Entitlement

An entitlement is the specific thing a system lets an identity do: admin on the billing tool, maintainer on a repository, read on a data warehouse schema, membership of a group that carries all three. One application exposes many entitlements, which is why "who has a seat?" and "who can do what?" are different questions with different answers.

Seats versus entitlements

Licence-level thinking says someone either has an app or does not. That model breaks the moment an app has more than one tier of permission inside it, which is almost immediately. Two people with a "seat" in the same tool can be a viewer and a super-admin; a review that certifies the seat has certified nothing about the difference. Counting by entitlement is what makes least privilege checkable at all.

Entitlements as the unit of governance

When the entitlement is the unit, everything downstream sharpens: requests ask for the capability rather than the app, approvals know what they are approving, reviews iterate over grants rather than accounts, and revocations remove one capability without touching the rest. Ploy models access this way: the access graph links every identity to every entitlement it holds and where that grant came from.