What is a "resource" in IAM, who owns it, and who decides who may access it?

A resource is a real-world service or data set (including physical things like buildings controlled through IT) that a resource owner wants to protect; it belongs to a relying party, the application that defines who may access it, when and under which conditions.

Three points are easy to miss:

• Resources are not only files. Anything whose use is governed by an IT system counts, including buildings and industrial plants with electronic access control. IAM therefore reaches into the physical world.
• The resource owner's goal is protection from unauthorised access. That is the mirror image of the subject's goal (getting in), and the tension between the two is what IAM mediates.
• The relying party (RP) speaks for the resource. The RP is the application, app or system that owns the resource and lays down the access rules. IAM services inform the RP about the subject, but the RP makes the final access decision.

Like subjects, resources are also stored in the IAM system as data objects, a digital image of the real thing, so that rules can refer to them.