What is a "subject" in IAM, what kinds of subjects exist, and how is a subject represented inside the system?

A subject is a real-world entity with identifying properties that wants to access a resource; it can be a natural person, a group, an organisation or a machine, service, thing or AI agent, and it is stored in the IAM system as a data object, its digital identity.

The word is chosen deliberately: "user" would be too narrow. Subjects come in several forms:

• Natural persons (synonyms: user, Benutzer)
• Groups of subjects
• Organisations, i.e. legal persons
• Machines, services, things and AI agents, which increasingly outnumber the humans

From the IAM point of view a subject has exactly one goal: to reach a resource. The subject itself lives in the real world; what the IAM system holds is a data object representing it, the electronic or digital identity. Keeping "subject" (real) and "digital identity" (data) apart is the first habit to build, because one subject can have many digital identities.