IAM standards tend to have "closed vocabularies". What does that mean, and what do the examples "user ≠ user", "server ⇔ client" and "RP ≈ application" illustrate?

Question

Accepted Answer

Each standard defines its own terms, tied to its own time and context, so the same word can mean different things in two standards and different words can mean almost the same thing.
There are many IAM standards and tools, and each one comes with its own self-contained set of terms (geschlossene Begriffswelt) that made sense when and where it was written. When you combine several standards, the vocabularies clash:

user ≠ user: the same word, different meanings. In one context a "user" is a human being, in another it is an account object in a directory, in another a role in a protocol (OAuth calls the human the "resource owner" and the browser the "user agent").
server ⇔ client: the roles flip depending on the viewpoint. A web application runs on a server, yet in OAuth 2.0 that same application is the client that asks for a token.
RP ≈ application: different words, nearly the same thing. The OpenID Connect "relying party", the SAML "service provider" and the OAuth "client" all roughly mean "the application the user wants to use", but each carries slightly different responsibilities.

The practical lesson: when two teams or two products talk about IAM, first agree on terms. Mapping vocabularies is part of the work, and standardised glossaries such as eCH-0219 exist precisely to give a common reference point.
Go deeper:

eCH-0219 IAM glossary — the Swiss reference glossary that relates terms from international standards to one consistent set of definitions (in German).