> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/end-user-guide-for-selfservice/glossary.md). # Glossary Plain-language definitions of the terms and abbreviations used in SelfService. The words below appear in SelfService screens and in this guide. They are written for everyday use — not as formal definitions. ## Terms | Term | What it means for you | | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Access** | Anything you are allowed to open, see, or do — an application, a folder, a system, a permission inside an application. | | **Access certification** | A periodic check in which a reviewer confirms that people still need the access they hold. If you manage people, you may be asked to take part. Older screens may label this *User Access Review*. | | **Access profile** | A ready-made bundle of access that fits a particular job. Requesting a profile is quicker than requesting each item separately. | | **Access request** | Your formal ask for something you don't currently have. It usually needs approval before it takes effect. | | **Access right** | A specific permission attached to a grant — what you may actually *do* with it, such as read, write, or approve. It appears as its own column on your access. | | **Approver** | The person who decides whether a request is granted. Often your manager, the owner of what you asked for, or both in turn. | | **Birthright access** | Access you receive automatically because of who you are — your department, job title, or location — without having to ask for it. | | **Campaign** | One run of an access review: a defined set of access, the reviewers assigned to it, and a deadline. You take part in a campaign rather than reviewing continuously. | | **Challenge questions** | Personal questions and answers you set in advance, used to confirm it is really you when you reset your password. Also shown as *Challenge Response*. | | **Delegated administrator** | Someone given permission to perform certain administrative tasks — such as creating users or resetting passwords — for a limited group of people, without being a full system administrator. | | **Deprovisioning** | The automatic removal or disabling of an account when it is no longer needed, for example when someone leaves. | | **Direct report** | A person who reports to you. If you have direct reports, extra options appear in SelfService for managing them. | | **Entitlement** | A single unit of access — a role, a group, or a resource — that can be granted to a person. | | **Group** | A collection of people who share the same access. Being added to a group grants you everything that group carries. | | **Identity** | Your account in one specific managed system. You are one person, but you may have several identities — one in the network directory, one in email, one in a business application. | | **IT policy** | A document your organization asks you to read and accept, such as an acceptable-use policy. SelfService records when you accepted it. | | **Managed system** | A connected application or directory that OpenIAM creates and updates accounts in. | | **Multi-factor authentication** | Signing in with more than a password — for example a password plus a code sent to you, or a security key. Often shortened to **MFA**. | | **One-time passcode** | A short code, valid once and only for a few minutes, sent to you by email or text to confirm your identity. Often shortened to **OTP**. | | **Organization** | The company, division, department, or cost centre you belong to. | | **Provisioning** | The automatic creation and updating of your accounts in the managed systems you are entitled to, based on who you are and what access you hold. | | **Questionnaire** | The short set of questions some requests ask before they go for approval — why you need the access, which project it is for. Your approver reads your answers. | | **Resource** | Anything access can be granted to — an application, a shared folder, a report, a screen. | | **Role** | A named job function that carries a bundle of access. Being given a role grants everything attached to it. | | **SelfService** | The OpenIAM portal described in this guide — where you manage your own profile, password, access, and requests. | | **Security key** | A small physical device, or a built-in feature of your phone or laptop, that proves it is you without a password. Uses the **FIDO** standard. | | **Single sign-on** | Signing in once and then opening your other applications without typing a password again. Often shortened to **SSO**. | | **SSH key** | A pair of files used instead of a password to connect to servers. Mainly relevant if your job involves technical systems. | | **Supervisor** | The person you report to, as recorded in OpenIAM. Usually the first approver for your requests. | | **Task** | An item waiting for your decision or attention — most often a request you need to approve. | | **Webconsole** | The separate administrative portal used by IT administrators. Most people never need it; this guide does not cover it. | | **Workflow** | The sequence of approvals a request travels through before it takes effect. | ## Abbreviations | Short form | Full term | | ---------- | --------------------------------------------------------------------------------- | | **FIDO** | Fast Identity Online — the standard behind security keys and passwordless sign-in | | **IdP** | Identity provider — the service that checks who you are when you sign in | | **IT** | Information technology | | **MFA** | Multi-factor authentication | | **OTP** | One-time passcode | | **SSH** | Secure Shell — a way of connecting to servers | | **SSO** | Single sign-on | {% hint style="info" %} Some screens show older wording than this guide uses — for example *User Access Review* where this guide says **access certification**. Where that happens, the guide quotes the screen exactly so you can still find the button. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/end-user-guide-for-selfservice/glossary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.