IAM, access control and secrets management explained
Learn how identities, permissions and application secrets work together, and how to reduce unnecessary access.
Accounts and applications need access to systems and data. Managing that access requires more than a login screen: teams must know which identity is acting, which actions are permitted, and how credentials are stored and retired.
## What is identity and access management?
Identity and access management (IAM) is the set of processes and technologies used to manage digital identities and their access to resources. Identities may represent people, applications or other non-person entities. IAM includes creating and disabling identities, managing credentials and permissions, and reviewing access over time. The details vary by provider and organization. [NIST's identity and access management glossary](https://csrc.nist.gov/glossary/term/Identity_and_access_management) describes identity and access administration in its source contexts.
Authentication checks evidence for a claimed identity; authorization decides whether an authenticated or otherwise identified subject may perform a particular action. These are distinct even when a product combines them. Single sign-on (SSO) lets a person use an established sign-in across participating services under a trust arrangement; it does not by itself decide every permission. See [our SSO explanation](https://blog.mithril.fund/what-is-single-sign-on?lang=en).
## What is access control?
Access control grants or denies requests to use resources according to rules or policies. A subject could be a user or application, a resource could be a document or database, and an action might be reading or changing it. Enforcement must happen at the resource or a trusted boundary; hiding a button is not sufficient protection. [NIST's access control glossary](https://csrc.nist.gov/glossary/term/access_control) gives several context-specific definitions.
Policies can use identities, roles, resource properties or other attributes. Role-based and attribute-based access control are approaches to expressing policy, not guarantees that every assigned permission is appropriate. Least privilege means giving an identity only the access needed for its authorized tasks, for the time needed; review changes, exceptions, service accounts and emergency access. Authentication success does not imply unlimited authorization.
## What is secrets management?
A secret is sensitive material whose disclosure may enable access or another security-sensitive action: examples include passwords, API credentials, private keys and tokens. A certificate is typically public, while its associated private key must be protected; a certificate can still be tracked in a credential lifecycle. Secrets management is the process and supporting controls for issuing, storing, delivering, rotating and revoking sensitive credentials. CISA describes credential tracking and management in its [cloud use case](https://www.cisa.gov/sites/default/files/2023-05/tic_3.0_cloud_use_case_508c.pdf).
Avoid committing secrets to repositories or embedding them in distributed applications. Prefer short-lived credentials or workload identity when supported, restrict access to secret stores and logs, and audit use. Rotation replaces a credential but does not automatically revoke every copy, invalidate existing sessions or remove an attacker; follow the provider's revocation and incident-response procedures if exposure is suspected. Encryption at rest does not remove the need to control which identities can retrieve a secret.
## Put the concepts together
An application may authenticate as a workload identity, receive permission to read only one data store, and retrieve a scoped secret from an approved store if needed. Inventory identities and credentials, review permissions against business need, test denied paths, remove unused grants and monitor changes. Provider controls, access models and token lifetimes differ, so verify the exact service configuration. For passkeys and password attacks see [our credential security guide](https://blog.mithril.fund/credential-stuffing-password-spraying-passkeys?lang=en). Sources reviewed on 2026-10-30.