> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lumos Glossary

Common terms and acronyms you'll see in Lumos and in these docs, in alphabetical order.

| **Term** | **Definition** |
| - | - |
| ABAC (attribute-based access control) | Granting access based on attributes such as department, location, or employment type. |
| Access policy | A rule that grants a set of apps and permissions to everyone who matches certain attributes. Access policies drive birthright access during onboarding and role changes. |
| Access request | A request from a user to get access to an app or permission through the AppStore. |
| Access Request Agent | An AI assistant in the AppStore that chats with a user to build a least-privilege access request. |
| Access review | A campaign where reviewers confirm or revoke who has access to an app. Often run for audits such as SOX or SOC 2. Also called a user access review (UAR). |
| Account | A user's login or record inside one connected app. Lumos links accounts to identities. |
| Account matching | Rules that tell Lumos how to link an app account to the right identity, for example by email or employee ID. |
| Activity Log | A record of events in your Lumos tenant. You can use it as audit evidence. |
| Agentic access reviews | AI recommendations in an access review that explain what access a person has and suggest a decision. |
| Albus | Lumos's AI assistant. It answers questions about your access data and can help draft access policies. |
| App | Any application you track in Lumos. An app can exist without an integration. |
| App Admin | The person assigned to manage an app in Lumos. App Admins handle manual provisioning, approvals, and access review assignments for that app. |
| AppStore | The self-service catalog where employees request access to apps and permissions. |
| Approver | A person who must approve an access request before access is granted. |
| Attribute | Data about an identity, such as department, title, or manager. Lumos pulls attributes from your source of truth. |
| Birthright access | The access a person gets automatically when they join, based on your access policies. |
| Circuit breaker | A safety check that pauses a sync or workflow when it would change an unusually large share of accounts at once. |
| CSM (Customer Success Manager) | Your main point of contact at Lumos. |
| Custom app | An app with no built-in integration. You load its accounts and permissions by CSV upload or a custom connector. |
| Delegation | A setting that sends your approvals to someone else for a date range, for example while you're out of office. |
| Delta review | An access review that shows only what changed since your most recently completed review, so reviewers don't re-check the same access. |
| Deprovisioning | Removing a permission, or disabling or deleting an account, in an app. |
| Entitlement | An attribute that describes a user in some way. It may relate to their access in an app. Unlike a permission, an entitlement doesn't necessarily grant a level of access by itself. |
| Escalation policy | A rule that reassigns a request or review item when the assigned person doesn't act in time. |
| Identity | A person, or a non-human actor, that Lumos tracks across your apps. One identity can own accounts in many apps. |
| Identity Agent Force | AI agents that look for identity risks across your environment and suggest fixes. |
| Identity type | A label on an identity, such as human or service account. Lumos uses it to filter and govern identities. |
| IdP (identity provider) | The system your company uses to manage sign-in and user identities, such as Okta, Microsoft Entra ID, or Google Workspace. |
| Inactivity workflow | An automation that finds unused accounts, notifies the right people, and then reclaims the access or license. |
| Integration | A live connection that lets Lumos read accounts and permissions from an app, and often make changes in it. Also called a connector. |
| ITSM (IT service management) | Your IT ticketing tool, such as ServiceNow or Jira Service Management. An ITSM integration creates or updates tickets for Lumos requests and tasks. |
| JIT (just-in-time) access | See time-based access. |
| JML (joiner, mover, leaver) | The three lifecycle events. A joiner is a new hire, a mover changes roles, and a leaver departs. |
| Knowledge Hub | A library of context about your apps and permissions that Lumos AI features use. Lumos builds it automatically, and you can edit it. |
| LCM (Lifecycle Management) | Automating access through onboarding, role changes, and offboarding. |
| Least privilege | Giving people only the access they need to do their job. |
| Lumos Admin MCP | An MCP server that lets AI tools such as Claude work with your Lumos data. |
| Lumos Launchpad | The guided self-implementation program in the Lumos app. It walks you through setup in four modules: Foundation, AppStore, Access Reviews, and Lifecycle Management. |
| Lumos University | Training courses and certifications for learning Lumos. |
| Manual task | A step a person must complete by hand, such as creating an account in an app with no integration. |
| MCP (Model Context Protocol) | A standard that lets AI agents call tools and data sources. |
| MCP Governance | Controls over which tools your AI agents can call through MCP servers, plus visibility into what they did. |
| NHI (non-human identity) | An identity that isn't a person, such as a service account, API key, bot, or AI agent. |
| On-premise agent | Software you run in your own network so Lumos can connect to systems it can't reach over the internet, such as Active Directory. |
| PAM (privileged access management) | Controls for high-risk admin access. |
| Permission | A specific level of access granted to someone inside an app, such as a role or group. Not the same as an entitlement. |
| Permission tags | Labels you add to permissions so you can group, filter, or scope them, for example in access reviews. |
| Pre-approval rule | A rule that approves certain requests automatically, for example by department. |
| Provisioning | Creating an account or granting a permission in an app. |
| Provisioning workflow | The automated or manual steps Lumos runs to grant or remove access for an app. |
| RBAC (role-based access control) | Granting access based on a person's job role. |
| Reviewer | The person assigned to approve or revoke access items in an access review. |
| Role mining | Analyzing real access data to suggest roles and access policies. |
| SCIM (System for Cross-domain Identity Management) | A standard that apps use to create and remove user accounts automatically. |
| Service account | An account used by a system or integration instead of a person. |
| Source of truth | The systems Lumos uses to decide who your people are and what their attributes are. Identities created by your source of truth are the people Lumos treats as members of your org. |
| SSO (single sign-on) | One login that gives access to many apps. |
| Task Center | The place in Lumos where you see and act on tasks assigned to you, such as approvals and manual provisioning steps. |
| Time-based access | Access granted for a set time window. Lumos removes it when the window ends. Also called just-in-time (JIT) access. |
| UAR (user access review) | See access review. |
| Unmatched account | An app account that Lumos couldn't link to any identity. Unmatched accounts aren't identities and don't count against your license. |
| User source | A system, usually your HRIS or identity provider, that creates identities in Lumos. You can rank several user sources by priority. |