Why "entitlements", not "access as code"
The name says exactly what the method manages. Here is how it differs from the terms next to it.
In 30 seconds
- An entitlement is one specific right held by one identity: a group membership, a role, a permission.
- Entitlements as Code manages who holds which entitlement, with its whole lifecycle, as reviewed changes in Git.
- "Access as code", "policy as code" or "authorization as code" usually mean something else: sign-in rules, decision logic, or how an application checks a permission.
What an entitlement is
Identity governance uses entitlement for the most specific unit of access. One identity governance vendor defines entitlements as "the access rights an account has on a source", the most granular form of access, which can then be grouped into access profiles and roles [1]. Microsoft Entra calls the same thing a resource role, for example being a member or an owner of a group [2].
That is the unit this method manages: not access in general, but who holds which specific right, who approved it, and until when. The word also carries the lifecycle with it. Auditors and identity teams already talk about requesting, approving, reviewing and removing entitlements, so the name fits the practices the method puts in Git.
The neighbouring terms
| Term | What it usually means | How Entitlements as Code differs |
|---|---|---|
| Access as code | A loose label, often for managing access with Terraform; also used for sign-in policies such as conditional access written as code [3] [4] | Names one thing only: who holds which entitlement, with its request, approval, review and end |
| Policy as code | Decision rules written in a policy language and evaluated by an engine, such as Open Policy Agent's Rego [5] | Uses policy checks on proposed changes, but its subject is the grants themselves, not a decision engine |
| Authorization as code | How an application or an API decides whether a request is allowed, kept outside the application's code [6] | Decides who holds an entitlement, not how an application evaluates it |
| IAM as code, permissions as code | Defining roles, policies and permission sets with infrastructure as code, for example cloud IAM roles or a GitHub organization's permissions [7] | Takes the roles as given and manages membership: who is in each group, approved by its owner |
| Identity as code | Configuring an identity provider with infrastructure as code: apps, policies, settings [8] | Reads people from the identity provider and changes only group memberships and owners |
| Entitlement management | The identity governance practice, and a Microsoft Entra ID Governance feature, for access requests, approvals, expiration and reviews through access packages [2] | Same goals; the record and every approval live in your Git as reviewed pull requests, the same way for every platform |
Entitlement management and Entitlements as Code
Microsoft describes entitlement management as "an identity governance feature that enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration" [2]. The goals are the ones Entitlements as Code shares: requests, approvals, end dates and reviews.
The difference is where the decisions live and how they are made. In Entitlements as Code, every grant and every removal is a change in a Git repository you own, reviewed as a pull request, with the full history in Git and the platforms reconciled to it. Teams that already treat infrastructure and policy as code get one way of working for access too.
Other uses of the name
The phrase "entitlements as code" is also used in software licensing, for the features a customer has paid for, managed through APIs and configuration [9]. That is a different meaning: here, an entitlement is a right a person holds on a system, in the sense of identity governance.
Sources
- SailPoint documentation, "Entitlements". documentation.sailpoint.com
- Microsoft Learn, "What is entitlement management?". learn.microsoft.com
- Opal blog, on managing access as code through Terraform, 2025. opal.dev
- Clear Path Security, on Entra ID conditional access policies as code. clearpathsecurity.co.uk
- Open Policy Agent documentation. openpolicyagent.org
- Axiomatics, eGuide on authorization as code and policy as code. axiomatics.com
- DEV Community, post on IAM as code for GitHub organization permissions. dev.to
- hoop.dev blog, on configuring Okta with Terraform. hoop.dev
- LicenseSpring glossary, entry on entitlements as code. licensespring.com