Terminology

454 terms, tools, patterns and metrics an architect is expected to use precisely. Each one gets a short explanation of what it is, and — where it matters — what it is commonly confused with. Search filters as you type; the column headers sort.

All areas454 Architecture Fundamentals16 Distributed Systems73 Data Architecture71 Cloud Architecture55 Networking13 API & Integration Architecture17 Reliability & Resilience16 Observability14 Performance & Capacity Engineering13 Security Architecture50 Cost Architecture & FinOps12 Business Architecture9 Architecture Communication8 Enterprise Architecture8 Legacy Modernization11 AI-Era Architecture15 Software Architecture & Engineering19 Architecture Patterns15 Architecture Decision-Making11 The Architect's Meta-Skills8

Kind Any concept166 practice107 pattern93 case-study26 tool26 protocol22 metric14

18 terms shown.

Term	Kind	Topic	What it is
Attack Surface	concept	Threat Modelling	The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability	concept	Security Architecture	The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Authentication AuthN	concept	Security Architecture	Establishing who a principal is, to a defined level of confidence.
Authorization AuthZ	concept	Security Architecture	Deciding whether an authenticated principal may perform a specific action on a specific resource.
Containment vs Eradication	concept	Security Incident Response	Stopping an attacker's ongoing access versus removing their foothold entirely — sequential phases with different urgency and different risks of doing them wrong.
Data Residency Data Sovereignty	concept	Security Architecture	A requirement that specific data be stored and sometimes processed only within a defined geography.
Identity and Access Management IAM	concept	Security Architecture	The system of record for principals, credentials and permissions, and the policy engine that decides what each principal may do.
Least Privilege	concept	Security Architecture	Granting each identity only the permissions it needs, for only as long as it needs them.
Mass Assignment Auto-Binding, Over-Posting	concept	Secure API Design	A vulnerability where a request body is bound directly to an internal object, allowing a caller to set fields the API never intended to expose.
Object-Level Authorization BOLA, IDOR	concept	Authorization	Checking that the caller is entitled to the specific record they requested, not merely that they may call the endpoint.
Permission Boundary	concept	Identity & Access Management	A policy limiting the maximum permissions an identity can have, used so that the ability to create roles does not become the ability to grant unlimited privilege.
Personally Identifiable Information PII, Personal Data	concept	Security Architecture	Data relating to an identifiable person — a category far broader than name and address, and the trigger for most regulatory obligation.
Purpose Limitation	concept	Privacy Engineering	The principle that personal data collected for one stated purpose may not be used for an unrelated one without a new lawful basis.
Refresh Token	concept	Tokens & JWTs	A long-lived credential used solely to obtain new short-lived access tokens, so sessions can persist without long-lived access tokens circulating.
Role Explosion	concept	Authorization	The proliferation of narrowly-scoped roles that occurs when RBAC is used to express rules that actually depend on context.
Secret Zero Bootstrapping Problem	concept	Secrets Management	The credential a workload needs in order to authenticate to the secret manager — the one secret that cannot itself be stored in the secret manager.
Server-Side Request Forgery SSRF	concept	OWASP Risks	Inducing a server to make an HTTP request to an attacker-chosen destination, turning it into a proxy into networks and services the attacker cannot reach directly.
Zero Trust	concept	Security Architecture	A security model that grants no implicit trust from network position, and authenticates and authorises every request individually.