Field Glossary
Field Glossary
Your buyer's AI automation conversation now runs through five terms: agentic AI, AI orchestration, MCP, kill switch, and shadow AI. Joint Five Eyes guidance already requires verified identities for autonomous agents. MCP has hit 97 million monthly SDK downloads with no native enterprise auth. Gartner says 69% of organizations suspect employees are using prohibited AI tools. All five terms trace back to an identity governance gap. Each entry below gives you the definition, the buyer's stake, and a single question that keeps you in the room.
Machine credentials outnumber human identities by at least 45 to 1 in most enterprises, and in cloud-heavy environments the ratio can exceed 140 to 1. Most agencies have never fully inventoried that side of their identity environment. These six terms cover what an AE will hear when a government IT buyer starts talking about credential risk they're only beginning to measure: the NHIs themselves, the aging service accounts and exposed API keys that create the exposure, and the remediation concepts that move the conversation forward.
Seven Okta terms keep surfacing in AI identity conversations, and the first thing any AE needs to know is which ones are safe to bring up on a federal call. This glossary is organized by deal readiness: three terms are FedRAMP-authorized today, two are commercial-only, one needs SE verification before you position it, and the last is the architecture narrative that ties the other six into a single platform story. Every entry opens with an explicit availability status line.
Compliance Terms
Zero Trust NIST SP 800-207 model: verify every identity continuously, grant no implicit trust based on network location. OMB M-22-09 made this mandatory for agencies, but verification was built around humans while AI agents operate in the gap. "How are you extending continuous verification to the non-human identities running AI workloads?"
FedRAMP Federal authorization framework gating all cloud procurement at Low, Moderate, or High impact levels. Any AI identity governance tool touching agency infrastructure falls in scope, so authorization status filters competitors before features matter. "Does your procurement timeline require FedRAMP-authorized tooling for AI identity governance?"
CISA Zero Trust Maturity Model Four-stage framework (Traditional, Initial, Advanced, Optimal) agencies use to measure and report Zero Trust progress across five pillars. OMB M-24-14 requires maturity reporting through FY2026, making ungoverned AI agents a documentable gap no one wants on the record. "Where do AI agents fall in your current ZTMM identity pillar assessment?"
Identity Pillar First of five CISA ZTMM pillars, explicitly scoped to non-person entities because CISA treats identity as the primary control point for everything else. Most agencies score Advanced for human identity but remain at Traditional for the AI agents and service accounts their own workforce is spinning up. "If an auditor asked for identity pillar evidence on your AI agents today, what would you hand them?"
Availability Guardrails
Authorized now: Okta Identity Governance (OIG) and Okta Workflows. Both FedRAMP High. Procurable today.
In process: Identity Threat Protection with Okta AI (ITP). GA commercial. FedRAMP Moderate authorization was projected Q2 2025 but never publicly confirmed as complete. Do not position as authorized. Verify with your SE before every federal conversation.
Commercial only: Cross App Access (XAA) and ISPM Agent Discovery. Both Early Access. No FedRAMP authorization of any kind.
When a buyer asks about something not yet authorized, say it straight: "That capability is live in our commercial environment but hasn't completed FedRAMP authorization. I'll get you the current timeline from our public sector team." Then pivot to OIG and Workflows, which are procurable right now. The rep who tells the truth about availability is the rep the CISO calls back.
Handoff Boundaries
Six terms surface on AI calls that live in the model layer, not identity. Prompt injection: unauthorized input hijacking model behavior. Training data poisoning: corrupted data skewing model outputs. LLM red teaming: stress-testing model vulnerabilities. AI hallucination: confident outputs that are factually wrong. AI bias/fairness: systematic skew in model decisions. Model observability: tracking model performance and drift in production.
Your redirect for any of them: "That's a model-security concern. The identity question is whether the agents touching those systems are scoped and auditable." When the buyer moves from "does this apply to us" to "how would this work here," bring your SE in. You found the signal. That was the job.