> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlasent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Controlled AtlaSent vocabulary for organizational authority, execution-time authorization, protected actions, permits, gates, and evidence.

## Category language

<ResponseField name="Authorization for consequential computational actions" type="category">
  AtlaSent's canonical category statement. The product determines whether a
  specific consequential computational action is organizationally authorized
  under current conditions before the governed effect occurs.
</ResponseField>

<ResponseField name="Execution-time authorization" type="mechanism">
  A per-request Authorization determination made at the execution boundary,
  before a consequential computational action is allowed to produce its native
  effect.
</ResponseField>

<ResponseField name="Consequential computational action" type="concept">
  A computational action capable of producing a material organizational effect
  such that the organization may require explicit authority, policy conditions,
  evidence, or enforcement before execution.
</ResponseField>

<ResponseField name="Organizational Authority" type="concept">
  The standing, scoped organizational right to cause a class of change.
  Authority may be delegated, constrained, revoked, or expire. It is distinct
  from technical capability, Approval, per-request Authorization, Decision,
  Permit, and Evidence.
</ResponseField>

## Identity and action

<ResponseField name="Caller" type="identity">
  The entity presenting a request at the system boundary, before runtime
  identity resolution.
</ResponseField>

<ResponseField name="Actor" type="identity">
  The resolved runtime identity evaluated by Policy. Caller and Actor are
  related but are not synonyms.
</ResponseField>

<ResponseField name="Execution Principal" type="identity">
  The workload, service, process, device, or runtime actually attempting the
  native effect. It is not automatically the requester or approver.
</ResponseField>

<ResponseField name="Action" type="primitive">
  The consequential operation being attempted.
</ResponseField>

<ResponseField name="Action Type" type="identifier">
  The categorical identity of an Action, represented by the canonical dotted
  slug. On the public request surface this maps to `action.type` / `action_type`.
</ResponseField>

<ResponseField name="Action Instance" type="identifier">
  This specific occurrence of an Action. It is distinct from Action Type.
</ResponseField>

<ResponseField name="Action Class" type="configuration">
  The organization-specific runtime governance/configuration object for an
  Action Type. Action Class and Action Type are related but are not the same
  concept.
</ResponseField>

<ResponseField name="Protected Action" type="concept">
  An Action subject to AtlaSent governance or enforcement. A Protected Action
  is not a synonym for Action Class.
</ResponseField>

<ResponseField name="Protected Class" type="metadata">
  Binary enforcement-classification metadata. It is not Action Type identity
  and is not an Action Class.
</ResponseField>

<ResponseField name="Resource / Target" type="primitive">
  The governed object whose state may be affected. Public request surfaces
  commonly use **Target**; normalized internal representations may use
  **Resource**.
</ResponseField>

<ResponseField name="Context" type="primitive">
  Current request or state inputs that are not themselves Authority or Policy,
  such as environment, resource state, transaction facts, timing, or other
  evaluated conditions.
</ResponseField>

## Authority and decision

<ResponseField name="Authority" type="primitive">
  Standing organizational right to cause a class of change.
</ResponseField>

<ResponseField name="Authorization" type="primitive">
  The per-request determination of whether this exact Action may proceed now.
</ResponseField>

<ResponseField name="Approval" type="evidence">
  Verified approver input satisfying a required condition. Approval is an input
  to Authorization; it is not itself standing Authority, the final
  Authorization determination, or proof that Execution occurred.
</ResponseField>

<ResponseField name="Delegation" type="primitive">
  A scoped transfer of Authority subject to applicable constraints such as
  role, time, resource, Action Type/Class, threshold, or Policy.
</ResponseField>

<ResponseField name="Assertion" type="evidence">
  A verified governance fact consumed by Evaluation. A caller-supplied claim
  does not become a trusted Assertion merely because it was supplied.
</ResponseField>

<ResponseField name="Evaluation" type="operation">
  The deterministic operation that evaluates the request against current
  Authority, Policy, required Assertions/approvals, Resource, Context, and other
  applicable conditions.
</ResponseField>

<ResponseField name="Decision" type="primitive">
  The runtime outcome of Evaluation: `allow`, `deny`, `hold`, or `escalate`.
  A Decision is not Approval. An `allow` Decision does not prove that Execution
  occurred.
</ResponseField>

<ResponseField name="allow" type="decision">
  The request satisfies the evaluated Authorization conditions. A Permit may be
  issued for the bounded execution context.
</ResponseField>

<ResponseField name="deny" type="decision">
  The request is not authorized under the applicable evaluated conditions. No
  Permit authorizes execution on that Decision.
</ResponseField>

<ResponseField name="hold" type="decision">
  The request is not yet authorized because a required condition, state, or
  evidence item remains outstanding.
</ResponseField>

<ResponseField name="escalate" type="decision">
  Additional authority, review, or evidence is required before the request can
  become authorized.
</ResponseField>

## Policy and enforcement

<ResponseField name="Policy" type="primitive">
  Versioned rules defining conditions under which Authority may permit an
  Action. Policy is not itself Authority.
</ResponseField>

<ResponseField name="Policy Bundle" type="primitive">
  A published runtime snapshot of Policy rules used for Evaluation.
</ResponseField>

<ResponseField name="Instrument" type="concept">
  The conceptual portable artifact embodying a positive Authorization. The
  current runtime/wire implementation uses **Permit** as the concrete species.
</ResponseField>

<ResponseField name="Permit" type="primitive">
  The current runtime/wire artifact implementing a positive Authorization for a
  bounded execution context. A Permit is verified immediately before execution.
  It is not standing Authority and is not the durable Evidence record.
</ResponseField>

<ResponseField name="Gate" type="primitive">
  The enforcement point with practical ability to withhold or constrain the
  native effect until required authorization conditions are satisfied. A Gate
  is not a Policy engine.
</ResponseField>

<ResponseField name="Verification" type="operation">
  The point-in-time check that a Permit is authentic, current, appropriately
  bound, unexpired, unrevoked, and unreplayed for the execution attempt. The
  current public operation is `POST /v1-verify-permit`.
</ResponseField>

<ResponseField name="Fail-closed" type="posture">
  An enforcement posture in which a governed action does not proceed through
  the protected path when required authorization or verification cannot be
  obtained. Apply this claim only to paths actually configured and tested for
  fail-closed enforcement.
</ResponseField>

## Execution and evidence

<ResponseField name="Execution" type="operation">
  The native system's attempt to perform the Action. Execution is a separate
  state from Authorization.
</ResponseField>

<ResponseField name="Native Effect" type="primitive">
  The actual state change or side effect produced by the native execution
  system. A Decision or Permit issuance alone does not prove the Native Effect
  occurred.
</ResponseField>

<ResponseField name="Evidence" type="primitive">
  The durable record connecting determination, Permit lifecycle, Verification,
  Execution, and execution conformance/outcome.
</ResponseField>

<ResponseField name="Proof" type="primitive">
  Cryptographically verifiable Evidence suitable for independent verification.
  Proof is not a synonym for a Decision, Approval, Permit, or generic log line.
</ResponseField>

<ResponseField name="Audit chain" type="primitive">
  The tamper-evident, hash-linked evidence history used to preserve integrity
  and ordering. Prefer **tamper-evident** over **immutable** unless a stronger
  storage claim is independently supported.
</ResponseField>

## Product packaging

<ResponseField name="Safeguard" type="product">
  Customer/product packaging around one or more Protected Actions. A Safeguard
  can include Action Class configuration, Policy, gate requirements, authority
  mapping, connectors/assertions, rollout/readiness material, and evidence. It
  is not another authorization engine or a second action taxonomy.
</ResponseField>

<ResponseField name="Safeguard Pack" type="product">
  A versioned mapping/reference package for a Safeguard, including Protected
  Actions, gates, assertions/connectors, authority/onboarding, and
  readiness/evidence material.
</ResponseField>

## Controlled distinctions

| Do not collapse | Reason |
| - | - |
| Authority / Authorization | Authority is standing and scoped; Authorization is per request. |
| Authority / Approval | Approval can satisfy a condition; it does not automatically create standing Authority. |
| Approval / Decision | Approval is an input; Decision is the evaluator's runtime outcome. |
| Decision / Permit | Decision is the outcome; Permit is the bounded artifact issued on positive Authorization. |
| Permit / Evidence | Permit is used for execution; Evidence is durable proof material. |
| `allow` / Execution | `allow` does not prove the native effect occurred. |
| Action Type / Action Class | Action Type is identity; Action Class is configuration. |
| Action Class / Protected Class | One is configuration; the other is classification metadata. |
| Gate / Policy | Policy defines conditions; Gate enforces at the execution point. |
| Proof / log | Proof is cryptographically verifiable Evidence, not arbitrary logging. |

## Related

* [Execution-time authorization](/concepts/execution-time-authorization)
* [Organizational authority](/concepts/organizational-authority)
* [Consequential computational actions](/concepts/consequential-computational-actions)
* [Authority vs. authorization vs. approval vs. access](/concepts/authority-vs-authorization)
* [Permit](/concepts/permit)
* [Runtime flow](/concepts/runtime-flow)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.