Glossary · Authority That Travels

Parties

Who acts, and who answers for it.

agent: A governed identity: a federation entity with its own identifier, its own root, roles, marks, keys and lifecycle state. Has no version.; See it on How it works
assistant: The customer's own AI, for example Claude, acting for the customer through a connector. Not a federation entity.; See it on Your own assistant
publisher: The organisation that builds a release and vouches for it with a signature and, where it has one, its own root.; See it on Same software, many environments
attester: The party that vouches for one instance, binds its key and publishes its entry on a signed list of copies.; See it on Wherever it runs
operator: The organisation that runs an agent and is accountable for it. May be the publisher or not.; See it on Same software, many environments
authority: A Connect entity that publishes signed subordinate statements, marks and policy about the entities it governs.; See it on Find and trust
anchor: The root entity of a trust domain whose key a consumer pins from configuration.; See it on Architecture
member: An organisation that holds claims in an authorisation domain.; Not drawn on a page yet
accreditor: The named person at the enterprise who grants roles in the accreditation console and records the intent.; See it on Find and trust: the evidence
platform: An authorisation server the customer owns, named by pattern: the workforce platform, the API platform.; See it on Architecture
catalogue: The customer side system where software is approved for deployment.; See it on Find and trust

Objects

What is built, signed and published.

release: A versioned build of agent software: artefact, digest, SBOM, tools offered, purpose. Signed by its publisher. Has a version. Has no identity.; See it on Same software, many environments
instance: One running copy of an agent: a key generated in process, an attestation binding that key, and one entry on the attester's signed list of copies. Has no address.; See it on Runtime patterns
client instance attestation: The signed statement an attester issues to one instance after it checks the platform's proof and maps the instance to its approved client. The instance presents it to authenticate as that client at a platform's token endpoint (OAuth attestation based client authentication).; See it on Wherever it runs
entity configuration: The self signed statement an entity publishes at its own identifier.; See it on Evidence
subordinate statement: The statement a superior signs about a subordinate: keys, policy, marks.; See it on How it works: the evidence
trust mark: The signed projection of an active accreditation, with a status endpoint.; See it on Architecture

Acts

What a party does, and what changes when it does.

resolve: Walk the chain from a leaf to a pinned anchor and fold the policy.; See it on Resolved, not registered
pin: The anchor key a consumer holds in configuration, written at deploy time, as the pair of anchor identifier and key.; See it on Across the boundary: the evidence
recognition: The governed act by which an authority becomes a superior of an entity that already publishes its own configuration, minting nothing.; See it on Across the boundary
accreditation: The governance act of granting a role; on the wire, a trust mark.; See it on Governance
withdraw: Change lifecycle or claim state so the authority stops publishing: an identity, an accreditation, a recognition, a publisher.; See it on When something changes
stop: Mark one instance stopped on the attester's signed list of copies. Reaches one running copy. Reversible.; See it on When something changes
revoke: Invalidate a credential: a certificate, a token.; See it on When something changes
expire: Reach the end of a stated lifetime: a statement, a token, an SVID.; See it on When something changes
rotate: Replace a key and re-bind what depended on it.; See it on Governance: the evidence
notify: Push a change to a subscriber so it re-reads sooner. Never replaces the signed source.; See it on When something changes: the evidence

Bounds

What sets the limit on what an agent may do.

trust domain: The set of entities that chain to one anchor.; See it on Across the boundary: the evidence
envelope: The set of authorization detail types and grant types an authority permits an agent to request. The registered ceiling.; See it on Same software, many environments
grant: What an accountable person permitted for one task, carried in the token. The granted ceiling.; See it on Governance: the evidence
ceiling: The bound one of the three layers sets: registered, attested, granted.; See it on Across the boundary

Evidence labels

How each claim on this site is supported. See it on Evidence

Observed: Seen on the wire in this deployment. A linked artefact exists.
Deployment evidence: A property of this deployment read from configuration or a document rather than a live call.
Available: The product does this. It is not switched on in this deployment, or it belongs to an adjacent Raidiam product.
Not observed on this tenant: A property the design requires and this tenant does not show today, stated openly.

One word for each thing. Every page uses the same one.