SECAI Core · phase 10 of 15
Identity and access management
A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.
The Explain card
- Plain English
- Identity and access management (IAM) is the security process that provides identification, authentication and authorization for users, computers and other entities so they can work with organisational assets such as networks, operating systems and applications.
- Example
- A company's IAM system issues a verified identity to each AI agent, authenticates it with short-lived tokens, grants it only the tool permissions its role needs, and revokes everything automatically when the agent is decommissioned.
- Why it matters
- AI adds a flood of new non-human identities: agents, pipelines, service accounts. Without IAM governing them, they become orphaned keys with standing access that attackers love.
- Hook
- Who you are, how you prove it, what you get.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
