SailPoint Terminology Guide

Comprehensive Definitions, Explanations, and Examples for Identity Governance

Identity Governance and Administration (IGA) relies on a specific vocabulary. This guide
categorizes and explains the essential SailPoint IdentityIQ terms to help you understand
identity lifecycles, access management, and system integration.

1. Core Identity & Access Concepts

Identity
Definition: The digital representation of a user (human or non-human) within SailPoint.
Explanation: Often referred to as an "Identity Cube," it aggregates all accounts, entitlements,
attributes, and roles associated with a specific person across the entire enterprise into a single,
unified view.

Example: John Doe has one Identity in SailPoint, which links to his Active Directory account, his
Salesforce account, and his SAP account.

Identity Attribute
Definition: A specific property or data field associated with an Identity.
Explanation: These attributes describe the user and determine their access. They are usually
sourced from an Authoritative application like HR.

Example: First Name, Last Name, Department, Manager, Job Title, and Location.

Account
Definition: A specific profile or login held by an identity on a target system.
Explanation: While a person has only one Identity, they can have multiple accounts across different
systems. Accounts hold specific privileges (entitlements).

Example: The username "jdoe" in Active Directory or "[Link]@[Link]" in Google Workspace.

 Entitlement
Definition: The most granular unit of access on a specific target application.
Explanation: It defines what an account is allowed to do or see within an application. Entitlements
are often grouped into Roles.

Example: Membership in the "Domain Admins" Active Directory group, or the "View Only" permission in
Salesforce.

Role
Definition: A bundled collection of entitlements across one or multiple applications.
Explanation: Roles simplify access provisioning. Instead of requesting 10 individual entitlements, a
user requests a single Role. SailPoint uses Business Roles (job functions) and IT Roles (system
access).

Example: A "Financial Analyst" role automatically grants access to the general ledger system, a shared
finance folder, and an analytics dashboard.

Account Group
Definition: A collection of accounts within a target system used to assign permissions.
Explanation: This represents the group objects on the target system that grant entitlements when
an account is added to them.

Example: An LDAP Group or an Active Directory Security Group.

2. Systems & Connectivity

Application
Definition: The SailPoint representation of an external IT system.
Explanation: Before SailPoint can manage access on a system, that system must be onboarded as
an "Application" object with configuration details (URLs, credentials).

Example: An application named "Corporate Active Directory" or "Global Workday."

Target System
Definition: The actual external software, database, or directory being managed.
Explanation: While "Application" is the logical object inside SailPoint, "Target System" refers to the
physical or cloud-based system itself.

Example: The actual Oracle Database server or the Microsoft 365 cloud environment.

Connector (Bridge)
Definition: The software component/driver that enables SailPoint to communicate with a
target system.
Explanation: Connectors translate SailPoint's commands (like "create user" or "add access") into
the specific API calls or language that the target system understands.

Example: The JDBC Connector for connecting to databases, or the REST API Connector for web
services.

Authoritative
Definition: An application designated as the absolute source of truth for user identities.
Explanation: Data from authoritative systems is used to create and update Identities in SailPoint.
When someone is hired or fired here, it triggers joiner/leaver processes.

Example: Workday, SAP HR, or Oracle HCM.

Non-Authoritative
Definition: Systems that receive identity data but are not the primary source of truth.
Explanation: These systems usually rely on the authoritative source to dictate who should exist and
what attributes they have.

Example: Active Directory, GitHub, or Jira. (Users are created here only after HR approves them).
3. Rules, Processes & Operations

Workflow
Definition: A multi-step, automated business process within SailPoint.
Explanation: Workflows orchestrate how tasks are routed, whom they go to for approval, and what
automated actions are taken at each step.

Example: LCM (Lifecycle Manager) Provisioning Workflow, which routes an access request to a
manager for approval, then to an IT owner, and finally provisions the access.

Rule
Definition: Custom Java/BeanShell code used to calculate values or define complex logic.
Explanation: When out-of-the-box configurations aren't enough, Rules allow developers to write
scripts that dictate behavior during aggregations, provisioning, or identity creation.

Example: An "Identity Creation Rule" that automatically generates a unique corporate email address
([Link]@[Link]) for a new hire.

Script
Definition: Small snippets of BeanShell code executed inline.
Explanation: Similar to rules, but usually embedded directly within a specific workflow step or form
rather than saved as a standalone, reusable object.

Example: A short script inside a workflow step that checks if the user's title contains the word "Manager".

Deprovisioning
Definition: The process of removing access, disabling, or deleting accounts.
Explanation: This is critical for security. It occurs when a user leaves the company (Leaver process)
or moves to a different department (Mover process).

Example: Disabling an AD account and stripping all Salesforce permissions on a user's termination date.
 Birthright
Definition: Baseline access automatically granted to a user based on their identity
attributes.
Explanation: "Day 1" access that requires no manual requests or approvals. It is automatically
provisioned because the user meets certain criteria.

Example: All employees in the "Finance" department automatically receive an Active Directory account,
an email address, and access to the company intranet.

Password
Definition: The secret string of characters used to authenticate a user.
Explanation: SailPoint has a Password Management module that allows users to reset, change,
and synchronize their passwords across multiple target systems securely.

Example: Resetting an AD password via SailPoint, which simultaneously updates the password in the
mainframe application.

4. Governance & Compliance

Policy
Definition: A set of rules defining what access combinations are dangerous or restricted.
Explanation: Used primarily for Separation of Duties (SoD) to prevent fraud or errors. If an identity
violates a policy, an alert or certification is triggered.

Example: An SoD Policy stating a user cannot have both the "Create Vendor" entitlement and the "Pay
Vendor" entitlement.

Risk
Definition: A calculated metric indicating the potential danger a user's access poses.
Explanation: SailPoint assigns Risk Scores based on attributes (e.g., executives have higher risk)
and entitlements (e.g., admin access increases risk). High risk triggers stricter audits.

Example: A contractor with Domain Admin rights will have a much higher Risk Score (e.g., 850) than a
regular employee with standard access (e.g., 150).
 Audit
Definition: The recording and reviewing of identity events and access changes.
Explanation: SailPoint logs who requested access, who approved it, and when it was granted. This
data is critical for compliance reporting (e.g., SOX, GDPR).

Example: An external auditor reviews SailPoint audit logs to ensure all database administrative access
was approved by a Director.

5. User Interface & Organization

Dashboard
Definition: The customizable home screen in the SailPoint UI.
Explanation: It displays widgets containing actionable items, metrics, charts, and shortcuts tailored
to the logged-in user.

Example: A manager's dashboard shows a pie chart of team risk scores and a widget listing 5 pending
access approvals.

Workitem
Definition: A task or action assigned to a specific user or group that requires human
intervention.
Explanation: Workitems pause workflows until a human completes the required action (approving,
delegating, or manually completing a task).

Example: An Access Request Approval routed to a manager, or a manual provisioning ticket sent to the
Helpdesk.

Form
Definition: A user interface element used to collect information from a user.
Explanation: Forms are displayed during workflows to gather necessary parameters that the
system can't calculate automatically.

Example: A "New Contractor" form that asks the sponsor to input the contractor's end date and required
laptop type.
Capability
Definition: The internal permissions dictating what a user can do inside SailPoint.
Explanation: While entitlements define access on *target systems*, Capabilities define what menus,
buttons, and actions a user can see *inside the IdentityIQ application*.

Example: The "SystemAdministrator" capability allows a user to configure the system, while the
"Certifier" capability only allows a user to perform access reviews.

Quicklink
Definition: UI shortcuts that launch specific workflows or pages.
Explanation: Configured to give users rapid access to their most frequent tasks from menus or the
dashboard.

Example: A Quicklink labeled "Request Access" or "Reset Password."

Population
Definition: A dynamically generated subset of identities based on a search filter.
Explanation: Populations are used for reporting, analytics, or targeting specific users for
certification campaigns.

Example: Creating a Population of "All users where Department = 'Finance' AND Status = 'Active'".

Group
Definition: Can refer to Workgroups in SailPoint, which are collections of users sharing
tasks.
Explanation: Within the IIQ UI, Workgroups are used to pool approvals or workitems so that any
member of the group can claim and complete the task.

Example: An "IT Helpdesk Group." If an access request needs IT approval, it is routed to this group, and
any helpdesk agent can approve it.