passive entity
A system resource — such as a device, file, record, table, domain, or process — that holds or receives information but does not itself initiate actions or requests. What distinguishes it from an active entity (a subject) is precisely this non-initiating character: it sits in the position of being *acted upon*, not acting. Access control mechanisms govern the relationship by granting or revoking privileges for active entities (subjects) to access or perform operations on passive entities (objects). In authoritative frameworks, the term appears as the standard counterpart to "subject" in the subject–object model: access control policies control access between active entities or subjects — users or processes acting on behalf of users — and passive entities or objects, such as devices, files, records, and domains. A passive entity contains or receives information, and access to it by a subject implies access to the information it contains.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A system resource — such as a device, file, record, table, domain, or process — that holds or receives information but does not itself initiate actions or requests. What distinguishes it from an active entity (a subject) is precisely this non-initiating character: it sits in the position of being *acted upon*, not acting. Access control mechanisms govern the relationship by granting or revoking privileges for active entities (subjects) to access or perform operations on passive entities (objects). In authoritative frameworks, the term appears as the standard counterpart to "subject" in the subject–object model: access control policies control access between active entities or subjects — users or processes acting on behalf of users — and passive entities or objects, such as devices, files, records, and domains. A passive entity contains or receives information, and access to it by a subject implies access to the information it contains.DR-088 backfill from the noun definition column