OpenCrowd — Glossary¶

Technical definitions for all concepts, terms, and components used in the OpenCrowd platform.

A¶

Access Certification Campaign¶

A periodic review process where designated reviewers examine all existing permissions and confirm ("approve") or remove ("revoke") each one. Used to prove compliance with frameworks like ISO 27001 and SOX that require regular access reviews. Enterprise feature.

Access Entry¶

A single permission record in the Access Matrix. Contains: who (principal), what app (application), what resource, what permission level, and whether it's allowed or denied.

Access Matrix¶

A unified cross-application view of all permissions across all connected apps. Shows who has access to what, in which application, at what level. The single source of truth for governance.

Access Profile¶

A predefined permission template (role) that bundles specific groups, permissions, and application access together. Used during onboarding to quickly assign the correct set of permissions. Example: "Finance Analyst" profile = xWiki Finance space (view) + OpenProject Finance project (member) + Nextcloud Finance folder (read).

Access Request¶

A formal request submitted by a user (or on behalf of a user) to gain access to an application, space, or resource. Goes through an approval workflow before being provisioned.

AGPL-3.0¶

GNU Affero General Public License v3.0 — the open-source license used by OpenCrowd. It requires that anyone who modifies and distributes the software (including offering it as a network service) must release their source code changes under the same license.

API (Application Programming Interface)¶

The REST endpoints exposed by the OpenCrowd backend. All interactions (frontend, SCIM, external tools) go through the API at /api/v1/.

Approval Workflow¶

A configurable multi-step process that access requests must pass through before being provisioned. Each step can require a different approver role (e.g., Step 1: Manager, Step 2: Security Officer).

Audit Event¶

A logged record of any governance action taken in the system. Includes: who did it, what they did, when, and the full details. Immutable and searchable.

Audit Log¶

The complete history of all governance actions. Stored in the database, searchable, filterable, and exportable as CSV/JSON.

Auto-Sync¶

The scheduled process (default: every 30 minutes) that automatically synchronizes users, groups, and permissions between OpenCrowd and all connected applications.

B¶

Bearer Token¶

An OAuth 2.0 access token sent in the HTTP Authorization header to authenticate API requests. Format: Authorization: Bearer <token>.

Bidirectional Sync¶

The ability to synchronize data in both directions: changes made in OpenCrowd push to connected apps, and changes made directly in connected apps sync back to OpenCrowd.

C¶

Campaign (see Access Certification Campaign)¶

Compliance Dashboard¶

An automated assessment view that evaluates your governance posture against a specific compliance framework (ISO 27001, SOX, or NIS2) and shows pass/warning/fail on each control. Enterprise feature.

Conflict (Sync Conflict)¶

A data disagreement detected during synchronization between OpenCrowd and a connected application. Example: user's email is different in OpenCrowd vs xWiki. Requires resolution (keep local, keep remote, merge, or ignore).

Conflict Resolution¶

The process of resolving data disagreements between OpenCrowd and connected apps. Options: Keep Local (OpenCrowd wins), Keep Remote (app wins), Merge (admin decides), Ignore (acknowledge but take no action). Enterprise feature.

Connected Account¶

A reference on a user record showing which external applications that user has been provisioned to. Example: "xwiki:john, openproject:42" means the user exists in both xWiki and OpenProject.

Connector¶

A component that integrates OpenCrowd with an external application (xWiki, OpenProject, Nextcloud). Handles authentication, user/group sync, permission reading/writing, and health monitoring.

Connector SDK¶

The interface contract that defines how a new connector must be implemented. Allows building custom connectors for any application.

D¶

De-provisioning¶

The process of removing a user's accounts and access from connected applications. Happens during offboarding (Leaver flow).

Dormant User¶

An active user who has not logged in for 90+ days across all connected applications. Identified by the lastLoginAt field. A governance risk — may indicate stale access that should be reviewed.

Docker Compose¶

The orchestration tool used to run all OpenCrowd components (PostgreSQL, Redis, Keycloak, Backend, Frontend) with a single docker compose up -d command.

Duplicate Detection¶

Built-in logic that prevents creating duplicate user identities. Checks username AND email before creating, at every level: onboard endpoint, service layer, connector sync, and provisioning.

E¶

Edition¶

One of three product tiers: Community (free), Professional ($15/user/month), or Enterprise (custom pricing). Features are gated by edition via the OPENCROWD_EDITION environment variable.

Elevation Request¶

An access request to increase existing permissions (e.g., from "view" to "admin"). A type of Mover event.

Enterprise Edition¶

The highest tier of OpenCrowd. Includes all Community and Professional features plus: SCIM 2.0, Access Certification Campaigns, Compliance Dashboards, Conflict Resolution, Custom Connectors, Multi-tenant, and Air-gapped deployment.

F¶

Feature Flag¶

A configuration toggle that enables or disables specific features based on the current edition. Managed by FeatureService in the backend and exposed via GET /api/v1/features.

G¶

Governance Score¶

A calculated percentage (0-100%) representing the overall health of your identity governance posture. Based on: user coverage (% of users with permissions), active ratio, connector health, and group coverage.

Group¶

A collection of users. Groups can be synced from connected apps or created in OpenCrowd. Adding a user to a group in OpenCrowd automatically pushes the membership to the connected apps where that group exists.

H¶

Health Check¶

An API call to a connected application to verify it's reachable and credentials are valid. Returns healthy/unhealthy status with timestamp.

I¶

Identity Governance¶

The discipline of managing who has access to what, ensuring it's appropriate, approved, and compliant. OpenCrowd's core function.

Identity Provider (IdP)¶

A system that authenticates users (verifies who they are). OpenCrowd uses Keycloak as its IdP. OpenCrowd itself is NOT an IdP — it's the governance layer above.

IGA (Identity Governance and Administration)¶

The industry category OpenCrowd belongs to. IGA platforms manage the lifecycle of digital identities and their access rights across applications.

ISO 27001¶

International standard for information security management. Section A.9 covers Access Control requirements. OpenCrowd's Compliance Dashboard assesses compliance with A.9 controls.

J¶

JML (Joiner / Mover / Leaver)¶

The three lifecycle events for user identity management: - Joiner: New user onboarded — accounts created, groups assigned, permissions provisioned - Mover: Existing user changes role — permissions adjusted (elevated or reduced) - Leaver: User departs — all access revoked, accounts disabled/removed

Just-in-Time Provisioning¶

Automatic creation of a user account in a connected app at the moment it's needed (e.g., when adding them to a group in that app). Prevents errors from trying to assign permissions to non-existent users.

K¶

Kai¶

OpenCrowd's AI-powered governance assistant. Answers natural language questions about access, users, and governance posture. Powered by Mistral AI (European, GDPR-compliant). Professional+ feature.

Keycloak¶

The open-source identity provider bundled with OpenCrowd. Handles user authentication (login), session management, and role assignment. Accessible at port 8180.

L¶

L1 / L2 / L3 Support¶

Support tiers: - L1 (Level 1): Basic user questions, how-to, password resets - L2 (Level 2): Technical issues, configuration problems, connector troubleshooting - L3 (Level 3): Engineering — bug fixes, patches, custom development

Leaver Flow¶

The process of offboarding a user: setting their status to OFFBOARDED, revoking all permissions in the Access Matrix, removing group memberships, and de-provisioning accounts from connected apps.

Lifecycle (see JML)¶

M¶

Mistral AI¶

The European AI company (Paris, France) powering Kai. GDPR-compliant, data processed in Europe. Only governance questions are sent to Mistral — never raw user data.

Multi-Tenancy¶

Architecture supporting multiple isolated organizations from a single deployment. OpenCrowd uses schema-per-tenant in PostgreSQL — each tenant has its own database schema, providing complete data isolation.

N¶

NIS2¶

Network and Information Systems Directive 2 — EU legislation for cybersecurity. Applies to essential and important entities. OpenCrowd's Compliance Dashboard assesses relevant access control articles (21, 23).

Nextcloud¶

Open-source file sharing and collaboration platform. One of OpenCrowd's three production connectors. Syncs users, groups, and folder memberships.

O¶

Offboarded¶

A user lifecycle status indicating the person has left the organization. All access should be revoked. Offboarded users do not count toward license limits.

OIDC (OpenID Connect)¶

The authentication protocol used between OpenCrowd's frontend and Keycloak. Based on OAuth 2.0 with PKCE flow for single-page applications.

OpenCrowd¶

Open-source Identity & Access Governance platform. Centralizes governance across xWiki, OpenProject, and Nextcloud. Not an identity provider — it's the governance layer above.

OpenProject¶

Open-source project management platform. One of OpenCrowd's three production connectors. Syncs users, groups, projects, memberships, and roles.

P¶

Permission¶

A specific access right granted to a user or group on a resource. Examples: view, edit, admin, delete, comment, script.

Permission Drift¶

When a permission changes directly in a connected application (bypassing OpenCrowd). Detected during sync as a conflict type. Indicates governance bypass.

PKCE (Proof Key for Code Exchange)¶

A security extension to OAuth 2.0 used by OpenCrowd's frontend for authentication. Prevents authorization code interception attacks.

Principal¶

An entity (user or group) that holds permissions. In the Access Matrix, each entry has a principalType (USER or GROUP) and principalName.

Professional Edition¶

The mid-tier of OpenCrowd. Adds: Kai AI Assistant, governance reports, email notifications, multi-step approval workflows, custom form fields, data export, and priority support.

Provisioning¶

The process of creating a user account in a connected application and granting the appropriate access. Can be triggered by: access request approval, joiner flow, or manual action.

R¶

RBAC (Role-Based Access Control)¶

Access control model where permissions are assigned to roles (Access Profiles), and roles are assigned to users. OpenCrowd supports RBAC through Access Profiles.

Realm (Keycloak)¶

A namespace in Keycloak that manages a set of users, credentials, roles, and clients. OpenCrowd uses the "opencrowd" realm.

Resync¶

A full re-import of all data from a connected application. Clears cached data and pulls everything fresh. More thorough than incremental sync.

Risk Alert¶

A governance warning displayed on the dashboard. Types: users without permissions, over-privileged users, dormant accounts, unhealthy connectors, incomplete profiles.

S¶

Schema-per-Tenant¶

OpenCrowd's multi-tenancy strategy. Each organization (tenant) gets its own PostgreSQL schema. Provides complete data isolation, simpler GDPR compliance, and easier per-tenant data export.

SCIM 2.0 (System for Cross-domain Identity Management)¶

A standard protocol (RFC 7643/7644) for automating user provisioning between identity providers (Azure AD, Okta) and applications. OpenCrowd's SCIM endpoint at /scim/v2/ receives user lifecycle events. Enterprise feature.

Segregation of Duties (SoD)¶

The principle that no single user should hold conflicting access combinations (e.g., both "create payment" and "approve payment"). OpenCrowd's SOX compliance check evaluates SoD risks.

Smart Group Push¶

When a user is added to a group in OpenCrowd, the system only pushes the membership to apps where that group is registered. Prevents cross-app pollution.

SOX (Sarbanes-Oxley Act)¶

US legislation for financial reporting and corporate governance. IT General Controls (ITGC) require documented access controls, periodic reviews, and audit trails. OpenCrowd's Compliance Dashboard assesses SOX ITGC requirements.

Sovereign (Digital Sovereignty)¶

The principle that an organization maintains full control over its digital infrastructure, data, and tools — without dependence on foreign cloud providers. OpenCrowd is designed for sovereign deployments: self-hosted, European AI, no mandatory telemetry.

Sync (Synchronization)¶

The process of exchanging user, group, and permission data between OpenCrowd and connected applications. Can be automatic (every 30 minutes) or manual (triggered by admin).

T¶

Tenant¶

An isolated organization within a multi-tenant OpenCrowd deployment. Each tenant has its own users, groups, connectors, and permissions — completely separated from other tenants.

Temporary Access¶

An access request type with a defined expiration. The user gets access for a specific duration (e.g., 30 days) after which it should be reviewed or automatically revoked.

U¶

UAT (User Acceptance Testing)¶

Testing performed by end users (or simulated) to verify the system works correctly from a business perspective. OpenCrowd uses Playwright for automated E2E UAT tests.

User Lifecycle¶

The states a user can be in: Active → Disabled → Locked → Offboarded. Transitions are tracked in the audit log and trigger provisioning/de-provisioning actions.

V¶

Valkey¶

Redis-compatible in-memory data store used by OpenCrowd for caching. Improves API response times for frequently accessed data (feature flags, session data).

W¶

Wholesale Price¶

The discounted price a reseller pays to OpenCrowd for the software. Typically 65-70% of the public list price. The reseller adds their margin on top when selling to the end client.

Workflow (see Approval Workflow)¶

Write-Back¶

The action of pushing a permission change from OpenCrowd's Access Matrix back to the actual connected application. Example: granting "edit" on a xWiki space in OpenCrowd writes the permission directly to xWiki.

X¶

xWiki¶

Open-source wiki and collaboration platform. One of OpenCrowd's three production connectors. Syncs users, groups, spaces, and page-level permissions.

Acronyms¶

Last updated: August 2026