The first step of I triple A. Establishing which subject is making an access request. Must be unique but does not need to be confidential.
Want to actually apply concepts like this instead of just reading definitions?