspired by the brain, but it is math, not a brain.
NHI: Non-human identity: a login for software, such as a service account, workload, bot or agent.
NIST: The US National Institute of Standards and Technology. It publishes widely used security guidance, such as SP 800-207 on zero trust.
NIST AI RMF: The US NIST's voluntary AI Risk Management Framework (January 2023). It has four functions: Govern, Map, Measure and Manage.
NIST SP 800-63: The US digital identity guideline. It defines the IAL, AAL and FAL assurance levels.
Nodes: The machines, real or virtual, that a Kubernetes cluster runs pods on.
Non-exportable key: A key you can use to sign or decrypt through an API or a chip, but never copy out. A thief can misuse it only while they have access. Every use can be logged.
Non-extractable key: A private key that the browser will sign with but never hand over. A script cannot copy it.
Nonce: A number used once. It makes a message unique, so an old answer cannot be replayed. It is used in ID tokens and in signed requests.
Normalizer: A step that turns events from many sources into one common shape, so they can be compared and tagged.
North-south traffic: Calls that cross the edge of your system, from clients outside to services inside.
NTLM: Windows' older challenge-response sign-in. The password hash itself works as a login (pass-the-hash). Microsoft has deprecated it in favor of Kerberos.
Number matching: The login screen shows a number. The user must type it on the phone to approve, so a blind tap does not work.
Number recycling: A phone company gives a number that was given up to a new customer after some months. The new owner then gets the messages meant for the old one.
OAuth: A standard that lets an app act for you with a token, without ever seeing your password.
OAuth 2.1: A draft that merges OAuth 2.0 with its best practice: PKCE always, no implicit grant and no password grant. It was still a draft in October 2026.
OAuth 2.x / OIDC / SAML: Three login standards. OAuth is the rulebook for tokens, OIDC adds sign-in on top, and SAML is the older XML-based way.
Object class: A type on an LDAP entry. It decides which attributes the entry must or may have, for example person.
OBO: On-behalf-of: an agent acts for a person and carries both identities, its own and theirs.
OCR: Optical character recognition: software that reads the letters in an image and turns them into text. An example is a scanned page.
OCSP: Online Certificate Status Protocol. A client asks the CA about one certificate when it uses it. It is now optional for public CAs. Some use CRLs instead.
Offline cracking: Guessing passwords on the attacker's own computer from stolen data. No lockout or rate limit applies.
offline_access: An OAuth scope that asks for a refresh token. The app can then get new access later, even when you are not there.
OIDC: OpenID Connect: a login layer on top of OAuth. It adds the ID token that says who signed in.
OIDC token: A signed token from an OpenID Connect issuer. A CI system issues one to each running job to say which pipeline it is.
On-behalf-of exchange: A token exchange where a service trades its token for a new one that acts for a user. The new token has fewer permissions.
Online eval: Scoring a sample of live traffic after the fact, using code checks, an LLM judge or user feedback. It catches quality problems that the offline test set missed.
OPA: Open Policy Agent: an open-source engine that decides allow or deny from rules written in Rego. A CNCF graduated project.
Opaque token: A token that is only a random string with no readable facts. The API must ask the issuer what it means.
Open banking: Rules that make banks let approved apps reach a customer's account data or payments, with the customer's consent.
Open redirect: A link that sends visitors to any address an attacker puts in it. Attackers use it to make fake pages look like the real site.
Open source: Software whose source code is published under a license. Anyone may use, study, change and share it, even commercially.
Open-weight model: A model whose trained weights you can download and run yourself, usually without its training data.
OpenFGA: An open-source system that decides who may do what from relationships. It follows the Zanzibar paper and is a CNCF Incubating project.
OpenID Federation: A standard (final in February 2026) that builds chains of signed statements. Many parties can then trust each other without one-to-one setup.
OpenTelemetry: An open standard for traces, logs and metrics. It is how agent decision trails are captured the same way everywhere.
Orchestrator-workers: A workflow pattern. A lead model decides the subtasks for each input, hands them to worker calls and combines their results.
Org-scoped role: A role that counts only inside one organization. Admin in one org gives no power in another.
Organization: A group of cloud accounts managed together. It can set rules, such as guardrails, that apply to every account in it.
Origin: The scheme, host and port of a page together, such as https://app.example.com. Browsers use it to decide who may read what.
Orphaned account: An account whose owner has left, or never existed. Nobody watches it, so attackers like it.
OTP: One-time password: a code that works only once. A code sent by SMS is weak, because of SIM swaps.
Out-of-band verification: Confirming a request through a separate channel you choose, such as a saved number or in person. Never use the call or message it arrived on.
Output guardrail: A check on the reply of the model before anyone sees or uses it. It can hide personal data and secrets and block harmful text.
Output tokens: What the model writes, including hidden reasoning. It is generated one token at a time and usually costs several times more than input.
Overlap window: A short time during rotation when both the old and the new secret work. No request meets a secret that was already removed.
OWASP: Open Worldwide Application Security Project: a nonprofit that publishes free security guides and Top 10 lists.
OWASP API Security Top 10: A free, community-written list of the most common serious API risks. OWASP means Open Worldwide Application Security Project. The 2023 edition is the current one.

P–R

p95 latency: The response time within which 95% of requests finish (p50 is the median). Watched instead of the average because averages hide the slow tail that real users feel.
Package manager: A tool that installs software by name. System ones, such as Homebrew or winget, install programs. Language ones, such as npm or pip, install code libraries.
Package registry: A public library of code packages, such as PyPI for Python and npm for JavaScript. Package managers install from it. Being listed there does not mean a package is safe.
Padlock: The small lock icon near the address. It shows your connection to the site is private. It does not prove the site is honest.
PAM: Privileged access management: extra-strict care for the most powerful accounts.
PAR: Pushed Authorization Requests (RFC 9126): the app sends its request straight to the server first. The browser cannot change it.
Pass-the-hash: An attack that uses a stolen NTLM password hash as the login, with no need to crack it.
Passkey: A way to sign in with your device and its unlock (fingerprint, face or PIN) instead of a password. A website cannot steal it.
Passphrase: A password made of several random words. It is long and easy to remember.
Password: A secret word or phrase that you and the site both know. It proves who you are, but it can be guessed, stolen or reused.
Password blocklist: A list of breached, common and context-specific passwords, such as company or product names. New passwords are checked against it and refused, with the reason shown.
Password grant: An old OAuth way for an app to collect your username and password and send them to the token endpoint. RFC 9700 forbids it.
Password manager: An app that creates and stores a different strong password for each site, so you remember only one.
Password reuse: Using the same password on more than one site. One leak then opens every account that shares it.
Password spraying: Trying a few very common passwords against many accounts, slowly, so no account has enough failures to lock. A blocklist, detection across accounts and MFA stop it.
Path-scoped rule: An instruction for a coding agent tied to a file pattern, such as all test files. It loads only for matching files. This keeps the context small.
Payload: The middle part of a token. It holds the claims. Anyone who has the token can read it.
PDP: Policy decision point: the judge that says allow, deny or step-up, using the rules and the facts.
PEP: Policy enforcement point: the gate that stops a request or lets it through, as the PDP decides.
PEP / PDP / PIP: The gate (enforces), the judge (decides) and the facts (informs) in a zero trust decision.
Permission boundary: A limit on the most an identity may ever do. The real permission is the overlap of what is granted and what the boundary allows.
Permission mode: A coding agent's setting for what it may do without asking, from read-only to full auto.
Permission rule: An allow, ask or deny entry in a coding agent's settings for one action, such as a command pattern. The tool checks it, not the model. Deny usually wins. It matches text only, so it is not a security boundary alone.
Permissions right-sizing: Cutting a policy down to what was really used. You record real use for weeks, then delete everything else.
Persistence: Something an attacker leaves behind to get back in later, such as an added passkey, recovery email or app grant.
Persona: One role of one person, such as customer, employee or partner agent.
Phishing: Tricking someone into giving up a secret, such as a password or a code. It happens on a fake page or in a fake message.
Phishing-resistant: Hard to steal by trickery. A passkey works only on the real site, so a fake site gets nothing.
PII: Personally identifiable information: details that point to a real person, like a name, email or ID number.
PII masking: Redacting personal data before an AI model (or log) sees it.
PIP: Policy information point: the source of facts the judge needs, such as device health or role.
PKCE: Proof Key for Code Exchange (RFC 7636). The app shows a secret whose hash it sent first, so a stolen code is useless.
PKCS#11: A standard way for programs to talk to a hardware security module. Software asks the device to sign or decrypt.
Plain text: Text that anyone can read, with no scrambling. A password stored in plain text is easy to steal.
Plan mode: A coding-agent setting where it can read, search and ask questions but not edit your project. It ends by showing a plan for you to approve, change or reject.
Platform admin: Staff of the product company who run the whole system. They sit outside every tenant, so give them as little power as possible.
Platform keystore: Secure storage built into a phone or computer. It keeps keys safe and signs with them, but never hands them out.
Platform-attested: Vouched for by the platform the code runs on. The platform checks the workload and gives it a short-lived credential.
Platform-controlled metadata: Profile data that only the platform can write, such as plan, region and roles. Users cannot change it.
Playbook: A written, step-by-step plan for handling one kind of incident.
Pod: The smallest unit in Kubernetes: one or more containers that start, run and stop together.
Policy: A set of rules that says who may do which action on which resource. The default answer is deny.
Policy bundle: A packed set of policy files, sent to the engines that run next to your services.
Policy enforcement point: The gate that applies an access decision and lets traffic through or blocks it.
Policy engine: Software that checks a request against written rules and answers allow, deny or step-up.
Policy-as-code: Access rules that are written, versioned and tested like software.
Policy engine (OPA / Cedar / OpenFGA): Software that checks requests against policy-as-code. OPA and Cedar use rules, and OpenFGA uses relationships.
Polling: Asking again and again, at set gaps, whether something is ready yet.
Pool model: All tenants share the same tables, and a tenant_id column on each row keeps them apart. It is cheap, but one missing filter leaks data.
Post-training: Training that turns a base model into an assistant: instruction tuning, RLHF and safety training.
Pre-authentication: A Kerberos step where the client proves it knows the password before the KDC gives out a ticket.
Pre-training: The first and most expensive training stage. The model learns to predict the next token from huge amounts of text.
Preference center: A page where a customer can see and change every consent and communication choice in one place.
Preflight: A separate OPTIONS request that the browser sends first, before a non-simple cross-origin request. It asks the server which method and headers are allowed.
Preventive control: A control that stops a problem before it happens, such as blocking a risky grant.
Primary source: The original of a claim, such as the law's text, the study or the organization's own announcement. News, blogs and AI summaries are secondary. They can lose or bend details.
Principal: A party that acts or is acted for in a request: a person, an app or an agent. One tool call can have two.
Privacy Pass: An IETF design (RFC 9576) where a client proves once that it passed a check. It gets tokens that cannot be linked back to the person.
Private CA: A certificate authority that a company runs for itself. Only its own machines trust it. It issues certificates for internal names and mTLS.
Private key: The half of a key pair that never leaves its owner. It makes signatures. The public key, which anyone may have, checks them.
private_key_jwt: A way for an app to sign in to the token server. It signs a short JWT with its private key. There is no shared secret.
Privilege creep: Access that piles up over the years as a person changes roles.
Privileged access workstation (PAW): A hardened device used only for admin work. It has no email and no general web browsing, and it matches the tier it administers.
Privileged account: Any identity that can change what other identities may do, or reach many systems or much data. This includes admins, local admins, powerful service accounts and deployment pipelines.
Probe: A test request that checks whether something really works, such as whether a cancelled token is refused.
Progressive profiling: Asking for customer details one at a time, when each is needed, instead of one long form at signup.
Prompt caching: Reusing the processed form of a request's unchanging opening, so repeat requests are cheaper and faster. It needs an exact match of the start.
Prompt chaining: Splitting a big job into steps, each its own prompt, with one step's output feeding the next.
Prompt injection: Hiding orders in content that an AI reads, so it follows them as if they came from its owner.
Prompt injection / jailbreak / tool poisoning: The AI-agent attack trio (the agents lesson).
Prompt template: A prompt kept as fixed text with named placeholders, such as {{ticket_text}}. Code fills them in for each request. Review it like code and test changes against an eval set.
Proof of possession: Showing that you hold something, such as a phone that receives a code. It proves you control that thing.
Protected resource metadata: A small file (RFC 9728) where an API says which authorization server issues tokens for it. An MCP client reads it after a 401.
Protocol: An agreed set of messages: who says what, and in what order. It lets two systems that never met work together.
Provenance: A proven record of where and how a piece of software was built.
Provisioning: Creating accounts and giving access.
Proxy: A server in the middle that passes requests along for someone else.
Proxy variable: A detail that stands in for a sensitive attribute because the two go together. Examples are a club name for sex or a ZIP code for race. Deleting the sensitive field leaves proxies behind.
PSD2 SCA: EU payments rule: strong customer authentication, with the approval tied to the amount and the payee.
Public client: An app that cannot keep a secret because its code runs on the user's device, such as a single-page app.
Public key: The half of a key pair that you can share with everyone. It checks signatures made with the private key.
Publisher verification: A check by the provider that confirms who is behind an app. Apps from verified publishers show a badge.
Pull request: A proposed change to code or policy that others review and approve before it is merged.
Purpose limitation: Collect and use personal data only for the clear purposes you named, and nothing more.
Push approval: An MFA message on your phone that only asks Approve or Deny. It is easy to tap by mistake.
Push authenticator: A phone app that gets an "Approve?" message from the sign-in service and answers with a signed yes or no.
Push fatigue: An attacker sends approval prompt after prompt until a tired user taps Approve. Also called MFA fatigue or push bombing.
Quantization: Storing a model's weights with fewer bits each, so it needs less memory at the cost of a little quality.
Query string: The part of a web address after the ?, such as ?scope=read. Browsers, add-ons and proxies can all see it.
Quota: A cap on total calls over a long time, such as a month. It usually follows a billing plan. A caller can be under the rate limit and still be out of quota.
RAG: Retrieval-augmented generation: fetch the relevant pieces of your own material at question time and put them in the prompt.
RAR: Rich Authorization Requests (RFC 9396): the app asks for one exact action, such as paying $50 to one account. It does not ask for a broad scope.
Rate limit: A cap on how fast a caller may send requests, such as per minute. Going over returns HTTP 429, so the caller should wait and try again.
RBAC: Role-based access control: permissions come from the role you hold.
RBAC / ReBAC: Access by role / access by relationship.
RC4: An old, weak cipher. It makes Kerberos tickets fast to crack, so Windows is retiring it.
Re-ranker: A second model that puts the search results in a better order after the first search.
Reasoning model: A model that writes out its working ("thinking") before it answers. It is better on hard problems, but slower, and the thinking is billed as output.
ReBAC: Relationship-based access control: permissions come from how people and things are linked, such as guardian-of.
Recall@k: The share of the relevant passages that appear in a retriever's top k results, averaged over test questions. It shows whether retrieval or generation is failing.
Receiver: In Shared Signals, an app that gets security events, checks them and reacts, for example by ending a session.
Reciprocal rank fusion: A way to merge ranked lists by rank, not score. Each item gets 1 / (60 + its rank) from every list it is in, and the sums are compared.
Reconciliation: Comparing the official directory with each app's real accounts on a schedule, then fixing every difference.
Recovery code: A one-time code that you save when you enroll in MFA. It lets you back in if you lose your other factors.
Recovery contact: A trusted person the user names in advance. The service can send them a code to help the user get back in.
Recovery point objective (RPO): How much recent data you can afford to lose in a failure, measured in time.
Recovery time objective (RTO): How long a system may be down after a failure before the harm becomes too big.
Red team / purple team: Friendly attackers testing your defenses / attackers and defenders running the exercise together.
Redirect: An answer that sends your browser to a different address.
Referer: A header that tells the next page which address you came from. A secret in a URL can leak this way. The odd spelling is old.
Refresh token: A longer-lived token used to get new access tokens without signing in again.
Refresh token rotation: Each refresh gives a new refresh token and cancels the old one. A leaked token then works at most once.
Region: A cloud area made of data centers in one part of the world. Using more than one region helps when one fails.
Registry (agent/NHI): The official list of all bots and agents, with an owner and a purpose for each. It can be checked while they run.
Rego: The language of Open Policy Agent. You write rules in it that answer allow or deny from the facts of a request.
Regression (eval): A test case that used to pass and fails after a change, often hidden by a better average.
Regression test: A test that reproduces a bug you fixed, so the same bug can't quietly come back.
Relation: A named link a subject can have to an object, such as owner, editor or viewer.
Relationship tuple: One stored fact of the form (subject, relation, object), such as (user:maya, owner, doc:report). It is one link in the graph.
RelayState: A small note the SP hands to the IdP and gets back unchanged. It remembers the page the user wanted.
Relying party: The website or app that you sign in to and that relies on the login. In WebAuthn it is also called the RP.
Replay attack: Sending a captured, validly signed message again. A signature alone cannot stop it. A time limit and a one-time ID can.
Report-only mode: A way to test a new access rule. It logs what it would have done but blocks nothing.
Repository: A project folder together with its full git history ("repo").
Representational harm: Harm when a system shows a group unfairly, uses stereotypes or ignores it. Compare allocational harm.
Request: A message a client sends to a server to ask for something. It has a method, a path, headers and sometimes a body.
Request object: The signed JWT that holds an OAuth request in JAR. Its signature shows who wrote it and that it is unchanged.
request_uri: A one-time reference to a request that the app already pushed (PAR). The browser carries it instead of the full request.
Reranker: A model that reads a question and one candidate text together and scores how well it answers. It is more accurate than embeddings but slower. It reorders a short list.
Reset storm: Many users forced to reset their passwords at once. It floods support, locks people out, and some never return.
Resource indicator: The resource parameter (RFC 8707). The app names the exact API a token is for, so the token works only there.
Resource server: The API that guards data and accepts access tokens. It checks that a token is meant for it.
Resource-based policy: A policy attached to a resource, such as a bucket. It says which identities may use that resource.
Response: The answer a server sends back. It has a status code, headers and usually a body.
REST: A common style for web APIs. You send plain HTTP requests, such as GET and POST, to named things like /Users.
Retry-After: An HTTP response header that tells the client how long to wait before trying again. The value is seconds or a date. It is sent with 429, 503 and some redirects.
Reuse detection: Noticing that an already-used refresh token was shown again. The server assumes theft and cancels the whole token family.
Revocation: Cancelling a token, session or certificate before it expires.
Revocation endpoint: The address where a client sends a token to cancel it (RFC 7009).
Revocation marker: A cut-off time kept on the server. Any token issued at or before that time is refused, even if it has not expired.
Reward hacking: When a trained model satisfies the check it is scored on instead of doing the real task. For example, it hard-codes expected answers or edits the tests.
RFC 9470: The standard for step-up authentication. An API says what proof it needs, and the client asks the IdP for it.
RFC 9700: OAuth 2.0 Security Best Current Practice (January 2025). It sets today's rules, such as PKCE for public clients and no password grant.
Right to be forgotten: A person's right to have their personal data erased (GDPR Article 17). It has limits, such as records the law makes you keep.
Risk scoring: Adding several weak signals into one number. The number decides whether to allow, step up, revoke or alert.
Risk tier: How dangerous an identity's powers are. It sets how often the identity is reviewed.
RLHF: Reinforcement learning from human feedback: people rank answers, and the model is nudged toward the kind they preferred.
Role: A named bundle of permissions, such as editor or viewer, that you give to people.
Role engineering: Designing roles top-down. You start from job descriptions and ask what each job needs.
Role explosion: Hundreds of narrow, one-off roles built for every exception. Nobody dares delete them, and nobody can audit them.
Role mining: Building roles bottom-up by finding access that groups of people already share. It copies today's over-grants unless a person checks each role.
RoleBinding: A Kubernetes RBAC object that grants a Role to users, groups or ServiceAccounts in one namespace only. A ClusterRoleBinding grants it cluster-wide.
Rollback: Sending traffic back to the old system if the new one fails, without losing data.
Rotation: Replacing a secret, key or certificate with a new one on a schedule, so a leaked copy stops working.
Row-level security: A database rule that shows each user only the rows they may see.
RP-initiated logout: The app (the relying party) sends the user's browser to the IdP's logout address. The IdP then ends its session too.
RPA: Robotic process automation: software that copies what a person does on screen, such as clicking and typing. It finishes repeated jobs.
Rubber-stamp problem: Reviewers approve everything without looking, so the review proves nothing.
Rug pull: A tool or server that is safe when you approve it and is changed later, in its description or its behavior, to do harm. Pin what you reviewed and ask again when it changes.
Runbook: A written, step-by-step guide for handling a known problem, such as an outage. People practice it before they need it.

S

Salt: A random extra value mixed into each password before hashing. It makes two equal passwords give different fingerprints.
Same-origin policy: The browser rule that script on one origin may send requests to another origin. By default it cannot read the replies. This stops one site reading another's pages.
SameSite: A cookie setting. It tells the browser not to send the cookie on requests that another site starts.
SAML: Security Assertion Markup Language: an older login standard that uses XML. Common in company software.
SAML metadata: A small XML file that lists a SAML party's web addresses, certificates and entity ID. The two sides swap it once to set up trust.
SAML Single Logout: The SAML way to sign out everywhere. The IdP sends a logout request to each app with a session and collects the answers.
SAN (Subject Alternative Name): The certificate field that lists the exact names it is valid for, such as DNS names, IP addresses or emails. A server's name is checked against the SAN only.
SBOM: Software bill of materials: the ingredients list of a piece of software, with every library and version.
SCA: Strong Customer Authentication: two independent factors for online payments (an EU PSD2 rule).
SCIM: System for Cross-domain Identity Management: a standard way to create, update and remove accounts across systems (RFC 7643, 7644).
Scope: A named permission in a token, such as bookings:read. It limits what the app may do.
Screen-scraping: A program logs in with your password and reads the pages as if it were you.
scrypt: A password-hashing method that is slow on purpose and needs a lot of computer memory, so guessing is costly.
SD-JWT: Selective Disclosure JWT (RFC 9901). A signed token where each claim can be hidden or revealed on its own.
Secret rotation: Changing passwords, keys and tokens automatically and often.
Secret scanning: Automatic search of code, commits and logs for keys and passwords. A leak is caught before it happens or soon after.
Secrets manager: A vault built to store secrets encrypted. It controls who reads them and logs every read. It often hands out short-lived secrets.
Secure cookie: A cookie flag. It tells the browser to send the cookie only over HTTPS. The cookie then cannot be read on a plain connection.
Security group: An AD group that can appear in an access control list, so it can grant permissions.
Security key: A small hardware device, often USB, that holds a passkey and signs in for you. It stays with you and cannot be copied.
Security question: A recovery question such as "first pet?". The answers are easy to find or guess, so it is a weak back door.
Selective disclosure: Showing only some facts from a credential, or a yes/no answer, while the signature still checks out.
Self-asserted attribute: A fact the user typed, such as a phone number. Nobody has checked it, so it is not trusted yet.
Self-hosting: Running software on your own servers: your data stays with you, and so does the patching.
Self-signed certificate: A certificate signed by its own key. No outside authority vouches for it, so clients trust it only if told to.
Sender-constrained token: An access token tied to a key or certificate. Only the real owner can use it. A copy alone is refused.
Separation of duties: Splitting powerful tasks across different identities, so no single one can do the whole risky job alone.
Server: A computer that waits for requests and answers them, such as the computer that runs a website.
Server-sent events: SSE: a web standard where one open HTTP response delivers a stream of small events. It is used to stream AI answers.
Server-side request forgery (SSRF): A flaw where an API fetches a URL the caller supplied without checking where it points. The request comes from inside the server's network. Defenses: allowlist destinations and isolate the fetcher.
Service account: A login used by software, not by a person. The classic non-human identity.
Service mesh: A layer that handles service-to-service calls. It often gives each service an identity and uses mutual TLS.
Service provider (SP): In SAML, the app you want to use. It trusts the IdP to vouch for you and runs no login of its own.
Service ticket: A Kerberos ticket for one service. You get it by showing your TGT. You show it to that service to get in. No password is used.
Session: The record a server keeps about your login: who you are, when you signed in and what you may do. Your cookie points to it.
Session assurance: How much we trust this session right now: device, network and freshness.
Session brokering: Admins connect through a gateway that adds the credential, so they never see it. The gateway also records the session.
Session fixation: An attack where the attacker sets the session ID first. Then they wait for the victim to sign in with it.
Session ID: The random string in a session cookie. The server uses it to find your session record.
Session recording: A replayable record of what an admin typed and clicked during a session.
SET: Security Event Token (RFC 8417): a signed message that says what happened. Shared Signals uses it.
SHA-1: A hash function. It is weak for storing passwords, but fine as a lookup key, as in the breach range check.
Shadow AI: Staff using AI tools the company hasn't approved, usually on personal accounts.
Shadow API: An API that runs but is undocumented, and the security team does not know it. So it escapes the protections that known APIs get.
Shared secret: A value that both you and the site know, such as a password or a code. Anyone who learns it can use it.
Shared Signals: The OpenID Shared Signals Framework: a standard way for systems to send each other security events. An example is "session revoked".
Shell: The program inside a terminal that reads your commands and runs them, such as zsh, bash or PowerShell.
Short-term memory: For an AI assistant, the current conversation held in the context window. It is gone when the session ends.
Sidecar: A small helper program that runs right next to a service and helps it, for example by answering policy questions.
SIEM: Security information and event management: a system that collects security logs and alerts from many places.
SIEM / SOAR / SOC: SIEM stores security events / SOAR reacts with automation / SOC is the team that runs both.
Sigma rule: A detection rule written in a shared, tool-neutral format. Many security tools can read and run it.
Signature: A value made with a private key. It proves who sealed the data and that nobody changed it. A public key checks it.
Signing (code / artifact): Publishers sign their software, and the signature is checked before it runs, so fakes are refused.
Silo model: Each tenant gets its own database or whole stack. The wall is physical, but you run many copies.
SIM swap: Moving a victim's phone number to the attacker's SIM card, to steal calls and SMS codes.
Simple request: A cross-origin request that the browser sends at once: GET, HEAD or POST with only safe headers. It still reaches the server. CORS only decides if the script may read the reply.
Single logout: Signing out once and ending every session that the login created: at the IdP and at each app.
Single point of failure: One part that, if it fails, stops the whole system.
Single-page app: A web app that loads once, then runs inside the browser tab and calls APIs. Short form: SPA.
Single-use token: A token that works only once and expires soon. After the first use, it is dead.
Skeleton key: A key that opens every door. A badly guarded emergency account works like one.
Skill atrophy: Losing a skill because a tool now does it for you (also called deskilling). Protect the skills you need to check the AI's work.
Slash command: A saved prompt you run by name in an AI assistant, for example /release-notes. You decide when it runs. Several tools are merging commands into skills.
Sliding window: Counting requests over the last 60 seconds, all the time. It removes the spike at the clock boundary.
Slopsquatting: Registering a package name that AI models keep inventing. People who trust the suggestion then install the attacker's code. The name joins "AI slop" and "typosquatting".
SOAR: Security orchestration, automation and response: software that runs set steps (playbooks) when an alert comes.
SOC: Security operations center: the team that watches for attacks all day and night.
Social engineering: Tricking a person into doing something unsafe, such as resetting a password for a caller.
Social login: Signing in with an account you already have elsewhere, such as at a big tech company. That company checks you and tells the app who you are.
SoD: Segregation of duties: nobody (person or bot) holds a dangerous mix of powers.
Softmax: The formula that turns a list of scores into probabilities that add up to 100%. With temperature T it is softmax(score / T).
Source code: The human-readable instructions programmers write, which get turned into the program a computer runs.
Source of authority: The one system that owns a given identity fact. Other systems hold copies. Change a fact where it is owned and let sync carry it outward.
Source of truth: The one system whose facts win when systems disagree, such as the HR directory for who works here.
Speech-to-text: Turning spoken audio into written text, for dictation, captions and meeting notes. Noise, accents and jargon lower accuracy. It can invent words that were not said.
SPIFFE: Secure Production Identity Framework For Everyone: an open standard that gives each workload a name and a short-lived ID.
SPIFFE / SPIRE: Open standards for workload identity: a universal name and a short-lived ID, given only after the workload is checked.
SPIFFE ID: The name of a workload, written like a web address: spiffe://trust-domain/service.
SPIRE: The software that checks a workload and then issues its SPIFFE ID.
Sponsor: The business owner who answers for a non-human identity and confirms it is still needed.
SSF: Shared Signals Framework: real-time security messages between systems (OpenID).
SSO: Single sign-on: sign in once, and the IdP vouches for you everywhere.
SSRF: Server-side request forgery: an attacker makes your server fetch an address they chose. The request starts inside your network, so it can reach hidden services.
Stack trace: A printout of the code path where an error happened. It shows inner details that help attackers.
Standing privilege: Admin rights that an account holds all the time, even when nobody is using them.
State: A random value an app sends at the start of a login and checks on return. It ties the answer to the request the browser began.
Stateless: Having no memory of earlier requests. HTTP is stateless, so each request must show who it is from. A stateless token carries its own proof, so the server keeps no list of live sessions.
Stateless API: An API that keeps nothing between requests, so each request must carry everything needed. Classic model APIs work this way: your app resends the whole conversation every turn.
Static secret: A secret that is set once and reused for months, like a database password. It stays valid until someone changes it.
Status code: The three-digit number at the start of a response. 2xx means it worked. 3xx means go elsewhere. 4xx means a request problem. 5xx means a server problem.
Status list: A long string of bits published by an issuer. Each credential has one bit. Flipping it revokes that credential.
Step-up: Asking for stronger proof only at the risky moment.
Stop reason: The API response field that says why the model stopped. It finished, it hit the output cap, or it wants a tool.
STRIDE: A threat checklist: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
Structured output: A model API feature that makes the answer match a JSON Schema you supply, so code gets fields, not prose. It guarantees the shape, not the truth. Still check refusals and wrong values.
sub: The "subject" claim in a token: a stable ID for the user at that provider. Match accounts on sub, not on email.
Subagent: A helper agent given one focused job in its own fresh context. It returns only a short summary.
Subdomain: A name added in front of a domain, like netbanking.yourbank.example. Whoever owns the domain on the right can add any name in front.
Supply-chain security: Making sure the software you use is genuine and was not changed on its way to you.
SVID: SPIFFE Verifiable Identity Document: the short-lived ID a workload shows.
Sycophancy: A model's tendency to tell you what you want to hear, including dropping a correct answer when you push back.
Symmetric encryption: Encryption where one shared key locks and unlocks. It is fast, but both sides must get the key safely first.
Synthetic identity: A fake person built from real pieces, like a real ID number with a fake face.
System of record: The trusted source for a fact, such as HR for employment or billing for a balance. Everything else is a copy.
System prompt: Standing instructions an app gives a model before the conversation. It steers strongly but is not a security boundary.

T–Z

Tabletop exercise: A drill where a team talks through a made-up incident step by step, without touching real systems.
Tamper-evident: Built so any change leaves a visible sign, like a broken seal.
Telemetry: Data a system sends about itself: logs, counts and events. Teams read it to see what is happening.
Temperature: A setting that sharpens (below 1) or flattens (above 1) the next-token odds. It controls variety, not truthfulness.
Temporary chat: A chat kept out of your history and memory and not used for training. Claude calls it an incognito chat. Providers may still keep a copy briefly for safety checks.
Temporary credentials: Keys that the cloud makes on demand and that expire soon, often in about an hour. They work for one role only.
Tenant: One customer organization inside a shared product. Its users, roles, rules and data are kept apart from every other tenant.
Tenant admin: An admin whose power counts only inside one tenant. They manage that customer's people and settings, and nothing else.
Tenant claim: A claim in a token that names the customer organization the request belongs to, such as org or tenant_id.
Tenant filter: A condition such as tenant_id = 'acme' added to every query, so a request only touches its own tenant's rows.
Terminal: A text window where you type commands and read their replies, instead of clicking.
Test-driven development (TDD): Writing a failing test for the behavior you want first, then writing code until it passes. With an agent, commit the test before asking for code. A later edit to it then shows.
Text-to-speech: Turning written text into a natural-sounding synthetic voice, for narration, audiobooks and accessibility.
Third-party cookie: A cookie set by a site other than the one in the address bar, for example from a hidden frame. Many browsers block these.
Threat model: A planned look at "how could this be attacked?", done when designing something.
Throttling: Slowing down repeated attempts with growing waits, instead of locking the account.
Ticket-granting ticket (TGT): The master Kerberos ticket you get at logon. You show it to the KDC to get service tickets. The krbtgt key protects it.
Tier 0: The top admin tier: whatever controls identity for everyone, plus anything that controls that.
Time to first token (TTFT): How long until the first word of an answer appears. People feel it as speed in a chat.
TLS: Transport Layer Security: the private, tamper-proof connection behind https and the padlock. The site proves who it is with a certificate.
TLS termination: Ending the TLS connection at a load balancer or gateway. It decrypts and forwards the request. It must then pass the caller's identity on safely and strip identity headers from outside.
Token: A small signed pass that an app carries to show who you are. You do not send your password every time.
Token (LLM): A piece of text a model reads or writes, roughly four characters of English. It is not the security token of the identity tracks.
Token bucket: A rate-limit method. A bucket refills with tokens at a steady rate. Each request spends one. When it is empty, requests are refused.
Token confusion: Using a real token for the wrong job, like sending an ID token to an API.
Token endpoint: The address on the authorization server where an app gets tokens. It trades a code, a refresh token or its own credentials.
Token exchange: Trading one token for a narrower one (RFC 8693). It is how a service acts for a user, and it is the basis of on-behalf-of.
Token family: A refresh token and every token that came from it by rotation. Reuse cancels all of them together.
Token passthrough: A server takes a token from a client and forwards it, unchanged, to another API. MCP forbids this.
Tokenizer: The part that chops text into tokens and numbers them. Different models split the same text differently.
TokenRequest API: The Kubernetes API that mints a short-lived ServiceAccount token for one audience. It replaces a never-expiring token stored in a Secret.
Tool calling: A model asks, in a set format, for a named tool to be run. Your code checks and runs it, never the model.
Tool poisoning: Hiding orders in a tool's name or help text, which the model reads and may obey. A hacked tool that returns false results is a related attack.
Top-k: Sampling only among the k most likely next tokens.
Top-K (retrieval): In search: the K stored chunks nearest in meaning to the question. The app passes them to the model.
Top-p: Nucleus sampling: the model samples only from the smallest set of top tokens whose probabilities add up to p.
TOTP: Time-based one-time password: a 6-digit code made from a shared secret and the clock. It changes every 30 seconds.
Toxic combination: Two powers that one person should never hold together, such as creating a vendor and approving payments to it.
TPM: Trusted Platform Module: a security chip that holds keys which cannot be copied off the device.
Trace (observability): The record of one request as it moves through a system, split into timed steps called spans. In an AI app it covers each model call and tool call. Engineers use it to find slow or failing steps.
Transaction token: A short-lived signed token that describes a whole internal request and is passed between services. It is an IETF draft.
Transmitter: In Shared Signals, the system that sends security events. It can be an IdP, a fraud service or an ITDR tool.
Trickle cutover: Moving users to the new system in small groups over time, so any problem stays small.
Trust anchor: The party at the top of a trust chain. Everyone trusts it first, and trusts others only if a chain of signatures leads back to it.
Trust domain: The area that one root of trust covers. In SPIFFE it is the first part of a workload name, such as example.org.
Trust policy: Rules on a role that say who may assume it. They name the issuer or principal and the conditions that must match.
Trust store: The list of root certificates that a client accepts. The operating system, browser or container image ships it. A chain is trusted only if it ends at a root in the list.
TTL: Time to live: how long a stored answer may be used before it must be looked up again.
typ: A JWT header field that names the kind of token. Access tokens use at+jwt (RFC 9068).
Type checker: A tool that checks every value is the right kind before the code runs, such as TypeScript's compiler or mypy. Type-correct code can still be wrong.
Type definition: In a relationship model, the shape of one kind of object and its relations. For example, a document has owner, editor and viewer.
Typosquatting: Registering a name one slip away from a popular package or site, to catch people who mistype it.
UEM: Unified endpoint management: one console to manage laptops, phones and tablets.
Unauthenticated bind: An LDAP bind with a name but an empty password. It proves nothing, so servers should refuse it.
Unit test: A small automatic test that checks one piece of behavior, such as "this request must be denied".
URL: Uniform Resource Locator: a web address like https://travel.example/flights. It has a scheme, a domain, a path and sometimes a query.
User code: In the device flow, the short code shown on the gadget. You type it on another device to approve the sign-in.
User prompt: What the person types, pastes or uploads on each turn of a conversation with a model.
User-writable metadata: Profile data that the user may change through a self-service API, such as theme and language. It has no security weight.
Userset: A group of subjects used as one, such as group:finance#member, meaning everyone who is a member of finance.
UUID: Universally unique identifier: a long random ID, such as 3f2b8c1e-.... It is hard to guess.
Vault: A guarded, logged safe for secrets such as admin passwords. People check a secret out and the vault changes it afterwards.
Vaulting: Keeping secrets in a guarded, logged safe, never in code.
Vector database: A store for embeddings that quickly finds the ones nearest to a query.
Verifiable credential: A digital statement signed by an issuer, such as a government saying "over 18". The holder keeps it in a wallet and shows it to others.
Verification: Proving that a contact detail, like an email or phone number, really belongs to the person and works.
Verification link: A one-time web address sent by email. Clicking it proves that you can read that inbox.
Verified attribute: A fact the user has proved, for example by entering a code sent to the phone. Now it can be trusted.
Verifier: The service that checks a credential by testing the issuer's signature. It does not need to call the issuer.
Verifying: Checking a token's signature with the issuer's public key. Only a verified token can be believed.
Voice clone: A synthetic copy of one person's voice, made from recordings of them. A short public clip can be enough. A familiar voice is no longer proof of who is calling.
VPN: Virtual private network: an encrypted tunnel that makes your device act as if it were inside the office network.
WebAuthn: The W3C web standard that lets a site log you in with a key on your device. Passkeys use it.
Webhook: An HTTP callback. When something happens, a provider sends a POST to a URL you registered. Check its signature and freshness. Handle retries so each event runs once.
WebView: A small browser window inside a mobile app. It shows web pages without leaving the app.
Weights: The learned connection strengths inside a neural network. A model file is basically a snapshot of them.
Well-known URL: A web address in the /.well-known/ folder. By agreement, every site puts the same kind of file at the same place.
Wildcard: A symbol that stands for any text. In an LDAP filter, * is the wildcard.
Wildcard (policy): A * in a policy that matches many actions or resources. admin:* means every action. Wildcards often give too much.
Wildcard certificate: A certificate for *.example.com. It covers exactly one name level, such as api.example.com. It does not cover example.com or a.b.example.com.
WIMSE: Workload Identity in Multi System Environments: an IETF working group on identity for software that calls other software.
Windows LAPS: Local Administrator Password Solution: Windows gives each computer its own random local admin password and changes it often.
Workflow automation: Tools that chain apps into triggered steps (actions, branches, AI steps) that run on their own.
Workforce identity: Sign-in and access for the people who work for a company, such as staff and contractors. HR and IT manage these accounts.
Workforce IdP: The identity provider for a company's own staff.
Workload: A running program or service, such as an app, a container or a virtual machine.
Workload identity (federation): The platform vouches for a program, so the program holds no lasting secret.
Workload identity federation: The cloud trusts a signed token from an outside issuer and swaps it for short-lived cloud credentials. No stored key is needed.
Workload principal: A machine identity in a cloud for a running app, job or function. It gets permissions by assuming a role.
WWW-Authenticate: The reply header where a server says how to sign in, for example Bearer realm="api", error="invalid_token". Every 401 reply must have one (RFC 9110).
WYSIWYS: What-you-see-is-what-you-sign: the approval shows the exact transaction.
X.509: The standard format for certificates (RFC 5280). It lists a name, a public key, dates, the issuer and a signature.
XML: eXtensible Markup Language: a text format that wraps data in tags. Older standards like SAML use it.
XML Signature Wrapping: An attack that hides forged data around a really signed part of an XML message. A careless reader checks the real part but reads the fake.
XSS: Cross-site scripting: an attacker gets their script to run on a trusted page. It can read data or act as the user.
Zanzibar: Google's 2019 paper on its global permission system. It stores who is linked to what. OpenFGA and SpiceDB follow it.
Zero data retention: A provider agreement under which prompts and outputs aren't stored after the response.
Zero standing privilege: Nobody holds admin rights by default. Every elevation is requested for a task, time-limited and removed automatically.
Zero trust: Never trust by default. Check every access on its own, wherever it comes from.
Zero trust / ZTNA: Never trust by default. Check every access. / The network products that do it.
Zombie API: An old API version that should have been retired but still answers. It usually lacks the fixes added to newer versions.
ZTNA: Zero-trust network access: products that apply zero trust at the network, so users reach only the apps they may use.