Access management
Access management is deciding and enforcing who may do what: after authentication establishes who you are, authorisation determines what you can reach. Common models are RBAC (rights via roles), ABAC (rights via attributes - which is where wallet attestations plug in) and least privilege as the guiding principle. Together with identity lifecycle management this forms IAM.
The building blocks around it: SSO and the identity provider deliver the who, mandates express acting on behalf of others, and audit logging proves after the fact who did what. In procurement language ("access management" is a recurring tender term) it usually spans this whole stack.
Access management is also a legal and regulatory requirement, not just good practice. NIS2 article 21(2)(j) requires essential and important entities to use multi-factor authentication or continuous authentication solutions where appropriate, as part of baseline access hygiene, not only for systems flagged as critical. GDPR article 32 requires appropriate technical and organisational measures to secure personal data, which in practice means restricting access to what is necessary. ISO 27001 Annex A likewise sets out access control objectives that auditors check against, typically including periodic access reviews and recertification to confirm that granted rights still match actual need.
For QTSPs and other trust service providers, access management carries extra weight. ETSI EN 319 401 requires separation of duties and four-eyes principles for sensitive operations and tightly controlled privileged access to the HSM that holds signing keys. Sole control - only the signatory being able to activate their own signature - comes from elsewhere: Annex II of eIDAS for the signature creation device, worked out for server signing in CEN EN 419 241-1 and -2. Under eIDAS, access decisions can also depend on the assurance level (low, substantial or high) at which an identity was verified, a relying party that intends to rely on wallets must register in the member state where it is established (Article 5b(1)) and may then ask only for the data it declared, with the wallet authenticating it through a separate access certificate, and under the Dutch Wdo an authorisation register (machtigingenregister) records who may act on whose behalf.