Agentic Access
Learn how to control agent identities, delegated authority, tools, and autonomous workflows.
Zero Trust Academy
Learn identity-aware access from first principles
Build a clear working model of identity, policy, networks, protocols, and agent access. Start with a topic or find the exact resource that you need.
Choose a topic
Learn by topic
Review a related set of concepts, then use the Pomerium documentation to apply what you learned.
Application and Service Access
Learn how identity-aware access protects web applications, APIs, and non-HTTP services.
Authorization and Policy
Learn how policy decides who can do what, under which conditions, and for how long.
Cryptography and Data Protection
Learn how cryptographic constructions, key lifecycles, and data governance protect information across its complete lifecycle.
Human Factors and Security Economics
Learn how usable controls, social engineering, incentives, insiders, support, recovery, biometrics, and behavior shape real security.
Identity and Authentication
Learn how systems establish identity and verify users, services, devices, and agents.
Network and Infrastructure
Learn the network boundaries, traffic paths, and infrastructure patterns behind private access.
Platform and Component Security
Learn how trusted bases, isolation, boot integrity, attestation, information flow, and shared hardware shape system security.
Privacy Engineering
Learn how to manage privacy risk through data maps, minimization, unlinkability, de-identification, telemetry design, and controlled use.
Security Engineering Foundations
Learn the system models and design principles behind secure access.
Security Operations and Risk
Learn the threats, controls, and operating practices that reduce access risk.
Software and Application Security
Learn how secure software design, browser boundaries, defensive coding, and verification prevent application vulnerabilities.
Standards and Protocols
Learn the standards and protocols that systems use for identity, policy, encryption, and transport.
Zero Trust
Learn the principles, trust boundaries, and request checks that define a zero trust architecture.
Reference library
Find a security resource
Search the full academy or filter it by the topic that you want to learn.
373 resources
2FA Authenticator
A 2FA authenticator is an authenticator used as one factor in a two-factor authentication process.
Access Control
Combine policy, reliable decision inputs, enforcement, and evidence to control actions on protected resources.
Access System Inventory
Inventory protected resources, identities, routes, policies, credentials, dependencies, owners, and recovery paths.
Access Token
An access token is a credential that a client presents to a resource server.
Account Recovery
Restore account access without giving attackers an easier path than the normal authentication and enrollment process.
Actor, Subject, and Principal
Separate the real-world actor, active subject, represented principal, digital identity, and account.
Adversary Model
State who can attack the system, what they want, what they can do, where they start, and what constrains them.
Agent
An agent is a software loop that uses model output and context to select steps or tools toward a goal.
Agent and Tool Inventory
Inventory agent identities, hosts, models, tools, servers, credentials, owners, versions, targets, and provenance.
Agent Blast Radius
Agent blast radius is the maximum credible effect that an agent can cause through its tools, credentials, data access, network reach, and chained actions.
Agent Cascading Failure
Stop one false result, repeated action, or unavailable dependency from propagating through agents and tools with growing impact.
Agent Credential Custody
Keep agent credentials isolated by user, task, audience, and tool and control storage, use, rotation, and revocation.
Agent Goal Hijack
Prevent untrusted instructions from changing an agent's objective, authority use, tool sequence, or target resource.
Agent Identity and Privilege Abuse
Prevent an agent from using a shared, wrong-user, stale, or excessive identity to act beyond the current delegated task.
Agentic Access Management (AAM)
Agentic Access Management controls agent actions with originating identity, explicit delegation, per-request policy, enforcement, and audit evidence.
Agentic Supply Chain
Verify the origin, version, integrity, permissions, and change process for agent code, models, prompts, tools, and metadata.
Analyze Security Incentives
Map cost, benefit, authority, information, liability, and feedback so a control works after teams and vendors optimize their own goals.
Analyze Side-Channel and Shared-Resource Risk
Model secret-dependent signals and deliberate covert channels across software, shared hardware, protocols, and physical devices.
Anonymization and Re-Identification
Evaluate whether a release resists identification and sensitive inference under realistic auxiliary data, recipients, repeated releases, and governance.
Apply zero trust to cloud-native systems
Apply user and workload identity across APIs, gateways, meshes, sidecars, clusters, clouds, and application resources.
Assess De-Identification and Inference
Test a dataset or query release against linkage, membership, attribute, reconstruction, rare-record, and repeated-release attacks.
Assess risk in an access path
Connect assets, threats, likelihood, impact, controls, evidence, assumptions, and residual risk for one access system.
Asset and Protected Resource
Identify what has value, what needs protection, and which resource an access decision controls.
Assume Breach
Design as if one identity, credential, workload, route, or control will fail, then limit movement and impact.
Attack Surface
An attack surface is the set of boundary points where an attacker can try to enter a system, cause an effect, or extract data.
Attack Tree
An attack tree decomposes one attacker goal into alternate and combined paths that can achieve it.
Attribute-Based Access Control (ABAC)
Evaluate subject, resource, action, and environment attributes with explicit provenance, freshness, and policy behavior.
Attribute, Claim, and Assertion
Separate a source fact, a released claim, and a protected statement sent between an issuer and relying party.
Audit and revoke agent actions
Trace one agent action through identity, delegation, policy, approval, credential, tool, target, result, and future revocation.
Authenticated Encryption with Associated Data (AEAD)
Encrypt plaintext and authenticate ciphertext plus unencrypted context with a standard AEAD construction and correct nonce handling.
Authentication
Verify that a claimant controls one or more authenticators bound to an account without confusing that result with authorization.
Authorization
Authorization determines whether a subject can perform a requested operation on a resource. It evaluates policy after or alongside authentication.
Authorization Consent
Use consent to record a user's informed grant without treating it as proof that an action is safe or permitted.
Authorization Decision Log
Record enough structured evidence to explain and test an access decision without storing credentials or excess personal data.
Authorization Drift
Authorization drift is the gap that develops when effective access no longer matches intended access.
Authorization Request
Model each decision with a subject, resource, action, context, policy, and evidence instead of a user role alone.
Authorize HTTP tunnels and upgrades
Place authentication and authorization around WebSocket upgrade, HTTP CONNECT, CONNECT-UDP, and long-lived tunnels.
Back-channel logout
OpenID Connect Back-Channel Logout lets an OpenID Provider notify a relying party through a direct server-to-server request.
Backup and Restore
Create isolated, complete, recoverable copies and prove they restore current service without old compromise, authority, or expired data.
Bastion Host
A bastion host is a hardened system that provides controlled administrative access to a more protected network or resource.
Biometric Authentication
Use noisy, non-secret human characteristics only within a bounded authenticator, sensor, matching, privacy, fallback, and recovery design.
Build a Privacy Threat Model
Model data actions, observers, linkability, inference, unawareness, loss of control, and human consequences across a complete system lifecycle.
Build a Security Behavior Learning Program
Turn role-specific risks into practiced tasks, usable tools, behavior measures, feedback, and control improvements.
Build an access audit trail
Join authentication, authorization, proxy, and application evidence without confusing one event for another.
Build application security requirements
Turn application risks into testable security requirements, assurance levels, negative tests, and evidence with OWASP ASVS.
Build assurance for an access control
Connect a protection need to requirements, design, implementation, tests, operations, evidence, and residual risk.
Build detections for access systems
Design and validate signals for route bypass, credential abuse, stale authority, policy drift, and control failure.
Build SPIFFE workload identity
Trace SPIFFE IDs, SVIDs, trust domains, bundles, Workload API delivery, attestation, rotation, and federation.
Business Logic Abuse
Protect workflow order, object state, quotas, prices, approvals, and other business invariants from valid-looking misuse.
Canonicalization
Convert equivalent input representations to one defined form before comparison, validation, authorization, and storage.
Capability-Based Security
A capability is an unforgeable reference that carries authority to perform defined operations on a resource.
Certificate Lifecycle
Issue, deploy, rotate, revoke, recover, and retire certificates and private keys without breaking name or trust validation.
Choose DAC, MAC, RBAC, or ABAC
Compare owner-controlled, centrally mandated, role-based, and attribute-based authorization for one resource.
Choose layer 4 or layer 7 access control
Place transport and application enforcement where the required identity, destination, protocol, resource, and action are visible.
Choose the access enforcement layer
Place access enforcement across identity-aware proxies, API gateways, service meshes, load balancers, and network tunnels.
Choose where authorization decisions and enforcement run
Compare central and local authorization while preserving complete enforcement, current context, and safe failure behavior.
Clientless Zero Trust Access
Distinguish browser or native-client access from broad network tunnels and state which protocols still require a local connector.
Cloud Access Security Broker (CASB)
A Cloud Access Security Broker is a policy enforcement point that mediates use of cloud services.
Cloud Metadata Service Risk
Cloud metadata services can deliver workload credentials, so network and identity boundaries must stop unintended callers.
Cloud Network Security
Cloud network security protects data, workloads, identities, and communication paths in cloud environments. It follows a shared responsibility model.
CNAME (Canonical Name)
A DNS CNAME record states that its owner name is an alias for another domain name.
Combine segmentation with identity policy
Use network segmentation to limit reachability and identity policy to decide access to named services, resources, and actions.
Command Injection
Avoid command interpreters and pass fixed executables and validated arguments through structured process APIs with narrow authority.
Commission and Retire an Access System
Put an access system into service and remove it with verified ownership, authority, dependencies, evidence, and final state.
Compare process, container, and VM isolation
Compare shared kernel, virtual machine, host, node, runtime, credential, and control-plane trust boundaries.
Compare zero trust deployment models
Compare device agent and gateway, enclave gateway, resource portal, and application sandbox deployment boundaries.
Complete Mediation
Check every relevant access and prevent alternate paths or stale decisions from bypassing current policy.
Confused Deputy
Prevent a service or agent from using its own authority for a caller that did not have permission to request the action.
Constrain an access token to its sender
Compare bearer, DPoP, and mutual-TLS token use and test proof binding, freshness, audience, and replay defenses.
Contain compromised access
Disable identity, revoke credentials and sessions, isolate routes, and measure the last accepted harmful action.
Context-Aware Proxy
A context-aware proxy is a policy enforcement point placed between a requester and a protected service.
Continuous Verification
Continuous verification means that a system continues to evaluate authorization during a session instead of treating the initial login as permanent trust.
Control Plane and Data Plane
Separate the systems that define and distribute access policy from the request path that enforces it on live traffic.
Covert Channel
Find unintended communication paths that let cooperating subjects transfer information through shared storage, timing, load, errors, or resource state.
Credential and Authenticator
Distinguish a bound credential, an authenticator, its secret or key, a factor type, and protocol output.
Credential Injection
Credential injection supplies a bounded upstream credential after access policy allows a request.
Cross-Origin Resource Sharing (CORS)
Grant selected browser origins permission to read cross-origin responses without treating CORS as authentication or request blocking.
Cross-Site Request Forgery (CSRF)
Stop another origin from causing an authenticated browser to perform an unwanted state-changing request.
Cross-Site Scripting (XSS)
Prevent untrusted data from executing as active browser content through context-aware encoding, safe DOM APIs, and constrained markup.
Cryptographic Agility
Inventory and replace algorithms, parameters, protocols, keys, libraries, certificates, and stored formats without hidden dependencies.
Cryptographic Hash Function
Map data to a fixed-length digest with defined preimage, second-preimage, and collision resistance for the selected use.
Cryptographic Key Management
Control cryptographic key purpose, generation, custody, distribution, use, rotation, compromise, recovery, and destruction.
Cryptographic Randomness and Entropy
Generate unpredictable security values from a validated entropy source and cryptographic random-bit generator with protected state.
Cyber Threat Intelligence
Turn evaluated information about adversaries, behavior, infrastructure, vulnerabilities, and incidents into a time-bounded security decision.
Data Breach
A data breach is the loss of control, compromise, unauthorized disclosure, acquisition, or access to sensitive information.
Data Classification
Assign data sensitivity, criticality, ownership, use, sharing, retention, and recovery requirements that drive technical controls.
Data Minimization and Purpose Limitation
Collect, use, expose, and retain only the data necessary for a stated operational purpose and bounded period.
Data Retention and Secure Deletion
Retain data for a stated need, then remove access across primary storage, replicas, caches, backups, indexes, keys, and media.
Default-Deny Authorization
Deny unmatched and indeterminate requests, then add explicit narrow grants with tested conflict and failure behavior.
Defend outbound requests from SSRF
Design a webhook, import, preview, or fetch service with strict destination, redirect, credential, egress, and resource policy.
Defense in Depth
Place complementary controls across distinct failure domains so one failure does not expose the protected asset.
Delegate authority without losing identity
Preserve subject, actor, audience, action, and authority limits when a service or agent acts for another principal.
Delegation
Delegation gives an actor limited authority to act for another principal, called the subject.
Delegation Chain
Preserve the human actor, agent, service, tool, target, authority, and constraints through every delegated access step.
Denial of Service
Model how traffic, expensive valid work, state, queues, dependencies, identity, and recovery controls can make a service unavailable.
Design access control during failure
Define fail-closed, fail-open, degraded, cached, and break-glass states for every access dependency before an outage.
Design access controls that people can use
Use open design, clear choices, safe defaults, and observable recovery so people can operate security correctly.
Design access for resilience and recovery
Keep access controls safe through dependency failures, limit damage, recover service, and prove the restored state.
Design application cryptography
Select a standard construction and define keys, nonces, context, record format, failure behavior, tests, and migration before coding.
Design human and non-human identity lifecycles
Give people, services, workloads, devices, and agents distinct identity, delegation, credential, and revocation models.
Design human approval for agent actions
Present the real target, arguments, authority, effect, and uncertainty so human approval gates a concrete agent action.
Design identity-aware API access
Protect API inventory, clients, routes, versions, objects, actions, credentials, quotas, and evidence with explicit owners.
Design identity-aware TCP and UDP access
Map user identity and policy to non-HTTP connections while controlling clients, ports, names, lifetime, and protocol limits.
Design Information Flow Controls
Define labels, allowed flows, trusted transformations, release policy, evidence, and residual channels across an application and its data systems.
Design multi-IdP routing and account linking
Route sign-in across identity providers without issuer confusion, account collision, unsafe linking, or recovery bypass.
Design Privacy-Preserving Security Telemetry
Collect enough access evidence for detection and investigation while limiting identity detail, linkability, sensitive content, recipients, and retention.
Design Secure Boot and Platform Attestation
Connect roots of trust, boot verification, measurements, fresh evidence, appraisal, policy, update, revocation, and recovery.
Design service-to-service access
Authenticate workloads, preserve human actor context, authorize target actions, and manage machine credentials through their lifecycle.
Detection Quality
Evaluate whether a detection observes the intended behavior with useful fidelity, timeliness, coverage, context, response, and manageable error.
Device Posture
Device posture is the current security state of a device.
Differential Privacy
Bound how much a computation's output distribution can change when one person's contribution is added or removed.
Digital Forensics for Incident Response
Identify, collect, preserve, examine, analyze, and report digital evidence with stated scope, methods, time, integrity, and uncertainty.
Digital Identity Assurance Levels
Select and distinguish identity, authentication, and federation assurance levels for a digital service.
Digital Signature
Bind a defined message to a private signing key and verify it through an authenticated public key, purpose, and context.
Distinguish proxy types before placing access control
Distinguish reverse, forward, transparent, and identity-aware proxies by client, destination, trust, and enforcement role.
Distributed Security State
Control policy, identity, revocation, key, context, and quota state across replicas with explicit freshness and failure semantics.
Do not treat a scope as a resource permission
Separate OAuth scopes, roles, entitlements, consent, and application permissions before a resource server authorizes an action.
East-West Traffic
East-west traffic is traffic between workloads, services, or systems within or across internal, cloud, or data-center environments.
Economy of Mechanism
Economy of mechanism keeps trusted security functions small, clear, and free of unnecessary shared behavior.
Encryption
Encryption transforms plaintext into ciphertext under a cryptographic key. Symmetric encryption uses a shared secret key.
Endpoint Security
Endpoint security is the set of controls used to manage and protect devices that access organizational data and services.
Envelope Encryption
Encrypt data with a data-encryption key and protect that key under a separately stored key-encryption key or key service.
Evaluate WebAuthn and passkeys
Trace WebAuthn registration and authentication across relying party, browser, authenticator, origin, and user verification.
Evidence Integrity and Chain of Custody
Show that evidence is authentic enough for its purpose and record every collection, transfer, access, transformation, analysis, and disposition.
Execution Isolation and Sandboxing
Bound untrusted code with explicit memory, process, file, network, device, syscall, identity, and resource controls.
Explicit Delegation
Explicit delegation records a deliberate grant from a subject to an actor with a named audience, actions, lifetime, and authorization evidence.
Fail-Safe Defaults
Start from explicit denial and define safe behavior for missing policy, invalid input, dependency failure, and recovery.
Fault Injection and Tamper Resistance
Model physical and logical faults that skip checks, corrupt state, expose keys, or force unsafe recovery in a security component.
Federate workload identity without static keys
Exchange attested platform identity for short-lived target credentials without copying long-lived cloud keys into workloads.
File Upload Security
Validate, transform, store, scan, and serve untrusted files through bounded stages with separate names, origins, and authority.
Firewall
A firewall is a device or program that controls network traffic between networks or hosts according to a firewall policy.
Formal Methods and Security Models
Use precise models, invariants, and proofs to answer a bounded security question without confusing the model with the deployed system.
Front-channel logout
OpenID Connect Front-Channel Logout uses the user's browser to load registered relying-party logout URIs from the OpenID Provider.
Gateway Bypass Path
Find every route that reaches a protected origin without the intended identity, policy, and evidence controls.
Govern the access policy lifecycle
Assign owners and review, approve, deploy, observe, expire, and retire access policy with evidence and rollback.
Harden a Security-Sensitive Service
Build, deploy, verify, update, and recover a role-specific minimal service without broad host or control-plane authority.
Hardware Root of Trust
Anchor a narrow security function in protected hardware while stating the manufacturing, firmware, key, lifecycle, and physical assumptions that remain.
Hidden Trust Boundary
A hidden trust boundary exists when one component accepts another component's identity, authority, data, or result without an explicit enforced rule.
HTTP Request Smuggling
Prevent HTTP intermediaries from disagreeing about message boundaries, request length, transfer coding, and the start of the next request.
HTTP Semantics
HTTP semantics define request methods, targets, fields, responses, status codes, authorities, and intermediary behavior.
HTTPS and TLS
Explain HTTPS as HTTP over an authenticated, encrypted TLS channel with explicit names, endpoints, and termination boundaries.
Identifier, Account, Record, and Person
Separate a label, system account, directory record, and real person before joining identity across systems.
Identity and Access Management (IAM)
Identity and access management uses governance, processes, and technology to establish digital identities and control their access to resources.
Identity Collapse
Identity collapse occurs when a downstream service sees a common agent or service identity and loses the originating user or actor relationship.
Identity Federation
Establish trust between an identity provider and relying party without treating an assertion as universal authority.
Identity Proofing and Enrollment
Resolve a claimed real-world identity, validate evidence, verify the applicant, and bind the result to an account.
Identity Propagation
Identity propagation carries verified information about the originating principal and, when needed, the acting service across request boundaries.
Identity Provider (IdP)
An identity provider establishes an authentication event and creates a verifiable assertion for a relying party in an identity federation.
Identity-Aware Rate Limiting
Identity-aware rate limiting bounds request volume by accountable subject, client, resource, action, and cost.
Implicit Trust Zone
An implicit trust zone grants authority from location, membership, or prior access without a resource-specific decision.
Indicator of Compromise and TTP
Distinguish short-lived technical observables from adversary tactics, techniques, and procedures used to build more durable detection and response.
Inference Attack
Derive protected facts from permitted queries, aggregates, models, correlations, errors, and repeated observations.
Information Flow Control
Control where information may move after access by tracking source, destination, transformation, label, release, and declassification.
Ingress and Egress
Place controls on traffic entering and leaving a workload boundary without treating direction or network location as identity.
Injection
Prevent attacker-controlled data from changing the structure or meaning of a command sent to an interpreter.
Input Validation and Output Encoding
Validate syntax and meaning at input boundaries, then encode untrusted data for the exact output interpreter and context.
Insecure Inter-Agent Communication
Authenticate agent messages, bind them to one task and audience, validate content, and preserve actor and delegation evidence.
Insider Threat
Reduce harmful action by people or partners who hold legitimate access, knowledge, proximity, or influence, whether intentional or accidental.
Intrusion Detection
An intrusion detection system monitors events and produces alerts when it finds signs of an incident or policy violation.
IPsec: Tunnel Mode and Transport Mode
IPsec is a suite of protocols that protects IP traffic under a security policy.
Joiner, Mover, and Leaver Lifecycle
Create, change, and remove identity and access state when a person or workload enters, changes, or leaves a role.
JSON Web Token (JWT)
Learn how JSON Web Tokens carry signed or encrypted claims, which checks a receiver must make, and how Pomerium uses a signed identity assertion.
JWK and JWKS
Select trusted JSON Web Keys from an approved set, restrict algorithms and key use, and rotate without trusting token-controlled URLs.
Key Derivation Function (KDF)
Derive purpose-separated cryptographic keys from suitable key material with a standard KDF, salt, context, and output length.
Key Management Service and HSM
Separate key lifecycle orchestration, hardware protection, cryptographic operations, workload authorization, and application data policy.
Kubernetes Gateway API
Gateway API models infrastructure, listeners, routes, backends, and policy attachment through role-oriented resources.
Kubernetes Namespace and Tenancy
A namespace scopes names and policy objects, but tenant isolation depends on many cluster and workload controls.
Kubernetes NetworkPolicy
Kubernetes NetworkPolicy controls selected Pod ingress and egress reachability through a supporting network plugin.
Kubernetes RBAC
Grant Kubernetes API verbs on exact resources and namespaces without broad roles, aggregation, bind, or escalation paths.
Kubernetes Service Account
Use bounded, short-lived Kubernetes service-account tokens for a workload and avoid static namespace-wide credentials.
Lateral Movement
Lateral movement is the post-compromise use of techniques to enter and control additional remote systems or accounts in an environment.
Layer-7 Enforcement
Layer 7 enforcement uses protocol facts, such as host, route, method, tool name, and verified identity, to make access decisions.
LDAP (Lightweight Directory Access Protocol)
Lightweight Directory Access Protocol (LDAP) is an Internet protocol for clients to access directory services that follow X.500 data and service models.
Linkability and Identifiability
Distinguish connecting events to each other from connecting them to a person, and bound both by observer, dataset, purpose, and time.
Load Balancer and Gateway
A load balancer selects a backend, while a gateway terminates or mediates a protocol boundary and can apply policy.
Malware
Understand malicious code that steals, persists, disrupts, spies, moves, or changes systems and prepare to contain and rebuild affected trust.
Man-in-the-middle attack (MITM)
A man-in-the-middle attack places an adversary between two parties to intercept, relay, or change communication without their knowledge.
Manage access-system vulnerabilities and patches
Prioritize exposure and authority, deploy verified patches, watch behavior, and retain a safe rollback path.
Manage application vulnerabilities
Receive, reproduce, triage, remediate, verify, disclose, deploy, and learn from application vulnerability reports.
MCP Authorization
Learn how MCP authorization uses OAuth metadata, resource indicators, token audience checks, route policy, and tool authorization.
MCP Security
Model Context Protocol security is the set of controls that protects hosts, clients, servers, tools, authorization flows, and downstream resources.
Memory and Context Poisoning
Stop untrusted content from becoming durable or cross-user agent state that changes later identity, policy, or tool actions.
Memory Safety
Prevent spatial, temporal, initialization, and type-safety errors that can corrupt memory, disclose data, or redirect control flow.
Message Authentication Code (MAC)
Verify message integrity and shared-key origin with a standard MAC while controlling key scope, context, replay, and verification.
Micro-segmentation
The primary security goal of micro-segmentation is to limit which workloads can communicate and reduce lateral movement after compromise.
Migrate one application to zero trust
Replace implicit network access with a named, identity-aware route and verify identity, policy, bypass, evidence, and recovery.
Minimize a Trusted Computing Base
Derive the real trusted set for one security claim, remove accidental trust, and build evidence for every remaining assumption.
Minimize Identity and Access Data
Reduce claims, identifiers, device signals, policy inputs, assertions, logs, and retention to the minimum required for each access decision.
MITRE ATT&CK
MITRE ATT&CK catalogs observed adversary tactics and techniques that can guide hypotheses, detections, and investigations.
Model and Verify a Security Invariant
Turn one access protection need into a precise state model, analyze adverse transitions, and connect the result to deployed evidence.
Model Context Protocol (MCP)
Model Context Protocol is a client-server protocol for context exchange between AI applications and external systems.
Multi-Factor Authentication (MFA)
Require authenticators from distinct factor types and evaluate phishing, enrollment, recovery, and session threats.
Multilevel Security
Enforce mandatory policy when one system processes information and users at different sensitivity and clearance levels.
Mutual Authentication with mTLS
Mutual TLS, or mTLS, is TLS with certificate authentication for both endpoints.
Named Resource Access
Grant access to one named application or service without extending general reachability to its network or neighboring systems.
Network Segmentation
Network segmentation divides a network into logical or physical zones and controls traffic between them.
Nonce and Initialization Vector
Apply the exact uniqueness, unpredictability, length, and state rules that a cryptographic construction requires for each key.
North-South Traffic
North-south traffic crosses an environment or trust boundary, such as traffic between a user and an application or between a private service and the internet.
OAuth 2.0
Learn how OAuth 2.0 separates clients, authorization servers, resource servers, scopes, tokens, PKCE, and current OAuth 2.1 guidance.
OAuth Client Credentials Grant
The client credentials grant issues authority to a confidential client acting for itself, not for a human user.
OAuth Metadata and Discovery
Discover authorization and resource metadata without allowing untrusted issuer, endpoint, key, or resource expansion.
OAuth Resource Indicator
An OAuth resource indicator identifies the protected resource for which a client requests an access token.
Object and Action Authorization
Authorize every application action against the exact object instead of trusting route access, a role, or an object ID.
OpenID Connect (OIDC)
OpenID Connect is an identity layer on top of OAuth 2.0. It lets a client verify an end user's authentication and receive identity claims in an ID token.
OpenID Connect Request Correlation
Bind an OpenID Connect response to the initiating browser, issuer, client, redirect URI, nonce, and authorization request.
Operate access configuration as code
Review, test, deploy, attest, observe, and reconcile access configuration without allowing hidden runtime drift.
Operate Actionable Threat Intelligence
Convert evaluated threat information into owned prevention, detection, hunting, patching, response, and risk decisions.
Operate protocol versions and deprecations
Inventory protocol profiles, detect use, migrate consumers, and remove obsolete versions without permanent compatibility paths.
Operate temporary and break-glass access
Grant short-lived and emergency authority with explicit scope, expiry, approval, monitoring, revocation, and review.
Operate the authorization policy lifecycle
Move access policy from protection need through review, testing, staged deployment, observation, rollback, and retirement.
Operate the credential and key lifecycle
Generate, store, issue, distribute, rotate, revoke, destroy, and recover credentials and cryptographic keys.
Operate token status and revocation
Separate token expiry, introspection, revocation, session termination, and replay response and measure the effective denial time.
OSI Layers
The OSI model is a seven-layer reference model, not a guarantee that each protocol provides reliability.
OWASP (Open Worldwide Application Security Project)
OWASP is the Open Worldwide Application Security Project.
Pass verified identity to an upstream application
Carry signed identity context across a proxy boundary and validate issuer, audience, signature, time, and delivery path upstream.
Passkey
Use WebAuthn public-key credentials bound to a relying party and understand sync, recovery, and device boundaries.
Password Authentication
Evaluate password verification, storage, throttling, compromised values, phishing, reuse, and recovery as one control.
Path Traversal
Prevent attacker-controlled file names and paths from escaping an approved storage root after decoding and canonical resolution.
Per-Request Authorization
Per-request authorization evaluates each action against current identity, resource, policy, and request context immediately before enforcement.
Perimeter
A security perimeter is a boundary where controls inspect or restrict communication. NIST zero trust does not remove firewalls or all network boundaries.
Personal Data and Metadata
Treat identifiers, device facts, access events, relationships, timing, locations, and derived attributes as personal when context can link them to people.
Phishing
Distinguish deceptive delivery from verifier impersonation, credential relay, malware, payment fraud, and session theft, then use protocol controls.
Place access control in a service mesh
Place identity, transport, route, and application policy across mesh gateways, sidecars, ambient proxies, and workloads.
Place the components of a policy system
Place policy administration, information, decision, enforcement, distribution, and evidence components in one access system.
Place zero trust policy components
Place policy administration, decision, information, and enforcement components across control and data planes.
Plan a cryptographic migration
Inventory cryptographic dependencies and migrate protocols, algorithms, keys, certificates, code, hardware, and stored data safely.
Platform Attestation
Appraise fresh signed evidence about a platform through explicit attester, verifier, reference-value, policy, and relying-party roles.
Policy
In access control, a policy is a machine-enforceable set of rules that decides whether a subject can perform an action on a resource under stated conditions.
Policy Administration Point (PAP)
In an XACML-style access control system, the Policy Administration Point creates and manages policy. It does not supply live request context to the PDP.
Policy as Code
Treat access policy as a versioned, reviewed, tested, and observable decision artifact with controlled deployment.
Policy Combining and Conflict
Policy combining defines how allow, deny, not-applicable, indeterminate, inherited, and local results become one decision.
Policy Decision Point (PDP)
A Policy Decision Point evaluates the applicable policies and request attributes and returns an authorization decision. It can be centralized or distributed.
Policy Enforcement Point (PEP)
A Policy Enforcement Point guards a resource and enforces the decision returned by a PDP. It permits, denies, or ends access at the enforcement location.
Post-Quantum Cryptography
Prepare public-key systems for quantum-resistant key establishment and signatures through inventory, standards, testing, and migration.
Preserve Digital Evidence During an Incident
Collect and preserve access evidence with documented integrity, context, custody, privacy, and reproducibility.
Prevent agent token passthrough
Reject tokens issued for another resource and exchange or broker credentials instead of forwarding bearer authority through agents.
Principal-Agent Security Problem
Control delegated security work when the actor has different goals, information, incentives, and accountability from the owner.
Principle of Least Privilege
Limit authority by resource, action, context, and time, then remove access when the assigned function ends.
Privacy Engineering Objectives
Apply systems engineering to make personal-data processing predictable, manageable, and no more associated with people than the purpose requires.
Privacy Risk
Assess data actions that can create problems for people, then combine likelihood and impact without reducing privacy to breach risk.
Privacy-Enhancing Technologies
Select minimization, isolation, cryptography, confidential computation, controlled queries, and formal privacy from a precise data-use threat model.
Privilege Separation
Split a service into components with different authority so compromise of one parser or workflow does not grant the complete service privilege.
Privileged Access Management (PAM)
PAM is the set of controls used to protect, monitor, and audit privileged accounts and privileged sessions.
Prompt Injection
Learn how direct and indirect prompt injection can drive unsafe agent actions, and how least privilege and authorization reduce impact.
Protect application data with cryptography
Choose transport, application, database, filesystem, storage, and in-use protections from the data threat model and key boundary.
Protect private SSH and RDP administration
Design named administrative access with strong identity, narrow routes, native server controls, session limits, and evidence.
Protect the access software supply chain
Verify source, dependencies, builds, provenance, artifacts, deployment, and runtime identity for access components.
Protect the data lifecycle
Control collection, use, sharing, storage, logging, backup, recovery, retention, deletion, and sanitization for one data class.
Protect upstream identity headers from spoofing
Remove untrusted identity fields, authenticate the proxy path, validate signed assertions, and close direct-origin bypass.
Pseudonymization
Replace direct identity with a controlled reference while treating the mapping, stable links, attributes, and auxiliary data as remaining privacy risks.
Public Key Infrastructure (PKI)
PKI is the people, policies, processes, and technology used to issue, validate, renew, and revoke public-key certificates.
Race Condition and TOCTOU
Prevent security decisions from becoming stale before the protected state change, resource use, or authorization commit completes.
Ransomware
Ransomware is malware used to deny access to data or systems and demand payment. Many operators also steal data and threaten disclosure.
Reauthentication and Step-Up
Require fresh or stronger authentication when session age, risk, or a sensitive action exceeds the current assurance.
Recover an access system
Restore known-good identity, policy, trust, routes, evidence, and service after compromise or control failure.
Recovery Time and Recovery Point Objectives
Set and test the maximum target time to restore a service and maximum acceptable data loss after disruption.
Reference Monitor
Evaluate an access-control mechanism for complete mediation, tamper resistance, and evidence-based assurance.
Refresh Token
Use refresh tokens only at the authorization server, bind them to a client, rotate or sender-constrain them, and detect replay.
Relationship-Based Access Control (ReBAC)
Derive permission from typed relationships between subjects, groups, resources, and organizations in an authorization graph.
Replace stored secrets with workload credentials
Separate stored secrets from projected, rotated credentials and reduce exposure through identity-bound delivery and use.
Respond to an identity and access incident
Prepare, investigate, contain, recover, and learn when identity or access authority is abused or compromised.
Revocation Latency
Measure how long a disabled identity, authenticator, session, claim, or permission can continue to authorize action.
Rogue Agent
A rogue agent acts outside its declared goal, approved policy, expected identity chain, or authorized operating boundary.
Role-Based Access Control (RBAC)
Assign permissions to reviewed job or system roles, then assign subjects to roles with constraints and lifecycle controls.
Route
In Pomerium, a route defines how a requester reaches a service behind Pomerium.
Run OAuth authorization code with PKCE
Bind an OAuth authorization code to one client transaction and reject code theft, injection, mix-up, and redirect abuse.
Same-Origin Policy
Understand how scheme, host, and port define a browser origin and limit cross-origin reads, script access, and storage.
SCIM Provisioning
Provision and deprovision accounts and groups without confusing lifecycle synchronization with authentication federation.
Secure a browser session through an identity-aware proxy
Separate identity-provider, proxy, and application sessions while controlling cookies, CSRF, logout, renewal, and origin trust.
Secure Access Service Edge (SASE)
SASE is an architecture that converges wide-area networking and security functions and delivers them as a distributed cloud service.
Secure Boot and Measured Boot
Distinguish code authorization before execution from recorded boot measurements used for later appraisal and recovery.
Secure browser origin boundaries
Design origins, sessions, cross-origin reads, state changes, frames, messages, and scripts as separate browser security controls.
Secure by Design and by Default
Build security into system requirements and architecture, then ship the safest practical configuration as the default.
Secure Enclave
Secure enclave is a general phrase for an isolated execution area, but it is also used in product names such as Apple's Secure Enclave.
Secure Error Handling
Fail safely without bypassing controls, exposing sensitive internals, duplicating effects, or leaving partial security state.
Secure Route Selection
Select a route from trusted authority and path data so an attacker cannot redirect policy or credentials to the wrong upstream.
Secure Sockets Layer (SSL)
SSL 2.0 and SSL 3.0 are obsolete and must not be used. Modern systems use TLS.
Secure Software Development Lifecycle
Integrate security requirements, design review, safe implementation, verification, release controls, and vulnerability response.
Secure Support and Recovery Workflows
Constrain help-desk, authenticator reset, impersonation, exception, federation, and emergency actions as one privileged control plane.
Secure System Decommissioning
Remove a system, route, identity, key, dependency, and data without leaving reachable shadow service or breaking another security control.
Secure the session lifecycle
Design session creation, binding, renewal, expiry, reauthentication, revocation, and termination after sign-in.
Secure Web Gateway (SWG)
An SWG applies policy to user access to internet web services.
Security Alert Triage
Qualify, categorize, prioritize, enrich, assign, and escalate a potential incident from evidence, asset criticality, identity, scope, and impact.
Security and Compliance
Security protects stated assets and properties, while compliance evaluates obligations against defined criteria and evidence.
Security Assertion Markup Language (SAML)
Security Assertion Markup Language 2.0 exchanges authentication, attribute, and authorization decision assertions between federation parties.
Security Assurance and Evidence
Distinguish a control claim, verification, validation, assurance argument, and the evidence that supports each conclusion.
Security Awareness and Behavior Change
Build role-specific learning around real tasks, safe alternatives, practice, feedback, and measured behavior instead of annual completion.
Security Culture for Access Systems
Security culture makes ownership, review, reporting, response, and recovery normal parts of access-system work.
Security Engineering
Design complete systems that keep stated security properties under faults, misuse, and deliberate attack.
Security Incentives and Externalities
Find when the party able to reduce risk does not receive the benefit or bear the loss, then realign cost, authority, and feedback.
Security Information and Event Management (SIEM)
Security information and event management collects, normalizes, stores, searches, and correlates security-relevant event and log data from multiple sources.
Security Kernel
Understand the small privileged mechanism that implements a reference monitor and controls access to system resources.
Security Keys
A security key is a roaming or dedicated hardware cryptographic authenticator, such as a USB, NFC, or Bluetooth key.
Security Misconfiguration
Prevent unsafe defaults, unnecessary features, exposed diagnostics, excessive authority, and configuration drift across environments.
Security Policy and Mechanism
Separate the rule that states allowed behavior from the components that decide, enforce, and record it.
Security Postmortem
A security postmortem turns an incident timeline, contributing conditions, and response evidence into owned system changes.
Security Properties
Distinguish confidentiality, integrity, availability, authenticity, accountability, and privacy in a system claim.
Security Risk
Connect a credible threat, likelihood, consequence, uncertainty, and stakeholder impact to an explicit risk decision.
Security Support and Recovery Workflow
Treat support, enrollment, authenticator replacement, policy exception, impersonation, and emergency recovery as high-authority security controls.
Security Telemetry
Security telemetry uses logs, metrics, traces, and events to answer defined detection, investigation, and control questions.
Security Time and Freshness
Use clocks, expiries, nonces, sequence, versions, and replay state without treating wall time as a complete ordering or trust source.
Security Understandability
Make the system, its authority, dependencies, state, failure behavior, and evidence clear enough to change and operate safely.
Sensitive Security Logging
Record useful access evidence while preventing credentials, excess personal data, tampering, and indefinite retention.
Separate device identity from device posture
Distinguish the device, its key, ownership, management state, health evidence, policy, and freshness limits.
Separate DNS from service identity
Trace resolution, routing, certificate names, endpoint authentication, and failover without treating DNS as identity.
Separate MCP transport security boundaries
Separate remote Streamable HTTP authorization from local stdio process, executable, environment, and operating-system security.
Separate three different access decisions
Trace authentication, gateway route authorization, and application permission as separate decisions with separate evidence.
Separate zero trust from ZTNA
Distinguish a resource-centered security architecture from a product pattern that brokers selected remote access.
Separation of Duties
Split incompatible authority across independent people or roles so one actor cannot complete a sensitive process alone.
Separation of Privilege
Require independent conditions, authorities, or actors before the system permits a sensitive action.
Server-Side Request Forgery (SSRF)
Prevent untrusted input from making a server reach internal services, cloud metadata, local files, or other unapproved destinations.
Shared Responsibility for Access
Shared responsibility assigns each access control, dependency, decision, evidence source, and recovery action to an owner.
Side-Channel Attack
Analyze information leaked through time, caches, memory access, power, emissions, sound, faults, resources, and error behavior.
Signed Header
Pomerium's signed header is the X-Pomerium-Jwt-Assertion header.
Single Sign-On (SSO)
SSO lets a user authenticate through one identity service and then access several relying applications without entering credentials at each application.
Social Engineering
Model deception and influence that cause a person or process to disclose information, change identity state, or perform an unauthorized action.
Software Defined Perimeter (SDP)
A software-defined perimeter hides protected services from unauthorized requesters and establishes identity-controlled connectivity.
Software Supply Chain Evidence
Distinguish component inventory, build provenance, attestations, signatures, and the policy that verifies them.
Software-Defined Networking (SDN)
Software-defined networking separates programmable control functions from the packet-forwarding plane through defined abstractions and interfaces.
Software-Defined Wide Area Network (SD-WAN)
SD-WAN uses a software-controlled policy layer to steer WAN traffic across one or more underlays such as broadband, cellular, and MPLS.
SQL Injection
Keep untrusted values separate from SQL structure with parameterized queries, allowlisted identifiers, and narrow database authority.
SSH Protocol
SSH authenticates a server and client, then multiplexes sessions, commands, and forwarding channels over one transport.
Stale Authorization Context
Find authorization decisions that outlive the identity, relationship, policy, resource state, or request they evaluated.
Stateless
A stateless service does not keep server-side session state between requests.
System Hardening
Reduce a deployed system to required services, identities, interfaces, privileges, configurations, and recovery paths, then keep it there.
Test application authorization
Verify object, property, action, workflow, tenant, and administrative authorization with a systematic identity and state matrix.
Test authorization policy as a decision system
Build deterministic authorization tests for allow, deny, boundaries, conflicts, failures, stale context, and bypass paths.
Test Backup, Restore, and Clean Rebuild
Prove that access systems can meet recovery objectives without restoring compromised authority, code, policy, or data.
Test common authentication attacks
Distinguish and test guessing, stuffing, spraying, phishing, MFA fatigue, recovery abuse, and session theft.
Threat Hunting
Proactively test a bounded threat hypothesis in existing evidence when no alert has yet confirmed the activity.
Threat-Model a Human Security Workflow
Model the real people, pressures, interfaces, support paths, incentives, and technical controls around one high-impact security task.
Threat-model a multi-cloud access path
Trace human and workload identity across clouds and find direct, federation, routing, control-plane, and recovery bypass paths.
Threat-model an identity-aware access path
Trace one protected request, find trust boundaries and bypass paths, and test which access decisions belong at the gateway and application.
Threat, Vulnerability, and Attack
Distinguish a possible harmful event, a weakness, an attempted exploit, exposure, consequence, and impact.
Token Exchange
Exchange an incoming security token for narrow target authority while preserving subject, actor, audience, and delegation semantics.
Token Issuer and Audience
Accept a token only from a trusted issuer and only at the resource audience for which the token was issued.
Tool
In Model Context Protocol, a tool is a callable capability that a server exposes with a name, description, and input schema.
Tool Discovery and Schema Trust
Treat tool names, descriptions, schemas, annotations, outputs, and discovery changes as untrusted supply-chain input.
Tool Misuse
Stop an agent from using a legitimate tool with harmful targets, arguments, sequences, volume, or delegated authority.
Tool Surface Area
Tool surface area is the full set of operations, inputs, external resources, and privilege effects that tools make available to an agent.
Trace a SAML federation flow
Trace identity provider, service provider, metadata, bindings, assertions, signatures, audience, correlation, and logout.
Trace an identity-aware application request
Trace DNS, TLS, authentication, session, route, policy, upstream, application authorization, response, and evidence.
Trace Kubernetes control-plane access
Trace Kubernetes API transport, authentication, authorization, admission, persistence, and audit for human and workload requests.
Trace network reachability for access systems
Trace addresses, prefixes, routes, ports, translation, names, and firewalls without confusing reachability with identity.
Trace the digital identity lifecycle
Follow identity proofing, enrollment, authenticators, federation, sessions, account changes, recovery, and termination.
Trace the human-agent-tool identity chain
Trace one agent action from human intent through agent, client, server, tool, credential, target resource, and evidence.
Trace TLS 1.3 through an access system
Trace TLS 1.3 authentication, key establishment, record protection, termination, and early-data risk across an access path.
Traffic Analysis
Infer participants, relationships, activity, protocol, content class, and events from communication timing, direction, size, frequency, and routes.
Triage and Investigate Security Alerts
Turn an access alert into a supported finding, a bounded response decision, and useful feedback for the detection.
Trust Boundary and Data Flow
Map where data or authority crosses between components with different control, identity, or assurance assumptions.
Trusted Computing Base
Identify every component whose correct behavior is necessary for a stated security property, then reduce and verify that trusted set.
Trusted Execution Environment (TEE)
A TEE is an execution environment isolated from software outside the TEE. It protects selected code and data against a defined set of threats.
Turn protection needs into access requirements
Derive testable security objectives, requirements, invariants, controls, and evidence for one protected action.
Unexpected Agent Code Execution
Keep model output, tool arguments, generated code, interpreters, and sandboxes from becoming uncontrolled host execution.
Unsafe Deserialization
Treat serialized objects as untrusted data and prevent input from selecting executable types, constructors, hooks, or object graphs.
Upstream and Downstream
Upstream and downstream describe direction relative to one intermediary, so the reference point must be explicit.
Usable Security
Make the secure action effective, efficient, understandable, accessible, recoverable, and compatible with the person's real task.
Use east-west and north-south traffic as topology
Use traffic direction to describe topology, then make identity and resource decisions independently.
Use network controls in zero trust
Keep routing, segmentation, firewalls, naming, transport protection, and availability controls without using location as trust.
Validate an OpenID Connect sign-in
Trace OpenID Connect sign-in and validate issuer, client, redirect, state, nonce, ID token, and access-token boundaries.
Validate an X.509 certificate path
Validate X.509 paths, service names, key usage, constraints, time, and revocation without expanding the trust boundary.
Validate and encode untrusted data
Build typed validation, canonicalization, parameterization, sanitization, and output encoding at every application boundary.
Validate JOSE objects safely
Separate JWT claims, JWS signatures, JWE encryption, and JWK key data and apply a fixed validation policy.
Virtual Private Network (VPN)
A VPN creates an encrypted tunnel over another network. Remote-access VPNs connect an endpoint to a private network. Site-to-site VPNs connect networks.
Vulnerability and Exploit
Distinguish a software weakness, exploitable vulnerability, exploit path, exposure, and resulting security impact.
Warning Fatigue and Habituation
Prevent repeated low-value prompts and alerts from training people to approve, dismiss, mute, or bypass security decisions.
WebAuthn
WebAuthn is a W3C API for creating and using public-key credentials scoped to a relying party.
WebSocket Access
WebSocket access starts with an HTTP upgrade and then carries long-lived bidirectional messages on one connection.
Workload Attestation
Use platform evidence to select a workload identity without treating mutable labels or network location as proof.
Workload Identity
Learn how workload, machine, service, and non-human identities differ from user identity, and how to scope machine-to-machine access.
Zero Trust
Zero trust does not assume that every user or device is malicious.
Zero Trust Network Access (ZTNA)
ZTNA is an access approach that applies zero trust principles to connections between subjects and specific private resources.
Zero Trust Trust Algorithm
A zero trust trust algorithm combines subject, resource, action, context, policy, and confidence into an access decision.
No resources match this search
Try a shorter phrase or choose all topics.
