system process
163524·updated Aug 30, 2026An active security principal—specifically, an executing software process on a computing system—that has been granted an identity and access rights so it can perform actions on behalf of a human user without that user being directly present. NIST (SP 800-37 Rev. 2) treats it as one of the two forms a "system user" may take: "an individual or (system) process acting on behalf of an individual that is authorized to access information and information systems to perform assigned duties." In access-control frameworks such as NIST SP 800-53 and SP 800-171, system processes are classified alongside human users as **active entities or subjects** that access control policies must govern, standing in contrast to passive objects such as devices, files, records, and domains. Practically, if a user launches an application or background tool, that application runs as the user and "is acting on behalf of the user," meaning any process running under a user's authority must be confined to the same access permissions as that user and no more.
Source
control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. Types of system access includethe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- system user - Glossary | CSRC
- 3.1.1: Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems) - CSF Tools
- Cuick Trac - Simplifying CMMC & NIST 800-171 Compliance
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
An active principal in an information system — such as a daemon, service, agent, or other software execution context — that the operating environment recognizes as a subject capable of initiating operations and requesting access to resources. What distinguishes it from a human user is that it acts autonomously or on behalf of a user without direct interactive control: the system itself launches, schedules, or sustains the process under an assigned identity and privilege level. In access-control frameworks (e.g., NIST SP 800-53 AC-3, AC-6, NIST SP 800-171 control 3.1.1), the field uses the term to enumerate this category of active subject alongside human users when specifying who or what must be authenticated, authorized, and constrained by least-privilege rules.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- system processes
- possessive
- system process's
- pluralpossessive
- system processes'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 5 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An active security principal—specifically, an executing software process on a computing system—that has been granted an identity and access rights so it can perform actions on behalf of a human user without that user being directly present. NIST (SP 800-37 Rev. 2) treats it as one of the two forms a "system user" may take: "an individual or (system) process acting on behalf of an individual that is authorized to access information and information systems to perform assigned duties." In access-control frameworks such as NIST SP 800-53 and SP 800-171, system processes are classified alongside human users as **active entities or subjects** that access control policies must govern, standing in contrast to passive objects such as devices, files, records, and domains. Practically, if a user launches an application or background tool, that application runs as the user and "is acting on behalf of the user," meaning any process running under a user's authority must be confined to the same access permissions as that user and no more.DR-088 backfill from the noun definition column