Identity and Access Management

Identity and Access Management (IAM) is an architectural discipline — spanning people, processes, and technology — that ensures the right identities can access the right resources at the right time, while preventing, logging, and enabling audit of unauthorized access. Within privacy architecture, IAM is the primary technical mechanism for enforcing least-privilege access to personal data, directly implementing the Privacy by Design principles of data minimization and purpose limitation. IAM encompasses four functional domains: (1) identity lifecycle management (provisioning, role changes, deprovisioning); (2) authentication (verifying who an identity is); (3) authorization (determining what an identity may access); and (4) audit (recording what was accessed, when, and by whom). IAM is not a single product — it is a composed architectural layer integrating identity providers (IdP), multi-factor authentication (MFA), privileged access management (PAM), identity governance and administration (IGA), and customer identity platforms (CIAM). IAM is not synonymous with cybersecurity broadly, nor with data encryption, data loss prevention, or network perimeter security — though effective privacy architecture integrates all of these with IAM.