Eight terms, defined

Each concept has a definition, its shape in code, the invariants that hold with the test that checks each one, and what is explicitly out of scope.

The accountable human or organization on whose authority something acts.

Software that sends requests, on its own or for a principal, and may carry a signature claim.

The on-behalf-of chain that binds an agent to a principal for a scoped task.

Records that let someone else check a claim, graded by how much weight they can bear.

The outcome a policy gives one request, with the rule and the facts behind it.

A signed record of one decision that anyone can check offline.

The rules and flag state that turn a request into a decision, identified by hash.

The isolation boundary: one organization's policies, receipts and data.