IAM gets described as plumbing, and that undersells it. It is the single control plane that decides every access request in a modern system — and because almost every breach eventually involves a misused identity, it is the part of security strategy that the rest depends on.
Two granted patents make the mechanism concrete. US9330280B2, "Identity management, authorization and entitlement framework" (Verizon, issued May 3, 2016; CPC G06F 21/629), describes a framework that ties identities to entitlements and evaluates them at access time. The earlier US7231661B1, "Authorization services with external authentication" (Oracle, issued June 12, 2007), separates the authentication step — proving you are who you say — from the authorization step that follows. You can read them at US9330280B2 and US7231661B1.
The way this actually works is two distinct decisions that people often blur. First, authentication: a system verifies identity, sometimes delegating that check to an external provider — the pattern Oracle's grant describes, and the architectural ancestor of today's single sign-on. Second, authorization: given a verified identity, the system consults entitlements and policy to decide whether this particular action is allowed. Verizon's framework grant is about that second decision — mapping identities to what they're entitled to do.
One analogy, then I'll drop it: authentication is the bouncer checking your ID at the door; authorization is the wristband that says which rooms you can enter once you're inside. A lot of security failures are really authorization failures — the ID was real, but the wristband let someone into a room they should never have reached.
Why this matters for the business of security: IAM is consolidating. Buyers want one control plane rather than a dozen point tools, and that pull toward platforms is exactly the strategic story public identity vendors tell. The fact that the foundational mechanism shows up in grants spanning 2007 to 2016 tells you this isn't a new idea being reinvented — it's a durable function being repackaged, integrated, and re-sold.
The grounded takeaway: when you evaluate an "identity platform," separate the two jobs. How does it verify identity, and how does it decide what a verified identity may do? The patents have named those two jobs for nearly two decades. The product names change; the authenticate-then-authorize mechanism doesn't.