In security, a user who may, according to an organization's security policy, perform an operation.