---
id: agent-brief/model-access-control
artifact_id: model/access-control
source_path: models/access-control/InfoTechCanonAccessControlModel.md
source_kind: model
generated: true
---

<!-- GENERATED by info_tech_canon; do not edit by hand. -->

# Agent Brief: InfoTechCanon Access Control Model

- Artifact ID: `model/access-control`
- Kind: `model`
- Canonical path: `models/access-control/InfoTechCanonAccessControlModel.md`
- Full source: `models/access-control/InfoTechCanonAccessControlModel.md`
- Summary: Domain model used by canon profiles and standards: InfoTechCanon Access Control Model.

## Retrieval Hints

Imports and anchors:
- `kernel/itc-core`
- `model/evidence`
- `model/governance`
- `model/identity`
- `model/organization`

## Owned Concepts

- `AccessCertification`
- `AccessControlEntity`
- `AccessFinding`
- `AccessRemediation`
- `AccessReview`
- `AccessRole`
- `AccessSession`
- `AgentAccess`
- `AuthenticatedSubject`
- `AuthenticationStrengthReference`
- `AuthorizationDecision`
- `AuthorizationRequest`
- `BreakGlassAccess`
- `Condition`
- `CredentialReference`
- `DecisionReason`
- `DelegatedAccess`
- `Denial`
- `Entitlement`
- `EvaluationContext`
- `ExcessAccess`
- `Grant`
- `IdentityReference`
- `InfoTechCanon Access Control Model`
- `JustInTimeAccess`
- `Operation`
- `OrphanedAccess`
- `Permission`
- `PolicyAdministrationPoint`
- `PolicyBinding`
- `PolicyDecisionPoint`
- `PolicyEnforcementPoint`
- `PolicyInformationPoint`
- `PolicyRetrievalPoint`
- `Principal`
- `Privilege`
- `ProtectedResource`
- `RelationshipTuple`
- `Resource`
- `ResourceAction`
- `ResourceScope`
- `RoleBinding`
- `ServiceAccountAccess`
- `StaleAccess`
- `Subject`
- `TemporaryAccess`
- `TokenReference`

## Related Distinctions

- **Actor vs Subject vs Principal**: Use actor for the acting entity in a context, subject for the entity a policy evaluates, and principal for the authenticated identity bound to access decisions.
- **Organization Role vs AccessRole vs CARING role**: Organization roles describe responsibility or position; access roles describe permissions; CARING roles classify access-governance needs and analysis.