Design Security for Real Human Systems
Build security that survives deception, pressure, support, recovery, insider authority, poor incentives, and daily work.
Topic index
Identity and Authentication
Learn how systems establish identity and verify users, services, devices, and agents.
Topic index
Understand this domain
Pomerium coverage
Pomerium can use its Hosted Authenticate Service or a configured OpenID Connect provider. It can evaluate verified claims, device identity, and external data in route policy. Pomerium Enterprise and Zero also provide service accounts for machine-to-machine requests.
Limits
- Authentication proves an identity result. It does not grant every action to that identity.
- A device identifier is not full operating-system posture.
- A workload identity does not preserve a human actor unless the design carries separate delegation context.
Primary sources
3 learning paths
Paths for this topic
Engineer Privacy into Identity and Access Systems
Control personal data, metadata, identifiers, correlation, telemetry, inference, release, retention, and deletion across access systems.
Identity lifecycle and authentication
Design proofing, enrollment, authenticators, sessions, recovery, federation, and non-human identity as one system.
18 related guides
Guides in this topic
Build SPIFFE workload identity
Trace SPIFFE IDs, SVIDs, trust domains, bundles, Workload API delivery, attestation, rotation, and federation.
Contain compromised access
Disable identity, revoke credentials and sessions, isolate routes, and measure the last accepted harmful action.
Design human and non-human identity lifecycles
Give people, services, workloads, devices, and agents distinct identity, delegation, credential, and revocation models.
Design multi-IdP routing and account linking
Route sign-in across identity providers without issuer confusion, account collision, unsafe linking, or recovery bypass.
Design service-to-service access
Authenticate workloads, preserve human actor context, authorize target actions, and manage machine credentials through their lifecycle.
Evaluate WebAuthn and passkeys
Trace WebAuthn registration and authentication across relying party, browser, authenticator, origin, and user verification.
Federate workload identity without static keys
Exchange attested platform identity for short-lived target credentials without copying long-lived cloud keys into workloads.
Minimize Identity and Access Data
Reduce claims, identifiers, device signals, policy inputs, assertions, logs, and retention to the minimum required for each access decision.
Pass verified identity to an upstream application
Carry signed identity context across a proxy boundary and validate issuer, audience, signature, time, and delivery path upstream.
Run OAuth authorization code with PKCE
Bind an OAuth authorization code to one client transaction and reject code theft, injection, mix-up, and redirect abuse.
Secure a browser session through an identity-aware proxy
Separate identity-provider, proxy, and application sessions while controlling cookies, CSRF, logout, renewal, and origin trust.
Secure Support and Recovery Workflows
Constrain help-desk, authenticator reset, impersonation, exception, federation, and emergency actions as one privileged control plane.
Secure the session lifecycle
Design session creation, binding, renewal, expiry, reauthentication, revocation, and termination after sign-in.
Separate device identity from device posture
Distinguish the device, its key, ownership, management state, health evidence, policy, and freshness limits.
Test common authentication attacks
Distinguish and test guessing, stuffing, spraying, phishing, MFA fatigue, recovery abuse, and session theft.
Trace a SAML federation flow
Trace identity provider, service provider, metadata, bindings, assertions, signatures, audience, correlation, and logout.
Trace the digital identity lifecycle
Follow identity proofing, enrollment, authenticators, federation, sessions, account changes, recovery, and termination.
Validate an OpenID Connect sign-in
Trace OpenID Connect sign-in and validate issuer, client, redirect, state, nonce, ID token, and access-token boundaries.
47 related terms
Concepts in this topic
2FA Authenticator
A 2FA authenticator is an authenticator used as one factor in a two-factor authentication process.
Account Recovery
Restore account access without giving attackers an easier path than the normal authentication and enrollment process.
Actor, Subject, and Principal
Separate the real-world actor, active subject, represented principal, digital identity, and account.
Agent Identity and Privilege Abuse
Prevent an agent from using a shared, wrong-user, stale, or excessive identity to act beyond the current delegated task.
Attribute, Claim, and Assertion
Separate a source fact, a released claim, and a protected statement sent between an issuer and relying party.
Authentication
Verify that a claimant controls one or more authenticators bound to an account without confusing that result with authorization.
Back-channel logout
OpenID Connect Back-Channel Logout lets an OpenID Provider notify a relying party through a direct server-to-server request.
Biometric Authentication
Use noisy, non-secret human characteristics only within a bounded authenticator, sensor, matching, privacy, fallback, and recovery design.
Credential and Authenticator
Distinguish a bound credential, an authenticator, its secret or key, a factor type, and protocol output.
Delegation
Delegation gives an actor limited authority to act for another principal, called the subject.
Device Posture
Device posture is the current security state of a device.
Digital Identity Assurance Levels
Select and distinguish identity, authentication, and federation assurance levels for a digital service.
Explicit Delegation
Explicit delegation records a deliberate grant from a subject to an actor with a named audience, actions, lifetime, and authorization evidence.
Front-channel logout
OpenID Connect Front-Channel Logout uses the user's browser to load registered relying-party logout URIs from the OpenID Provider.
Identifier, Account, Record, and Person
Separate a label, system account, directory record, and real person before joining identity across systems.
Identity and Access Management (IAM)
Identity and access management uses governance, processes, and technology to establish digital identities and control their access to resources.
Identity Collapse
Identity collapse occurs when a downstream service sees a common agent or service identity and loses the originating user or actor relationship.
Identity Federation
Establish trust between an identity provider and relying party without treating an assertion as universal authority.
Identity Proofing and Enrollment
Resolve a claimed real-world identity, validate evidence, verify the applicant, and bind the result to an account.
Identity Propagation
Identity propagation carries verified information about the originating principal and, when needed, the acting service across request boundaries.
Identity Provider (IdP)
An identity provider establishes an authentication event and creates a verifiable assertion for a relying party in an identity federation.
Joiner, Mover, and Leaver Lifecycle
Create, change, and remove identity and access state when a person or workload enters, changes, or leaves a role.
JSON Web Token (JWT)
Learn how JSON Web Tokens carry signed or encrypted claims, which checks a receiver must make, and how Pomerium uses a signed identity assertion.
Kubernetes Service Account
Use bounded, short-lived Kubernetes service-account tokens for a workload and avoid static namespace-wide credentials.
LDAP (Lightweight Directory Access Protocol)
Lightweight Directory Access Protocol (LDAP) is an Internet protocol for clients to access directory services that follow X.500 data and service models.
MCP Authorization
Learn how MCP authorization uses OAuth metadata, resource indicators, token audience checks, route policy, and tool authorization.
Multi-Factor Authentication (MFA)
Require authenticators from distinct factor types and evaluate phishing, enrollment, recovery, and session threats.
Mutual Authentication with mTLS
Mutual TLS, or mTLS, is TLS with certificate authentication for both endpoints.
OAuth 2.0
Learn how OAuth 2.0 separates clients, authorization servers, resource servers, scopes, tokens, PKCE, and current OAuth 2.1 guidance.
OAuth Client Credentials Grant
The client credentials grant issues authority to a confidential client acting for itself, not for a human user.
OpenID Connect (OIDC)
OpenID Connect is an identity layer on top of OAuth 2.0. It lets a client verify an end user's authentication and receive identity claims in an ID token.
OpenID Connect Request Correlation
Bind an OpenID Connect response to the initiating browser, issuer, client, redirect URI, nonce, and authorization request.
Passkey
Use WebAuthn public-key credentials bound to a relying party and understand sync, recovery, and device boundaries.
Password Authentication
Evaluate password verification, storage, throttling, compromised values, phishing, reuse, and recovery as one control.
Phishing
Distinguish deceptive delivery from verifier impersonation, credential relay, malware, payment fraud, and session theft, then use protocol controls.
Reauthentication and Step-Up
Require fresh or stronger authentication when session age, risk, or a sensitive action exceeds the current assurance.
Refresh Token
Use refresh tokens only at the authorization server, bind them to a client, rotate or sender-constrain them, and detect replay.
Revocation Latency
Measure how long a disabled identity, authenticator, session, claim, or permission can continue to authorize action.
SCIM Provisioning
Provision and deprovision accounts and groups without confusing lifecycle synchronization with authentication federation.
Security Assertion Markup Language (SAML)
Security Assertion Markup Language 2.0 exchanges authentication, attribute, and authorization decision assertions between federation parties.
Security Keys
A security key is a roaming or dedicated hardware cryptographic authenticator, such as a USB, NFC, or Bluetooth key.
Security Support and Recovery Workflow
Treat support, enrollment, authenticator replacement, policy exception, impersonation, and emergency recovery as high-authority security controls.
Security Time and Freshness
Use clocks, expiries, nonces, sequence, versions, and replay state without treating wall time as a complete ordering or trust source.
Single Sign-On (SSO)
SSO lets a user authenticate through one identity service and then access several relying applications without entering credentials at each application.
WebAuthn
WebAuthn is a W3C API for creating and using public-key credentials scoped to a relying party.
Workload Attestation
Use platform evidence to select a workload identity without treating mutable labels or network location as proof.
Workload Identity
Learn how workload, machine, service, and non-human identities differ from user identity, and how to scope machine-to-machine access.
