It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a passwo

It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.