Skip to main content
Version: 1.0

Glossary

Definitions of terms used throughout the PBAC documentation.

Access token​

An opaque token issued by PBAC after policy evaluation; presented to Resource Servers to access protected resources. (Getting tokens)

Authorization code​

A short-lived, single-use code issued during the authorize flow, exchanged at /token for tokens. Bound to a redirect URI and PKCE verifier. (Getting tokens)

AuthZEN​

An open standard for direct access evaluation. PBAC exposes /access/v1/evaluation for subject/action/resource queries without OAuth flows. (AuthZEN guide)

Bundle​

A gzipped tarball of Rego policies and data.json served by PBAC at /bundles/pbac/bundle.tar.gz. OPA polls this to stay synchronized. (OPA setup)

CIMD​

Client ID Metadata Document. A zero-config registration method where client_id is a URL and PBAC fetches metadata to create a transient client. (Clients)

Client​

Any application registered with PBAC that requests or validates tokens -- web apps, services, or AI agents. (Clients)

Client credentials grant​

OAuth flow for machine-to-machine auth. The client authenticates and receives a token with no user involved. (Getting tokens)

Composite token​

In token exchange, a token carrying both the original subject (sub) and the delegating agent (act.sub). (Token exchange)

DCR​

Dynamic Client Registration (RFC 7591). Clients self-register at /register with a software statement or as a public client. (Registering software)

Denylist​

Blocked entities (client IDs, subjects, issuers, domains) in policy data. Changes take effect on next OPA poll -- no restart needed. (Policy)

DPoP​

Demonstrating Proof of Possession (RFC 9449). Binds tokens to a client's private key via a proof JWT in the DPoP header. (Getting tokens)

Extension hook​

A custom Rego rule in evaluations_ext.rego or register_ext.rego that extends built-in policy. (Rego for PBAC)

Grant type​

The OAuth mechanism used to obtain a token: client_credentials, authorization_code, refresh_token, or token exchange. (Getting tokens)

ID token​

An OIDC JWT (RS256-signed) with claims about the authenticated user. Issued during authorization code flow with openid scope.

IdP​

Identity Provider. An external OIDC service (Okta, Azure AD, Keycloak) that authenticates users. PBAC federates with multiple IdPs. (Clients)

Introspection​

Token validation via /introspect. Resource Servers send a token + context and receive active: true/false with scopes and obligations. (Introspection guide)

JIT single-use token​

A token marked by policy with jit_single_use: true -- revoked after the first introspect call.

Obligation (RS)​

A structured requirement embedded in the introspect response for the Resource Server to enforce (e.g., audit logging, rate limiting, field masking). (Obligations guide)

Obligation (subject)​

A requirement that pauses the authorize flow (e.g., consent redirect, step-up auth) before issuing a token. (Obligations guide)

OIDC​

OpenID Connect. An identity layer on OAuth 2.0 adding ID tokens, UserInfo, and authentication semantics.

OPA​

Open Policy Agent. The external policy engine PBAC uses to evaluate every authorization decision. (How it works)

PAT​

Protection API Token. A token with uma_protection scope that Resource Servers use to call /introspect. (Introspection guide)

PBAC​

Policy-Based Access Control. The IDENTOS authorization server combining OAuth 2.0 with external OPA policy evaluation.

PDP​

Policy Decision Point. OPA serves as the PDP. PBAC stores both PDP input and output with every token for audit.

PKCE​

Proof Key for Code Exchange (RFC 7636). Prevents authorization code interception using a code verifier/challenge pair. Required for public clients.

Policy data​

JSON configuration in OPA as data.oauth. Defines denylists, resource types, IdP selection, and entitlements. Updated via Admin API PATCH. (Policy)

Policy rule​

A Rego file stored in the database and served in the OPA bundle. Defines authorization logic. (Policy)

Public client​

A client (SPA, mobile app) that cannot store secrets. Authenticates via PKCE. (Clients)

RAR​

Rich Authorization Requests (RFC 9396). Fine-grained authorization as JSON objects instead of scope strings. (Getting tokens)

Refresh token​

A long-lived token exchanged for new access tokens. Rotated for public clients (old revoked, new issued). (Getting tokens)

Rego​

OPA's declarative policy language. PBAC policy rules are Rego files served via the bundle. (Rego for PBAC)

Resource indicator​

A URI (RFC 8707) identifying a specific Resource Server. Tokens are bound to resource indicators. (Getting tokens)

Resource Server (RS)​

An API that validates PBAC tokens via /introspect and enforces policy decisions. (First integration)

Resource type​

A category (e.g., urn:example:Patient) with allowed scopes (read, write). Multiple RSes can serve the same type. (Policy)

Scope​

A permission string (read, write) requested by clients and granted by OPA. Validated against resource type registries.

Software statement​

A JWT or JSON declaring client capabilities -- grant types, granted resources, trust level. The primary entitlement mechanism. (Clients)

Token exchange​

RFC 8693 grant. A client exchanges one token for another with narrower scope or different audience — used for agent scope narrowing and cross-domain identity. (Token exchange)

Trust tier​

A custom claim in software statements (e.g., trust_level: "low") used by policy to vary TTLs, scopes, or access. (Clients)

UMA​

User-Managed Access 2.0. Resource owner delegation pattern. PBAC implements resource registration and delegation.

Next steps​