Glossary
Entitlement
An entitlement is one specific thing an account is allowed to do in a system, such as holding a role or belonging to a group.
The account and the thing it holds
An account is the holder. An entitlement is what it holds. In Keycloak that is a role, a composite role or a group membership. In GitHub it is a permission on a repository or a team. In AWS it is a policy attached to a user or a role. Identity governance tools use the word entitlement for all of them, so one list can cover many systems.
Why it matters in an access review
A review is a set of decisions, and each decision is about one entitlement held by one account. A reviewer can only judge what they can read. A name like finance-power says little. A name with a plain line about what it allows says more.
Three facts make entitlements harder than they look.
- Many entitlements are bundles. A Keycloak composite role contains other roles. An AWS group carries policies. Holding one entitlement can mean holding dozens of permissions.
- The same permission can arrive by two routes. A person can hold a role directly and also through a group. Both routes count. Remove one and the other still grants it.
- Not all of them are assigned directly. A person inherits entitlements from groups, and from the bundles inside other entitlements. A list of what was assigned to the person leaves these out.
An example
In Keycloak, Dana belongs to the group /Finance/Admins. That group holds the role finance-power. That role contains payments-admin, which contains billing-admin. Her entitlement list should show billing-admin, and it should show the route: group, then bundle, then bundle. The guide on how to run a user access review in Keycloak shows how to get that list.
Common mistakes
- Listing only what was assigned directly.
- Using names so vague that a reviewer cannot judge them.
- Counting one entitlement once when it arrives by several routes, so that a removal looks finished when it is not.
- Confusing the entitlement with the account that holds it.