Glossary
Core Britive and privileged-access terms used across these guides. Each entry has a stable link — for example /glossary/#checkout — so any page can point to a definition.
- Access Broker
- The Britive component that runs checkout and check-in scripts against a target system to grant and revoke access for resources that have no native cloud IAM (servers, databases, network devices).
- Application
- A connected platform in Britive (AWS, Azure, GCP, Snowflake, Okta, and others) that profiles grant access into.
- Association
- The link between a profile and the environments, environment groups, or resources it grants access to.
- Bridge
- A lightweight relay deployed inside a private network so the Britive Access Broker can reach targets that are not directly reachable from the internet.
- Broker Pool
- A named group of Access Broker workers. Resources are assigned to a pool so any broker in it can service their checkouts, providing redundancy and scale.
- Check In
- Returning access before or at expiry. Britive revokes the granted permissions and ends the session, restoring least privilege.
- Checkout
- Requesting temporary, time-bound access to a profile. Britive grants the profile's underlying cloud permissions for its expiration duration, then revokes them automatically at expiry.
- Continuous Access Evaluation Profile (CAEP)
- Shared Signals event types for changes that affect a user's current access, such as a revoked session or a changed credential.
- Environment
- A distinct account, project, or tenant within an application — for example an individual AWS account or GCP project — that a profile can be scoped to.
- Group Managed Service Account (gMSA)
- A Windows service account whose password Active Directory manages and rotates automatically, with no stored secret to maintain. Used to run the Britive Access Broker on a domain-joined host.
- JSON Web Key Set (JWKS)
- The public keys a transmitter publishes so that receivers can verify the signatures on its Security Event Tokens.
- Just-in-Time Access (JIT)
- Granting access only when needed and only for as long as needed, instead of standing (always-on) permissions. The core principle behind Britive profiles.
- Permission
- A specific cloud role, policy, or group attached to a profile that defines the actual entitlements granted on checkout.
- Policy
- Rules that control who can check out a profile and under what conditions — members, approval requirements, IP restrictions, and time-of-access windows.
- Profile (PAP)
- A just-in-time access package tied to an application or resource. Defines which permissions are granted, for how long, and under what conditions. Also called a Britive Access Profile (PAP).
- Receiver
- In Shared Signals, the system that receives security events. Britive is a receiver when it accepts events from a transmitter. A SIEM is a receiver when Britive sends events to it.
- Resource
- A specific target managed through the Access Broker (a server, database, or device) rather than through a cloud application's native IAM.
- Risk Incident Sharing and Coordination (RISC)
- Shared Signals event types for changes to a user's account, such as an account that was disabled, enabled, or deleted, or a compromised credential.
- Security Event Token (SET)
- A signed JSON Web Token (JWT) that carries a security event, defined in RFC 8417. Shared Signals events are sent as SETs.
- Service Identity (SI)
- A non-human identity (application, script, or workload) that authenticates to Britive with a token or federated credential instead of interactive login.
- An OpenID Foundation standard for exchanging security events, such as a revoked session or a disabled user account, between systems as they happen.
- Tag
- An identity group used to assign access at scale. Members (users or service identities) inherit the profiles and policies granted to the tag.
- Transmitter
- In Shared Signals, the system that sends security events. An identity provider is a transmitter when it sends events to Britive. Britive is a transmitter when it sends events to a receiver.