What Is Identity?
Before tokens and protocols: what a system actually means by 'who'.
By the end of this lesson, define identity precisely and separate it from authentication and authorization.
Identity is not a login box. It is the answer a system gives to a single question: who or what is making this request? Everything else in security — sessions, tokens, permissions — exists to answer that question reliably and then act on the answer.
A digital identity is a set of attributes a system associates with a subject: an identifier, some claims about it, and a way to prove the association is real.
First, see the whole system. Then we’ll open it up.
Identity sits at the front of every request
- A caller presents a credential to the identity layer.
- The identity layer establishes an authenticated subject.
- Authorization decides what that subject may do before the resource is reached.
flowchart LR caller[Caller] -->|presents credential| verify[Identity layer] verify -->|establishes| subject[Authenticated subject] subject --> authz[Authorization] authz --> resource[Resource]
- Subject (principal)
- The entity an identity refers to — a human user, a service, a device, or an agent. Also called a principal.
You know what happens. Now see why it works.
Systems used to trust the network: if you were inside the firewall, you were trusted. That collapses the moment services span clouds, partners, and untrusted networks. Identity replaces 'where the request came from' with 'who the request is from' — the foundation of zero trust.
Identity is the root of the whole domain.
Is 'identity' the same as 'login'?
No. Login (authentication) is the act of proving an identity. The identity is the subject and its attributes that the proof establishes.