CyberArk Defender - Identity key terms

The encrypted, access-controlled store where privileged account credentials and secrets are held, so administrators and applications retrieve them on demand instead of keeping them in scripts, config files, or human memory.

A logical container inside the Vault that groups accounts and secrets and carries its own authorization rules, so teams can delegate access to one collection without exposing the rest of the environment.

An identity or group granted a defined permission set on a Safe, such as retrieve, use, manage, or approve, which determines what that identity may do with the accounts stored inside it.

The process of registering a privileged account in the Vault, including its address, platform, and reconciliation settings, so the credential becomes centrally managed, rotated, and auditable.

A configuration template that tells the Vault how to talk to a particular target system, covering connection settings, password-change logic, and verification steps for that technology type.

A scheduled check in which the Vault confirms that the stored credential still authenticates successfully to the target system, flagging drift or manual changes before they cause an outage.

A safeguard requiring two authorized users to approve a sensitive action, such as retrieving a high-value password, so no single person can act alone on the most critical accounts.

The principle of granting an identity only the permissions needed for its current task and no more, reducing the blast radius if that identity is compromised or misused.

Granting elevated rights only for a limited window when a task requires them, then revoking automatically, instead of leaving standing privileges assigned permanently to a user or group.

An authorization model where permissions are attached to roles and identities are assigned to those roles, simplifying administration and keeping access consistent as staff move between teams.

A tightly controlled emergency credential kept for situations when normal access paths fail, protected by strong monitoring and dual control so it cannot become a routine shortcut.

Capturing an interactive privileged session, including keystrokes and screen activity, into an immutable audit trail so investigators can reconstruct exactly what an administrator did on a target system.

Brokering and monitoring interactive connections to target systems so users never receive the underlying password, and every command can be inspected, recorded, or blocked in real time.

The chronological, tamper-resistant record of who accessed which secret or system, when, and from where, used for investigations, compliance evidence, and detection of anomalous behavior.

The discipline of storing, distributing, rotating, and auditing nonhuman credentials such as API keys, tokens, and certificates so applications never embed them in code or configuration files.

Automatically replacing a credential with a new value on a schedule or after suspected exposure, then updating every dependent consumer so the old value stops working.

A short-lived secret or token issued for a single use or brief window and then expired automatically, so a leaked copy has little value to an attacker.

A credential generated on demand at request time with a limited lifetime, often by creating a temporary database or cloud user, rather than storing one long-lived shared password.

The nonhuman identity an application or service uses to authenticate to the Vault and other systems, which must be authenticated and authorized just as carefully as a human user.

Proving a workload's identity using platform-attested evidence, such as a cloud instance role, Kubernetes service account, or certificate, so secrets are released only to verified consumers.

Any nonhuman entity that authenticates to systems, including servers, containers, scripts, and devices, each of which needs its own managed credential rather than a shared human account.

Authenticating an identity by proving possession of a private key matching an issued certificate, commonly used for workloads and devices where password-based login is impractical or too weak.

Tracking and automating issuance, renewal, and revocation of certificates so workloads keep valid credentials and expired certificates do not cause outages or force risky manual workarounds.

The uncontrolled spread of credentials across source code, build pipelines, spreadsheets, and chat history, which multiplies exposure points and makes rotation and revocation nearly impossible.

A password, key, or token written directly into source code or a configuration file, where it is easily copied, committed to version control, and rarely rotated.

The identity assigned to an autonomous AI agent so its actions can be authenticated, authorized, and attributed to a specific owner, rather than running under a broad shared service account.

A software system that uses a language model to plan and execute multi-step tasks, calling tools and external services on a user's behalf, which makes its access to credentials and data a security concern.

An arrangement where an agent acts with a narrowly scoped subset of a user's or service's rights, so the agent can complete a task without holding the full privileges of the delegator.

Limiting an agent's tools, data access, and credential scope to exactly what its assigned task needs, so a prompt injection or model error cannot reach unrelated sensitive systems.

The moment an agent calls an external function, API, or system to act on the world; each call is a control point where authorization, logging, and approval checks should be enforced.

A design pattern requiring explicit human approval before an agent performs a high-impact action, such as deleting data or moving funds, rather than allowing fully autonomous execution.

An attack where malicious text in content an agent processes manipulates it into ignoring instructions or misusing its tools, which is why agent permissions must be constrained independently of the prompt.

The recorded agreement and permission boundary defining what an agent may access on a user's behalf, which should be reviewable and revocable at any time by that user.

A control that removes standing local administrator rights from workstations and servers, elevating only approved applications on request and logging each elevation for review.

A policy that permits only trusted, allowlisted applications to run or elevate on an endpoint, blocking unapproved executables and scripts that attackers commonly use for privilege escalation.

Rules on the endpoint that detect and block risky behavior, such as credential dumping or unauthorized child processes, even when the initiating application would otherwise be allowed to run.

The processes and controls for reviewing, certifying, and revoking access over time, ensuring entitlements match business need and that orphaned or excessive rights are removed promptly.

A periodic, documented review in which managers or resource owners confirm that each identity still needs its access, producing evidence for auditors and triggering revocation of what is no longer justified.