In this course, who means subject form; whom is the object form in formal usage. The introduction ties that sense to person. See the Cambridge English entry and the Merriam-Webster entry. Encyclopedic background is in Who.
Read along with the three podcasts, or open the full dictionary entry for Who for the definition, Arabic meaning, synonyms and example sentences.
Welcome. Today's word is who — a pronoun, pronounced HOO, written in phonetics as h, uː.
Who is one of the most fundamental words in the English language — an interrogative pronoun used to ask about the identity of a person, and a relative pronoun used to introduce clauses that describe or identify people.
In questions, who asks for the identity of a person: who did this, who is calling, who invented the telephone. The question form who places the person at the centre of the enquiry — it is the most direct way to ask for a human identity.
As a relative pronoun, who connects a describing clause to the person it describes: the man who called yesterday, the team who won the championship, the philosopher who changed how we think about language. Here, who links the noun to additional information about it.
The word comes from Old English hwa, from Proto-Germanic hwaz, from Proto-Indo-European kwo — the interrogative root that gave Latin qui, French qui, German wer, and the English words who, what, where, when, why, and which — all of the wh-question words derive from the same ancient interrogative root.
Who has a companion form: whom. Whom is the object form — used when who is the object of a verb or preposition rather than the subject. To whom are you speaking. Whom did she choose. In formal English, the distinction between who and whom is maintained. In informal spoken English, who is increasingly used in all positions, with whom feeling formal or slightly stiff.
Who is also famously embedded in the phrase Doctor Who — the British science fiction television programme whose very title uses the word as a question about identity.
In register, who is entirely universal — one of the most fundamental and inescapable words in the language.
Remember it like this: who is the word that turns language toward the human — whenever you want to know about a person, who is where you begin.
And that is our word — who: the simplest, oldest question about the person in front of you.
Speaker A: The who-versus-whom distinction is one of the most frequently discussed grammar questions in English, and it is worth understanding clearly. Who is the subject form — it replaces a subject pronoun like he or she. Whom is the object form — it replaces an object pronoun like him or her. A practical test: if you can replace the word with he or she, use who; if you can replace it with him or her, use whom. Who called — he called, so who is correct. Whom did you call — you called him, so whom is correct. The test works reliably in most cases.
Speaker B: Who as a relative pronoun in restrictive and non-restrictive clauses is worth distinguishing. A restrictive relative clause introduced by who is essential to the meaning of the sentence — it defines which person is being referred to. The student who passed the exam received a certificate — who passed the exam tells you which student. A non-restrictive relative clause is additional information about an already-identified person, set off by commas. My sister, who passed the exam, received a certificate — who passed the exam is additional information about my already-identified sister. The same word, two functions, distinguished by punctuation and context.
Speaker A: Who versus that — what is the distinction?
Speaker B: In relative clauses, who is used for people; that is used for things and, in informal English, also for people. The man who called is standard. The book that arrived is standard. The man that called is informal but common. In formal writing, using that for people is considered incorrect by many style guides — the person that did this should be the person who did this. In spoken informal English, that is widely accepted for people as well. The distinction is primarily a formal versus informal register question: formal writing uses who for people; informal speech accepts that for people.
Speaker A: What is a common mistake about who in grammar?
Speaker B: Using who in sentences where whom is strictly required, particularly in formal writing contexts. The most common error is in prepositional phrases: for who, to who, from who should be for whom, to whom, from whom in formal English. The confusion arises because in everyday speech, whom feels awkward and old-fashioned, so speakers default to who in all positions. This works fine in informal speech and is increasingly accepted in informal writing, but in formal documents, legal writing, and careful literary prose, the distinction between who and whom remains expected and its violation is noticeable.
Speaker A: Any close synonyms?
Speaker B: There are no true synonyms for a pronoun — it is a function word that performs a specific grammatical role. The closest equivalents in function are: whom as the object form of the same word. That as an informal substitute in relative clauses for people. Which for non-human referents. The person or the individual are noun phrases that can replace who constructions but at the cost of more words. In many languages, who and whom collapse into a single form — in French, qui serves both functions. English maintains the distinction in formal registers while informally converging on who for both.
Speaker B: Welcome to the workshop. Today we prompt AI using the word who — building the user identity and authentication systems, person record management tools, role and permission management frameworks, user research and persona management platforms, and access control systems that answer the question who is this user, who has permission, and who is responsible for each action in a system.
Speaker A: So who tells the AI to build the identity and person management systems — the user authentication and identity verification systems that confirm who a user is before granting access, the role and permission systems that define who has permission to perform each action in an application, and the user research and persona tools that help product teams understand who their users are and what they need?
Speaker B: Exactly. It signals identity management, access control, and user understanding. Let me start with a user identity and profile management system.
Build a user identity and profile management system: manage user accounts with secure authentication — email and password with bcrypt hashing, optional two-factor authentication, and OAuth login via Google and GitHub. Store user profiles with configurable attributes. Support user-managed profile editing with validation. Implement account recovery via email. Track login history with device and location information. Allow administrators to view, suspend, or deactivate accounts. Generate a user activity report showing active and inactive users over a selected period.
Speaker B: Identity management system handles email-password-bcrypt-2FA-OAuth authentication, stores configurable profiles, supports validated user profile editing, implements email account recovery, tracks login history with device-and-location, allows admin view-suspend-deactivate, and generates active-inactive user activity reports — the AI builds the full user identity and profile management system.
Speaker A: Tracking login history with device and location information — recording which device and approximate location was used for each login — is the anomalous access detection mechanism: a user who normally logs in from a single device in London appearing with a simultaneous login from a different device in Singapore is exhibiting behaviour that warrants either a security alert or a prompt to confirm the login.
Speaker B: Device-and-location login history as the simultaneous-different-device-location security-alert-or-confirmation anomalous access detection mechanism. Now the user identity schema.
Design a user identity and access management schema: a users table recording each user with an ID, email, hashed password, full name, account status as active, suspended, or deactivated, the account creation timestamp, and the last login timestamp. A user_profiles table recording extended profile attributes with the user ID, display name, profile picture URL, timezone, language preference, and a JSON field for custom attributes. A login_events table recording each authentication event with the user ID, the timestamp, the device type, the approximate location as city and country, the authentication method, and the success flag. A user_sessions table recording active sessions with the session token hash, the user ID, the creation timestamp, the last activity timestamp, and the expiry timestamp.
Speaker B: User identity schema stores users with email-password-status-timestamps, extended profiles with display-name-picture-timezone-language-custom, login events with device-location-method-success, and active sessions with token-hash-expiry — the AI builds the four-table schema.
Speaker A: Storing the session token hash rather than the session token itself — applying the same principle as password hashing to session tokens — is the stolen-token protection mechanism: if the sessions table is compromised by an attacker, a hashed session token cannot be used directly to impersonate a user; the attacker would need to reverse the hash to obtain the actual token, which is computationally infeasible with a strong hash.
Speaker B: Session-token hashing as the compromised-sessions-table cannot-directly-impersonate stolen-token protection mechanism. Next, the identity management interface.
Design a user identity and account management administration interface: show a searchable list of all users with their status, registration date, and last login. Allow filtering by status — active, suspended, or deactivated. Display a detailed user view with their profile, login history, active sessions, and role assignments. Provide admin actions — suspend account, deactivate account, reset password, revoke sessions. Show a user activity summary chart over the last ninety days. Highlight users who have not logged in for more than ninety days.
Speaker B: User admin interface shows searchable status-filtered user list, detailed view with profile-login-history-sessions-roles, admin suspend-deactivate-reset-revoke actions, ninety-day activity summary chart, and ninety-plus-day inactive user highlighting — the AI builds the user list, the detail view, the admin actions, the activity chart, and the inactive highlight.
Speaker A: Highlighting users who have not logged in for more than ninety days — surfacing accounts that may be abandoned, stale, or security risks — is the dormant account management mechanism: a dormant account with full access that is never reviewed is a security risk; if the account owner no longer uses it, the credentials may be weak, reused, or shared; the ninety-day highlight prompts administrators to review and potentially deactivate stale accounts.
Speaker B: Ninety-day inactive highlight as the abandoned-weak-reused-credentials security risk dormant account management mechanism. On to access control.
Create a role-based access control system: define roles with specific permission sets — view, create, edit, delete, and administer for each resource type in the application. Assign roles to users, with support for multiple roles per user. Enforce permissions at the API level — reject requests that do not have the required permission. Log all permission denials with the user, the resource, the action attempted, and the timestamp. Provide an interface for administrators to manage roles and user assignments. Support role inheritance — a senior role inherits all permissions of the junior roles below it.
Speaker B: Role-based access control defines view-create-edit-delete-administer permission sets, assigns multiple roles per user, enforces at API level with denial logging, provides admin role-and-assignment management, and supports senior-inherits-junior role inheritance — the AI builds the role definer, the assignment manager, the API enforcer, the denial logger, the admin interface, and the inheritance engine.
Speaker A: Role inheritance — where a senior role automatically includes all permissions of the junior roles below it — is the permission maintenance simplification mechanism: without inheritance, a senior editor role whose junior editor permissions change requires a manual update; with inheritance, the senior role automatically picks up any changes made to the junior roles it inherits from.
Speaker B: Senior-inherits-junior as the manual-update-on-junior-change versus automatic-pickup permission maintenance simplification mechanism. Now something whole.
Build a user identity and access management platform for a multi-tenant SaaS application: manage users, organisations, and their relationships. Support per-organisation role and permission configuration. Implement single sign-on with SAML and OAuth. Manage user provisioning and deprovisioning, including automated deprovisioning when an employee leaves an organisation. Track all access events for audit compliance. Provide a self-service portal where users can manage their own profile, sessions, and two-factor authentication settings. Generate monthly access and compliance reports for each organisation.
Speaker B: Multi-tenant identity platform manages users-organisations-relationships, per-organisation role-permission configuration, SAML-and-OAuth SSO, automated provisioning-and-deprovisioning, access event audit tracking, self-service profile-sessions-2FA portal, and monthly per-organisation compliance reports — the AI builds the full user identity and access management platform.
Speaker A: Automated deprovisioning when an employee leaves an organisation — revoking access immediately without requiring a manual off-boarding checklist item — is the leavers-access-security mechanism: a former employee whose SaaS access is not promptly revoked retains access to organisational data; automated deprovisioning triggered by an HR system event removes access within minutes of the employment relationship ending, rather than waiting for an administrator to remember the task.
Speaker B: Automated HR-triggered deprovisioning as the manual-checklist-delays versus within-minutes-of-employment-ending leavers-access-security mechanism. Last one — identity API.
Write a user identity and authentication REST API: provide endpoints for user registration with email validation, login with JWT token issuance, token refresh, logout and session revocation, password reset via email, two-factor authentication setup and verification, and querying the authenticated user's profile and permissions. Validate all inputs with descriptive error messages. Rate-limit authentication endpoints to prevent brute-force attacks. Return all responses as structured JSON with appropriate HTTP status codes.
Speaker B: Identity REST API provides registration-with-email-validation, login-with-JWT, token-refresh, logout-revocation, email-password-reset, 2FA-setup-and-verification, and profile-and-permissions query endpoints with input validation, rate limiting on auth endpoints, and structured JSON with HTTP status codes — the AI builds the full user identity and authentication REST API.
Speaker A: Rate-limiting authentication endpoints to prevent brute-force attacks — limiting the number of login attempts from a given IP or for a given account within a time window — is the credential-guessing prevention mechanism: without rate limiting, an attacker can try thousands of passwords per second against an account; with rate limiting, the same attack is slowed to a rate that makes it computationally infeasible to succeed before the account owner notices and responds.
Speaker B: That is the goal — one identity question word, better-designed user authentication and access management systems. Keep it in your kit.
Who — meaning in Arabic & definition More W courses GL Dictionary