Identity-based access is a security model that grants permissions to a verified identity, such as a person, service account, device, or AI agent, rather than to a shared password or static API key. The system checks who or what is making the request, then applies the correct policy for that identity.
This matters because identities can be scoped, monitored, and revoked more easily than shared secrets. In modern cloud and AI environments, it helps teams enforce least privilege, assign short-lived credentials, and keep audit trails tied to a specific actor. In attacks, stolen shared secrets let an intruder impersonate many users at once, while overprivileged identities can be abused to move across systems. Defenses use strong authentication, workload identity, conditional access, and rapid revocation to limit damage when a credential or agent is compromised.