I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example external consultants, market partners, businesses which use our corporate services, and so on. The second type are end-users which use customer-facing applications, like mobile apps etc.
In my mind it feels intuitively clear, but I am having difficulty articulating this distinction. I am trying to find, firstly, correct vocabulary for referring to these two types of users, and secondly, a simple set of rules for determining the boundary between these two.
The reason for this is because it will impact the technical implementation of user authentication and authorisation. One idea I had was to differentiate based on the type of data the users would use. The first uses corporate data, whilst the second uses personal and private data. For the first group of users (the only type we have had to deal with thus far) they are all managed within Active Directory and authentication/authorization is implemented via a Single Sign On service. However, this is not necessarily appropriate for mobile app users (for example), but I need to give clear definitions and input to our security team who will need to amend security policies and directives which govern how we manage user identities, authentication and authorization.
I would appreciate some direction, particularly if there is some well-established best practice or industry standard which relates to my question.
Human
(an account tied to a specific person),Corporate
(an account shared by multiple persons in a business/department) andMachine
(an account for use by automated systems). Then see where it makes sense to allow each type of user.Human
accounts. Machine-to-Machine authentication is handled in a completely different way, as is corporate entities.