What it means
Identity and access management brings together the processes that establish identities, authenticate them, grant permissions, and keep access aligned with changing responsibilities. It includes people, devices, and software workloads. A directory or sign-in product can support IAM, but the operating process extends beyond any single tool.
Think in terms of a lifecycle: an entity joins, its needs change, and eventually its access ends. Each stage requires a trustworthy trigger, an accountable owner, and a way to confirm the resulting access. Governance reviews and privileged-access controls address specialized parts of this larger capability rather than replacing it.
The idea at a glance / Identity
Access changes. Check the application.
Follow Kael’s access across three dates. The departure disables the directory account, but a surviving Chronos Hub session exposes incomplete removal.
Fictional May 2026 snapshots: PeopleOps supplies the employment change; IT and the Chronos Hub owner manage directory U042 and account FL-17. Chronos Hub maintains its own permissions and sessions and does not automatically end them on a directory disable.
READ THE PICTURE
Read the lifecycle
On 03 May, FL-17 can scan Pad 3. On 17 May, Pad 3 access is removed and Pad 8 scanning is allowed. On 30 May, U042 is disabled, but a surviving Chronos Hub session still scans Pad 8. That observed gap needs application removal and retesting.
Keep in mindThis is one employee and one application, with an explicitly incomplete departure. IAM also covers devices and workloads. A directory state or role name cannot prove that every application, token, and session has lost access.
Read the complete example
- Read the lifecycle. On 03 May, FL-17 can scan Pad 3. On 17 May, Pad 3 access is removed and Pad 8 scanning is allowed. On 30 May, U042 is disabled, but a surviving Chronos Hub session still scans Pad 8. That observed gap needs application removal and retesting. PeopleOps owns Kael’s employment status and supplies approved join, transfer, and departure events. IT and the application owner carry out the access changes and verify them in Chronos Hub. The assumed directory-to-account association is U042 to FL-17; these local identifiers are not authenticators. On 03 May, the approved pad job requires scanning Pad 3 only. On 17 May, a transfer removes that old grant and replaces it with Pad 8 scanning; it does not accumulate both grants. These rows are dated lifecycle snapshots, not three stages in a login. Normal authentication and a resource-specific authorization check still apply to each use. On 30 May, the directory record is disabled after departure, preventing new sign-ins through that directory. Chronos Hub keeps local permissions and its own session state in this example. A controlled post-departure test using an already established Chronos Hub session still permits Pad 8 scanning, showing that removal is incomplete. The owner must disable the application’s access, remove the no-longer-needed grants, terminate affected sessions or tokens as required, and test the denied task again. No successful final removal is depicted. Separate applications and nonhuman identities need their own owners and verification.
This is one employee and one application, with an explicitly incomplete departure. IAM also covers devices and workloads. A directory state or role name cannot prove that every application, token, and session has lost access.
Diagram references: NIST SP 800-53 Rev. 5 - AC-2 and AC-6 · NIST SP 800-63B-4 - Session Management
AN ILLUSTRATIVE SCENARIO
A logistics contractor
A logistics firm hires a contractor for a six-week warehouse project. The sponsor requests a named account with access to the relevant warehouse records and a planned end date. The account uses the organization's sign-in process, while the application enforces the approved scope. When the contract ends, the identity system disables sign-in and the application removes local permissions and active sessions as required. A review checks that a separate reporting account was not left behind.
Put it to work
- Map the systems that create identity records, authenticate users, and enforce permissions; identify disconnected applications and nonhuman accounts.
- Define joiner, role-change, and departure workflows with approvals, scoped access, expiry where appropriate, and accountable application owners.
- Reconcile intended access with actual application state, test removal across connected systems, and record exceptions that need manual handling.
How to check your work
Trace a test identity through creation, a role change, and removal. Confirm actual access at the applications after each step and retain evidence of who approved it and which exceptions remain.
Connect the ideas
- Identity
The record an organization uses for a person, device, or workload that can be authenticated.
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- IGA
Processes and tools for reviewing who should have which access and removing what is no longer justified.
- PAM
Controls that broker, record, and constrain powerful administrative identities and sessions.