Entitlements as Code glossary

Access

A specific right held by an identity on a system, such as a membership in a group, a role or a permission. See why "entitlements".

One entitlement given to one person, with who approved it, why and until when.

A set of people in the identity provider. Platforms map groups to their own roles, so a group is how access is given.

A system that gives access to the members of a group, such as a code host, a cloud account or a project tool.

The directory that holds people and groups, such as Microsoft Entra ID. Platforms trust it for sign-in and for groups.

The person who asks for an entitlement, for themselves or for someone else. Never an approver of that request.

A person responsible for a group, who approves who joins it and reviews who keeps it. See roles.

A person who looks after the access process itself, such as approval rules, checks and the choice of observe or enforce.

A proposed change in Git that shows the exact change, its author and reason, and is reviewed before it is merged.

The rule that the person who benefits from a change, or who proposed it, cannot approve it. See principle 3.

The one place that says what access should be. In Entitlements as Code, the files in Git.

A difference between what Git says and what a platform shows, such as a member added or removed by hand. See principle 6.

To compare the platforms with Git and act on the differences, by reporting them or putting them back.

A mode where nothing is written to the platforms; differences with Git are only reported.

A mode where approved changes are applied and changes made by hand go back to what Git says.

The date a temporary grant ends on its own, agreed when it is requested and approved.

A scheduled check where owners keep or remove each member of their groups, with every decision recorded.

Giving each person only the access they need, for only as long as they need it. See where it comes from.