Study Guide
Identity and Access Management: Identification and AAA
The four steps of access control in order, why AAA has three As and not four, the kinds of authentication factor, and how identity and access management is the wider discipline around them.
Lesson 1.8 Cybersecurity Foundations
Signing in to something feels like a single action. This lesson takes it apart, because security work depends on knowing exactly which part has gone wrong. It ends with the wider discipline of identity and access management.
Stage: Think
Checking in to a hotel
Think it through
You arrive at a hotel where you have booked a room. List everything that happens between walking up to the desk and opening your room door, including anything the hotel keeps a record of.
- Hint 1: What do you say first? What does the receptionist ask to see?
- Hint 2: Which doors will your key card open, and which will it not?
Show what happens
Most lists contain four separate things: you say who you are, you prove it, you are given access to some places and not others, and your use of the card is recorded.
Think it through
Show the answer
Answer: B. Not yet: saying a name is a claim, not proof.
Saying who you are and proving it are two separate steps. A name is a claim; the passport or the card used to book is the proof.
Stage: Explain
The idea
Think about checking in to a hotel.
- You say who you are: “I have a booking in the name of Khan.”
- The receptionist asks for proof, such as a passport or the card used to make the booking.
- You are given a key card that opens your room and the gym, but not other guests’ rooms or the staff office.
- The door system records each time the card is used.
Those are the four steps of access control, and each answers its own question.
| Step | The question it asks | In one line |
|---|---|---|
| Identification | “Who do you claim to be?” | Presenting an identity, such as a username. |
| Authentication | “Prove it.” | Checking evidence that the claim is true. |
| Authorisation | “What are you allowed to do?” | Deciding which resources and actions that identity may use. |
| Accounting | “What did you do?” | Recording what the identity actually did. |
Check your understanding
Show the answer
Answer: B. Authorisation: what your identity is allowed to use.
Which doors open is authorisation: a decision, made in advance, about what that identity may use.
Stage: Predict
The access-control flow
Think it through
Show the answer
Answer: C. No: each step needs the result of the one before.
The order is fixed by what each step needs. The note under the diagram below says why.
The steps always happen in this order, because each depends on the one before it.
An original diagram with a fictional example. Identification comes first and is not one of the three As; authentication, authorisation and accounting together are AAA.
Comes first · not one of the three As
Identification
“Who do you claim to be?”
A member of staff types their username. Nothing has been proved yet.
AAA · the three As
Authentication
“Prove it.”
They enter their password and approve a prompt on their phone: two different kinds of evidence for the claim.
Authorisation
“What are you allowed to do?”
The system checks the account’s permissions: it may read the finance reports but may not change them.
Accounting
“What did you do?”
The sign-in, each report opened and a refused attempt to save a change are all written to a log.
A system cannot check proof for an identity nobody has claimed, cannot decide permissions for an identity it has not verified, and can only record actions against an identity it knows.
Stage: Explain
The four steps
Identification
Think it through
Show the answer
Answer: A. No: anyone who knows the address can type it.
An email address or username says which account is being claimed. It proves nothing, because other people can know it.
Identification is the claim: stating which identity you are using. It is usually a username, an email address, an account number or a staff ID card.
An identity is the account, person or system being claimed. Identity and authentication are different things. Put simply, identity is what is claimed, and authentication is the proof of that claim. A username proves nothing by itself. Usernames are often easy to guess, and many are public, such as an email address.
Good identification depends on unique identities: one account for each person or service. Non-Repudiation explains what is lost when several people share one account.
Authentication
Authentication is checking the evidence for the claim. If the evidence matches what the system expects, the system accepts that you are who you say you are. That is all it settles. Authentication says nothing about what you may do next.
Authorisation
Once the system knows who you are, it decides what that identity may do: which files, systems and functions it can reach, and which actions it can take with them, such as reading, changing, deleting or administering. These rights are called permissions. They are set in advance, often by placing accounts in roles or groups.
How much to permit is guided by least privilege: give a user, process or system only the permissions required to perform its legitimate task, and no more. Least Privilege develops that principle.
You will often see the American spelling, authorization, in products, standards and exam materials. It is the same word.
Accounting
Accounting is keeping a record of what was done: sign-ins, files opened, changes made and attempts that were refused. It has nothing to do with money. The word is used in the sense of “giving an account” of activity. The same idea is often called auditing or logging.
Accounting records are what make it possible to investigate an incident, to notice misuse and to show afterwards who did what. That last use is non-repudiation. Records only help if they are kept, protected from the people they describe, and actually looked at.
Stage: Predict
Authentication factors
Think it through
Show the answer
Answer: B. No: both are things you know.
Both are things you know, so an attacker who learns them can use both. Proof is counted by kind, as the list below sets out.
The evidence used in authentication comes in different kinds, called factors. The three to learn first are:
- Something you know: a password, a PIN (personal identification number) or a passphrase.
- Something you have: a phone with an authenticator app, a hardware security key or a smart card.
- Something you are: a fingerprint or a face, known as biometrics.
Multi-factor authentication asks for two or more different kinds. A password and a PIN are both things you know, so together they are one factor used twice, not two factors. A password and a code from your phone are two factors, because the second is something you have.
Many systems check a password by comparing a hash of it with a stored copy. A hash is a fixed-length value calculated from the password, designed so that the password cannot practically be worked back from it. The system stores the hash, not the password, and compares hashes when you sign in.
That is one way of checking one kind of evidence. Authentication as a whole is wider: it also includes codes from a device, cryptographic keys and biometrics, and it applies to systems as well as people, for example a server proving its identity to your browser. Describing authentication as “comparing password hashes” describes one common method, not the idea.
Some syllabuses list further kinds of evidence, such as somewhere you are, meaning your location. Learn the three above first.
Stage: Predict
Authenticated is not authorised
Think it through
Show the answer
Answer: B. No: they are signed in, but not permitted to open that.
Nothing has gone wrong. The pupil is authenticated, and authorisation correctly refuses a page that identity may not open.
The most common confusion in this topic is treating a successful sign-in as permission to do anything. A simple example: a user can authenticate successfully and still have only read permission, with write denied.
| What the user tries | Authenticated? | Authorised? | Result |
|---|---|---|---|
| Open the finance report | Yes | Yes: read is permitted | The report opens |
| Save a change to it | Yes | No: write is not permitted | The change is refused |
Nothing has gone wrong in the second row. The system is working as designed: it knows exactly who the user is, and that user is not allowed to change the report. A refused action is not a failed sign-in.
Stage: Predict
Why AAA has three As
Think it through
Three of the four steps are often grouped under the name AAA. Which one do you think is left out, and why?
- Hint 1: Which step happens before any evidence is checked at all?
- Hint 2: Is anything proved, decided or recorded at that step?
Show what happens
Identification is left out. It is only the claim, and nothing is checked, decided or recorded until it has been made.
AAA stands for authentication, authorisation and accounting. Identification is not one of the three. It comes first, because there is nothing to authenticate until an identity has been claimed.
Many explanations fold identification into authentication and call the pair “signing in”, because the username and password are typed on the same screen. Keeping all four apart is useful when something goes wrong, because the symptom tells you which step to look at.
| What you observe | The step involved |
|---|---|
| “Unknown user”: the account name is not recognised | Identification |
| The right username, but the password or code is rejected | Authentication |
| Signed in, then “access denied” on a folder | Authorisation |
| A file was deleted and nobody can tell which account did it | Accounting |
- The call. Priya, in the accounts team, phones the help desk: she cannot get into the payroll folder this morning.
- Ask for the exact message. It reads: “Access denied: you do not have permission to open Payroll 2026.”
- Read the symptom. The message appears after she has signed in, so identification and authentication have both worked. A refusal at this point is authorisation.
- Find the cause. Her account was moved into a new team group on Friday, and that group has no permission on the payroll folder.
- Fix the right step. The owner of the payroll folder confirms that Priya still needs it, and her account is added to the group that has access.
- The result. Priya is back in within minutes. Resetting her password, the usual first reaction, would have changed nothing: her password was never the problem.
Stage: Explain
IAM is the wider discipline
Identity and access management (IAM) is everything an organisation does to manage identities and what they can reach. It covers:
- Identities and accounts: creating them for people, services and devices, and making sure each is unique.
- Roles and permissions: deciding what each kind of user needs, and granting only that.
- Authentication: choosing how identities prove themselves, including where to require more than one factor.
- The access lifecycle: giving access when someone joins, changing it when they move role, removing it when they leave, and reviewing it in between.
AAA describes what happens each time someone uses a system. IAM is the management around those moments, over months and years. If AAA is what happens at the door, IAM is everything that decides who has a key, which doors it opens and when the key is taken back.
Check your understanding
Show the answer
Answer: B. In IAM: the access lifecycle should have removed it.
Each sign-in can work exactly as designed and still let the wrong person in. Taking the key back when someone leaves is IAM, the management around the moments of access.
Applying and reviewing access shows the lifecycle in a worked example, and The NIST Cybersecurity Framework shows where IAM sits among an organisation’s other security work.
When someone reports “I can’t get in”, ask which of the four steps failed before changing anything. Resetting a password does not help a user whose account is not in the right group, and adding permissions does not help a user who is typing the wrong username. In a support role, the quickest route to the right fix is usually the exact wording of the error message.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Did the user get past signing in? If so, which step refused them?
Show the answer
Answer: C. Whether the account was in the group allowed the folder.
The user signed in, so authentication worked. Being refused a folder is an authorisation symptom: check the account’s permissions or groups, not its password.
Apply it
Show the answer
Answer: A. Two: something you have and something you know.
The card is something you have and the PIN is something you know: two different kinds, so two factors.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Identification → authentication → authorisation → accounting
The access-control flow is identification, authentication, authorisation and accounting, in that order, and the order cannot change: each step depends on the one before it. A system cannot check proof for an identity that nobody has claimed, cannot decide permissions for an identity it has not verified, and can only record actions against an identity it knows. The four steps answer four questions: who do you claim to be, prove it, what are you allowed to do, and what did you do.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Show answer
Answer: Authentication, authorisation and accounting
AAA stands for authentication, authorisation and accounting, and identification comes before AAA without being one of the three As. All four steps are often presented as one flow, which is why identification is often counted by mistake. It comes first, because there is nothing to authenticate until an identity has been claimed. Access and availability are not among the three As, and the third A is accounting, even though the activity is often described as auditing.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Show answer
Answer: Identification
Identification is the first step of the access-control flow. Identity is the account, person or entity being claimed, and authentication is proof of that claim. Entering a username is identification: it claims an identity, here a colleague’s, and anyone who knows or guesses a username can type it. Authentication has not happened, because no evidence, such as a password, has yet been checked. Authorisation and accounting come later in the flow, and the user has gone no further.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Show answer
Answer: Authentication succeeded, but the account is authorised to read and not to write
A user may authenticate successfully and still have only read permission, with write denied. Signing in proved the claimed identity, which is authentication. What that identity may then do is authorisation, and it is decided separately. Here the account is permitted to read and not to write, so the system is working as designed. A refused action is not a failed sign-in, and nothing in the description suggests that identification or accounting went wrong.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record)
Show answer
Answer: Accounting
Each symptom points to a step, and being unable to tell which account acted points to accounting, the step that asks what an identity did. Identification is claiming an identity and authentication is proving it, and nothing here suggests that either went wrong. Authorisation decides what an account may do, and the deletion may well have been permitted. What is missing is the record. Without it, the organisation cannot investigate the deletion or show afterwards which account was responsible.
Revision sources: Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Show answer
Answer: A password and a code from an authenticator app on a phone; A fingerprint and a hardware security key
Authentication factors are something you know, something you have and something you are, and multi-factor authentication needs two or more different kinds. A password with a code from a phone combines something you know with something you have. A fingerprint with a hardware key combines something you are with something you have. A password with a PIN, two passwords, and a PIN with a memorable word are all things you know, so each is one kind of factor used twice.
Revision sources: Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Show answer
Answer: IAM is the broader discipline; AAA covers core functions inside it.
IAM is the broader discipline covering identities, accounts, roles, permissions, authentication and the access lifecycle, with AAA representing core access-control functions inside it. AAA is therefore part of IAM, not the other way round, and the two are not different names for the same thing. Nor are they separate halves that do not overlap: authentication, one of the three As, is itself part of managing identities and access. IAM also covers the access lifecycle, which goes beyond any single sign-in.
Revision sources: Identity and Access Management: Identification and AAA (Supplementary Study Guide explanation)
Study and revision
Practise through the Identity & Access topic. Questions cover the order of the four steps, what the three As are, why a username is only a claim, why an authenticated user can still be refused, which step a given symptom points to, counting authentication factors and how IAM relates to AAA; four flashcards recall the order of the steps, what AAA stands for, the question each step answers and the three kinds of factor. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.2 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Four steps, in order: identification (the claim), authentication (the proof), authorisation (what is allowed) and accounting (the record).
- A username is a claim, not proof.
- Factors are counted by kind: something you know, have or are.
- Authenticated is not authorised: a refused action is not a failed sign-in.
- AAA is authentication, authorisation and accounting; IAM manages identities and access over time.
Key terms
- IAM (Identity and Access Management)
The discipline of managing identities and what they can reach: accounts, roles, permissions, authentication and the access lifecycle.
- AAA (Authentication, Authorisation and Accounting)
The three core access-control functions: authentication proves a claimed identity, authorisation decides what it may do and accounting records what it did.
- Identification
Claiming an identity, for example by entering a username, before any proof has been given.
- Authentication
Establishing or verifying a claimed identity, for example when a user signs in.
- Authorisation
Deciding which resources and actions an identity is permitted to use.
- Accounting
Recording what an identity did on a system, such as signing in, opening files, making changes and being refused.
- Authentication factor
A kind of evidence used to prove an identity: something you know, something you have or something you are.
Common misunderstandings
AAA is authentication, authorisation and accounting. Identification comes before the three As and is not one of them.
Signing in is authentication. What you may do afterwards is authorisation, and it is decided separately.
A username is a claim. The proof is the evidence checked during authentication.
Factors are counted by kind. Two things you know are still one factor.
That is one common way of checking one kind of evidence. Devices, keys and biometrics are also used, and systems authenticate as well as people.
Further reading
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 7 (see the Session 7 Learning Log): identification, authentication, authorisation and accounting, presented in that order; the distinction between identity and authentication; and the example of a user who authenticates successfully but has read permission while write is denied.
- Accuracy qualifications: AAA strictly stands for authentication, authorisation and accounting, and identification comes before it without being one of the As. Authentication is not limited to comparing password hashes.
- Supplementary explanation: the hotel comparison, the question for each step, the wording that identity is what is claimed and authentication is the proof, IAM as the broader discipline, the diagram and its example, the description of each step, the factor explanation and the note on hashes, the table of symptoms, the lifecycle description, the practical note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Earlier teaching reused: least privilege was taught in Sessions 1 and 2 and has its own lesson; it also appeared in the Session 7 review questions.
- Fictional examples: the hotel guest and the member of staff opening a finance folder are invented.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the hotel opening questions, every question asked in the lesson with its feedback and hints, the email-address, pet-name, learning-platform, help-desk call, leaver, HR-folder and server-room examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not configured accounts, permissions, authentication or logging as part of this lesson.
The three core access-control functions: authentication proves a claimed identity, authorisation decides what it may do and accounting records what it did.
Recording what an identity did on a system, such as signing in, opening files, making changes and being refused.
Establishing or verifying a claimed identity, for example when a user signs in.
A kind of evidence used to prove an identity: something you know, something you have or something you are.
A secret value that controls what a cipher does. The same algorithm with a different key gives a different result.
A function that turns input of any size into a fixed-length digest. It is one-way and uses no key.
The discipline of managing identities and what they can reach: accounts, roles, permissions, authentication and the access lifecycle.
Claiming an identity, for example by entering a username, before any proof has been given.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.