Identity and access management
Identity and access management governs who may act. Existence governs whether the known participant is present when that authority is used.
IAM establishes identities, roles, privileges, access policy, lifecycle, and accountability. Existence research adds a separate present-tense condition without replacing the identity or authority that IAM already governs.
The IAM responsibility
An organization must know its people and govern their authority.
Identity lifecycle, provisioning, role assignment, access review, authentication policy, authorization, privileged access, and deprovisioning determine who may receive and exercise organizational authority.
Existence does not create that authority. The organization must already know the participant, assign the participant’s role, and define the actions that role may perform.
The distinction
Who may act and whether that person is present now are separate facts.
An identity may be valid. Its account may be active. Its role may be correct. Its access may have been reviewed. Its credential may authenticate successfully.
Those facts establish governed authority. They do not independently establish that the known participant is present when the authority is exercised at the next protected action.
Identity lifecycle
Existence establishment follows assignment and completes at private arrival.
The EAID is uniquely assigned, activated, and bound to its governed authority relationship. At runtime, it receives current session authority, registers with the organization’s Existence Beacon, reaches the first successful heartbeat, releases the Rendering Agent, and loads the organization’s page. That arrival completes existence establishment.
The organization’s page still applies its own credential, identity, role, and authorization requirements. Activation or possession of the EAID alone never grants application access.
Access authority
RBAC and policy remain authoritative.
Existence does not decide which records a person may read, which application functions a role may invoke, which approvals are required, or which privileged commands are allowed. Those decisions remain with IAM, the application, and organizational policy.
Existence does not determine access. It maintains a separate current condition that the organization may observe after its own credential and authority requirements are satisfied.
Privileged access management
The greater the consequence, the more important the current condition may become.
Privileged actions often receive additional controls because their consequences are broader. Session recording, approval, credential checkout, time limits, and command restrictions can all remain necessary.
A current existence check can be added before a selected privileged action so that valid privilege is not treated as sufficient after the required participant relationship has ended.
Session authority
Application authority and the observed existence condition remain separate.
The Authority Server issues volatile runtime authority to the activated EAID. After private arrival, the existence relationship maintains itself through recurring heartbeat. The Existence Beacon and Oracle observe and record the current result for the organization.
When the relationship collapses, the identity and role still exist, but the previous runtime session no longer has a current existence condition to accompany it. Existence is not application authority.
At the decision point
IAM supplies who and what. Existence supplies whether the required participant relationship is present now.
verify_existence(...)The protected function evaluates the current existence result alongside identity, role, entitlement, approval, device, transaction, and risk policy.
Limits
Presence does not correct poor identity governance.
A present participant may be overprivileged. An account may be improperly provisioned. A role may violate separation of duties. An access review may be incomplete. A trusted person may request an improper action.
Existence cannot repair those defects. It prevents valid identity and authority from being mistaken for a current existence result, and prevents the EAID itself from being described as an access credential.
Related research paths
Identity governance connects to authentication, Zero Trust, and the protected application decision.
Examine the evidence that begins the runtime relationship.
Zero TrustExamine how current identity, device, risk, and presence inputs may be evaluated together.
CybersecurityPlace IAM and current presence within the larger protected-decision problem.
All research topicsReturn to the complete cybersecurity research library.
Organizational examination