What it means
A digital identity is the representation a system uses to distinguish an entity. That entity may be a person, a device, or software performing work. Its account or record can hold identifiers, attributes, credentials, ownership, and lifecycle information. Those details support later authentication and access decisions.
An account name is not proof of the human who performed an action. A credential may be shared or stolen, and automated workloads can act without a person present. Identity proofing establishes a claimed real-world identity when the use case requires it; authentication checks control of an authenticator later. Keep these stages distinct when investigating or designing access.
AN ILLUSTRATIVE SCENARIO
A hospital scheduling integration
A hospital creates a separate workload identity for software that transfers appointment availability between systems. The identity has a named technical owner, a documented purpose, and access only to the required scheduling data. It does not inherit a staff member's broad account simply because that person configured the integration. When the integration is retired, the owner removes its access and credentials. Logs can then distinguish the integration's actions from a scheduler's interactive work.
Put it to work
- Inventory the identities used by people, devices, and workloads, including their owners, purpose, authoritative source, and lifecycle status.
- Choose appropriate identity establishment and authentication methods; record how credentials bind to the intended entity without assuming usernames prove attribution.
- Connect account creation, changes, and removal to real events such as hiring, role changes, device retirement, or application decommissioning.
How to check your work
Choose an account and trace its owner, purpose, credential, and approved access. Confirm that a lifecycle change reaches every connected system and that activity can be attributed with stated limits.
Connect the ideas
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- IAM
The capability for creating identities, authenticating them, authorizing actions, and managing their lifecycle.
- Attestation
Evidence or a statement about a claimed device, workload, or control state that another party can evaluate against its requirements.