What are the three core processes of an IAM system, and which further processes complete the picture?

Registration (including identification), authentication and authorisation are the core processes; mutation and deletion or blocking (revocation) round them off.

* The three core processes follow the subject's path to the resource; mutation and revocation keep the identity current over its life. *

The core processes follow the subject's path towards a resource:

1. Registration (with identification): the subject is taken into the system and a digital identity is created for it.
2. Authentication: on each access, the subject proves that the presented digital identity is really its own.
3. Authorisation: the system decides whether this authenticated identity may perform the requested operation on the resource.

An IAM system is then defined as all processes and systems that enable subjects to access resources. Two more processes are needed because identities are not static:

• Mutation: attributes, roles and authentication means change over time.
• Deletion or blocking (revocation): the identity or its authentication means are withdrawn, for example when someone leaves or a token is lost.

Tip: Register, authenticate, authorise: the "three A's" of the subject's path, plus change and remove for the life cycle.