passive entity
163525·updated Aug 30, 2026A system resource — such as a device, file, record, table, domain, or process — that holds or receives information but does not itself initiate actions or requests. What distinguishes it from an active entity (a subject) is precisely this non-initiating character: it sits in the position of being *acted upon*, not acting. Access control mechanisms govern the relationship by granting or revoking privileges for active entities (subjects) to access or perform operations on passive entities (objects). In authoritative frameworks, the term appears as the standard counterpart to "subject" in the subject–object model: access control policies control access between active entities or subjects — users or processes acting on behalf of users — and passive entities or objects, such as devices, files, records, and domains. A passive entity contains or receives information, and access to it by a subject implies access to the information it contains.
Source
control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. Types of system access includethe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- Advances in Security in Computing and Communications
- Date updated: May 14, 2024 Withdrawn NIST Technical Series Publication
- Glossary | CSRC - NIST Computer Security Resource Center
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A resource or system element — such as a device, file, record, table, program, network, or domain — that contains or receives information but does not itself initiate actions or cause state changes, in contrast to an active entity (subject), which is generally an individual, process, or device that drives information flows or system-state transitions. In access control frameworks, the distinction structures the fundamental permission relationship: active entities (subjects) are granted or denied rights to access or act upon passive entities (objects). NIST uses the concept directly in defining the "object" — characterizing it as "the set of passive entities within the system, protected from unauthorized use," and more specifically as "a passive entity that contains or receives information" — making *passive entity* the defining genus of the object class across DAC, MAC, RBAC, and ABAC models alike.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- passive entities
- possessive
- passive entity's
- pluralpossessive
- passive entities'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A system resource — such as a device, file, record, table, domain, or process — that holds or receives information but does not itself initiate actions or requests. What distinguishes it from an active entity (a subject) is precisely this non-initiating character: it sits in the position of being *acted upon*, not acting. Access control mechanisms govern the relationship by granting or revoking privileges for active entities (subjects) to access or perform operations on passive entities (objects). In authoritative frameworks, the term appears as the standard counterpart to "subject" in the subject–object model: access control policies control access between active entities or subjects — users or processes acting on behalf of users — and passive entities or objects, such as devices, files, records, and domains. A passive entity contains or receives information, and access to it by a subject implies access to the information it contains.DR-088 backfill from the noun definition column