The vocabulary of non-human identity and AI agent security is borrowed from several fields — cloud IAM, PKI, secrets management, application security and, recently, agent engineering — and the same word often means different things in each. These definitions are the ones we use across the site and the platform. Where a term has a specific meaning in Trustivan (CHALLENGE, DENY, Agentic Access Management) we say so and label its status.
- Access path
The chain of relationships through which an identity can reach a resource: identity → credential → service → role or grant → resource. Access paths are what you evaluate to understand effective access, and the reason a permission list alone is misleading.
- Agentic Access Management
Access for agents that has to be asked for and ends on its own: time-bounded access grants, approved by someone other than the requester, that the runtime gate reads. Built and validated on sample data; a unified authority model across humans, machines and tools is a future capability.
- AI agent
A software system that uses a model to decide which tools to call, what data to read and which actions to take toward a goal, often with authority delegated from a person or another agent. An agent is a non-human identity with unusually dynamic authority.
- API key
A static secret presented to an API to identify and authorize a caller. API keys are credentials, not identities; they are frequently long-lived, copied and shared, which makes them the most common form of credential sprawl.
- App registration
The definition of an application in an identity platform — an Entra ID app registration, for example — which can hold client secrets or certificates and be granted permissions. An integration identity.
- Attestation
A recorded confirmation by an accountable human that an identity is theirs, has a stated purpose and should continue to exist, typically repeated on a cadence. An attributed owner is a hypothesis; an attested owner is a control.
- Blast radius
Everything that becomes reachable if a given identity or credential is compromised: the services, resources and downstream systems on its access paths. Blast radius is a property of the graph, not of the credential.
- Certificate
A signed public-key credential that binds an identity to a key pair, used for TLS, mTLS, code signing and workload identity. Certificates expire, which is both their strength and a common cause of outages.
- CHALLENGE
The verdict the runtime gate returns when an action needs a human before it should proceed — a mutating call against a high-impact resource with no grant behind it, for example. It is handed back to the caller, and the agent runtime is what stops; an access grant, requested and then approved by someone other than the requester and bounded to at most seven days, is what turns a later attempt into ALLOW.
- Confused deputy
A failure in which a trusted component is tricked into using its own authority on behalf of a less-privileged requester. Agents that act with broad inherited credentials on instructions found in untrusted data are confused deputies by default.
- Credential
Anything an identity presents to prove it is that identity: an API key, token, password, certificate, key pair or cloud access key. Identity ≠ credential: one identity may hold many credentials, and one credential may be copied into many places.
- Delegation
One identity granting another the right to act with some or all of its authority — a person to an agent, an agent to another agent, a service to a job. Delegation chains are where effective authority quietly exceeds anyone’s intent.
- Denial of wallet
An attack or failure mode in which an agent or automation is driven to consume paid resources — model tokens, API calls, compute — at a scale that causes financial harm. The agent-era form of resource exhaustion.
- DENY
The verdict the runtime gate returns when a rule refused the action, or when no rule spoke for it at all. Deny by default: an empty rule set denies rather than permits, so an action nothing authorizes is refused rather than let through unexamined. The calling runtime does not act, and the decision is recorded either way.
- Dormant identity
An identity that still exists and still holds valid credentials but has not authenticated within a defined window. Dormancy should be computed from observed use where the source exposes it, and shown as unknown where it does not.
- Effective access
What an identity can actually do, evaluated across every role, policy, trust relationship and grant that applies — as opposed to declared access, which is what any single policy document says.
- Evidence
The source records — snapshots, logs, configuration, attestations — that support a claim about an identity, with timestamps and provenance. Trustivan’s rule is evidence before claims: when evidence is missing, show unknown.
- Identity graph
The data structure that connects owners, identities, credentials, services, resources, actions and — for agents — tools, delegations and data sources, with evidence on every edge.
- Indirect prompt injection
Prompt injection delivered through content the agent reads rather than a message it is sent: a web page, a document, a ticket, a tool result or an email. The reason an agent’s data sources are part of its threat surface.
- JWTJSON Web Token
A signed, self-contained token that carries claims about an identity and its authorization. JWTs are credentials; their lifetime, audience and signing keys determine how dangerous a leaked one is.
- Long-lived credential
A credential with no expiry, or an expiry measured in months or years. Long-lived credentials turn a one-time leak into standing access; short-lived, automatically issued credentials are the remedy.
- Machine identity
A non-human identity bound to a machine, workload or device rather than to an application-level account — typically a certificate, key or workload identity such as SPIFFE. Often used loosely as a synonym for NHI.
- Managed identity
A cloud-issued workload identity whose credentials are created, rotated and delivered by the platform, so that no secret is handled by the application. Managed identities remove secret sprawl but not overprivilege.
- MCPModel Context Protocol
An open protocol through which agents discover and call tools and resources exposed by servers. Every MCP server and tool is an identity and a capability with provenance; an unknown server is an unknown dependency.
- mTLSmutual TLS
Transport-layer authentication in which both client and server present certificates, commonly used between services. mTLS authenticates the workload; it does not decide what the workload may do.
- Non-human identityNHI
Any principal that authenticates and acts without a person at the keyboard: service accounts, workload identities, machine identities, integration identities, automation identities, credential-backed identities and AI identities.
- OAuth app
An application that has been granted delegated or application-level permissions on a platform through OAuth consent. OAuth apps are integration identities; the scopes granted, the person who consented and the last use are the facts that matter.
- Orphaned identity
An identity with no accountable owner — typically because its creator left, the team was reorganized or the project ended — that still holds valid credentials. The most common first finding in any NHI program.
- Overprivilege
The gap between what an identity can do and what it needs to do, measured by comparing effective access with observed use. Overprivilege amplifies every other risk because it expands blast radius.
- Ownership
Accountability for an identity’s existence and behaviour, held by a person or team who can state its purpose, name its dependencies and decide when it should stop existing. Ownership is the precondition for every other control.
- Prompt injection
Instructions placed in an agent’s input that cause it to pursue the attacker’s goal instead of the user’s. Because a model follows instructions in its context, prompt injection cannot be fully prevented inside the model — which is why actions must be authorized outside it.
- Provenance
The recorded origin and history of an agent, tool or identity: who created it, from what source, with what configuration, and what has changed since. Provenance is how you decide whether to trust a tool before it runs.
- Rotation
Replacing a credential with a new one and retiring the old, on a schedule or in response to exposure. Rotation without ownership is risky because nobody knows what depends on the old credential.
- Runtime authorization
Evaluating whether a specific principal may perform a specific action on a specific resource at the moment it is requested — outside the model, for agents. In Trustivan the principal is resolved from the credential presented rather than claimed in the request, thirteen deny-by-default rules decide, and the strictest verdict wins. It enforces when the agent runtime calls it. The tool entitlements it decides over are set by an operator; no connector discovers an agent, and no screen registers one.
- Secret sprawl
The uncontrolled spread of credential copies across code, configuration, pipelines, chat, documents and machines. Sprawl is a symptom of long-lived, hand-distributed credentials and unknown ownership.
- Service principal
The identity object that represents an application or service in a tenant, used to sign in and to be granted roles. A service principal is a service identity; its credentials — secrets or certificates — are separate objects.
- Shadow AI
AI tools, assistants and agents adopted without security review, visible in the identity layer as unexpected OAuth grants, service principals, API keys and tool bindings. An identity problem more than a tooling problem.
- SPIFFE / SPIRE
SPIFFE is a standard for workload identity — an identifier plus a short-lived, verifiable identity document; SPIRE is its reference implementation. Together they replace hand-distributed secrets with attested, rotating workload identities.
- Token
A credential issued to an identity for a bounded purpose and, ideally, a bounded time: access tokens, refresh tokens, personal access tokens, session tokens. Lifetime, audience and scope determine a token’s blast radius.
- Tool
A capability an agent can invoke — an API call, a function, an MCP server method, a shell — that turns model output into an action. Tools carry identity, credentials and provenance, and are the unit at which agent authority should be governed.
- Tool poisoning
Compromising or impersonating a tool so that an agent calls something other than what it believes it is calling, or receives results that contain instructions. Addressed by tool identity, provenance and authorization — not by prompts.
- Transitive access
Access reached through a chain of trust relationships rather than a direct grant: a role that can assume a role that can read a bucket. Transitive access is where most hidden machine-to-machine paths live.
- Vaulting
Storing credentials in a dedicated secrets manager with access control, audit and rotation, instead of in code, configuration or documents. Vault coverage is a measurable property of every credential.
- Workload identity
An identity issued to a running workload — a pod, function, VM or job — usually by the platform that runs it, and often federated to a cloud provider without long-lived secrets. The modern replacement for baked-in keys.