## 6.3.1.13.20  Glossary for Identity and Access Management
Get an overview of the terminology used for identity and access management.
| Terminology Overview Term   | Description                                                                                                                                                                                                                                                                                                                                                  |
|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Access category             | A category that defines what kind of access is granted to the users assigned to a business role, for example, Read , Write , or Value Help .                                                                                                                                                                                                                 |
| Business role               | A business role provides users with authorizations to access apps.                                                                                                                                                                                                                                                                                           |
| Business role template      | A pre-defined set of authorizations and assigned business catalogs you can use as a basis for creating new business roles.                                                                                                                                                                                                                                   |
| Business user               | Any person who can log on to the system, including adminis- trators.                                                                                                                                                                                                                                                                                         |
| Restriction                 | An access limitation that is defined on business role level. You can determine what kind of access is granted to specific objects, such as company code .                                                                                                                                                                                                    |
| Restriction field           | A field that is used to restrict the access to a specific busi- ness object, for example, organizational area .                                                                                                                                                                                                                                              |
| Restriction type            | An authorization entity that bundles the available restriction fields to a logical definition, for example, company code.                                                                                                                                                                                                                                    |
| Leading restriction         | A property that defines a certain restriction field as leading restriction. No matter in which restriction types the restric- tion field is being used, the field will have the same restric- tion assigned in all types.                                                                                                                                    |
| Technical user              | A technical user corresponds to a local or remote process which is typically part of the cloud management process (e.g. system provisioning, support) or intrinsic system proc- esses (e.g. periodic clean-up of logs). There are technical users that belong to the software or service provider and there are technical users that belong to the customer. |
| IAM app                     | A unit that grants access to a set of services and authoriza- tions. An IAM app can be grouped in business catalogs and assigned to business roles.                                                                                                                                                                                                          |
| External app                | An IAM app based on services, for example derived from SAP Fiori launchpad app descriptor items. It contains serv- ices and authorizations.                                                                                                                                                                                                                  |