Glossary · ZIFFER

One definition per term, in the words the rest of this section uses, with the API's name beside each of the three verdicts.

The words on the left are the ones used everywhere else in this section. Where the API spells something differently, its name is given too, because that is what your code compares against.

Term	What it means
action catalog	The set of action classes your policy names. It is closed: an action outside it has no risk function, and an action with no risk function is refused rather than graded.
`ALLOW`	The API's name for a granted action. A receipt follows once the Executor's part is done; wait until it is present, verify it, then act.
anchored externally	Published where a party other than us can read it. A record only one party holds is a record only that party can edit.
append-only ledger	The chain receipts are added to. A receipt cannot be removed later without breaking every receipt after it.
approver	An identity enrolled in your attester registry that confirms a held action by signing it: a person with a passkey or a hardware key, or a machine with a key pair. The check is on the signing identity, never on the name in the message.
`ATTEST`	The API's name for an action held for a quorum. It is the gate, not a refusal: the proposal is in flight, the receipt attaches to the same decision once the quorum forms and the hold releases, and proposing again would be a second action.
decision record	One decision as a person reads it: what was proposed, how it was graded, who signed, and when.
`DENY`	The API's name for a refused action. Nothing ran.
epoch	The version number of a policy bundle. An integer, and every publish must raise it. The same epoch twice is refused, which is what stops a rollback to older, more permissive rules.
executor	The code that verifies a receipt and then performs the action with your credential: your own handler, calling the SDK's `verify` before it acts. Your code is the only holder of the credentials that cause an effect.
grant, granted	The decision that an action may run, produced by grading a proposal against signed policy and comparing the grade to a floor. The API answers `ALLOW`. A grant is not an execution: ZIFFER never performs the action.
hold, held	What happens to an action at or above its floor: it waits for signatures rather than being blocked. The API answers `ATTEST`.
policy	The rules that decide: how sensitive each system is, how risky each action is, what can be undone, who is told, who receives each critical alert.
policy bundle	The signed files that carry the policy, with a manifest naming the tenant and the epoch, and a signature file over the whole set. You sign it with your own key; change one byte afterwards and the signature no longer verifies.
proposal	A request from an AI agent for one action: what to do, to which resource, with which arguments. It is not a permission, and holding one grants nothing.
quorum	The rule for a held action: how many distinct approvers must confirm before a grant is issued. Two named humans, in the policy this documentation uses as its example. Two confirmations from one approver are one approver.
receipt	The signed record of a grant: the hash of the proposal it answers, the grade, the policy version, the digests of the approvals that met the quorum, and the time. Only a granted action gets one; a refusal or an expiry leaves a decision record. Signed with two independent algorithms, and verification requires both.
refuse, refused	The answer when an action is outside policy, or when policy has nothing to say about it. The API answers `DENY`. Distinct from an access denial: a gap in policy refuses rather than grading down.
sandbox	A separate tenant whose held actions are answered by a robot approver. It exercises the real path with nobody in it, and its receipts fail production verification because it signs under its own identity. It is not a dry run: your handler still performs the action.
signing ceremony	The controlled process by which a policy bundle is signed, with an offline key held apart from every runtime key.
tenant	The customer one signed bundle governs. Your API key determines which tenant you are, and a request naming a different one is refused rather than rewritten.
trust anchor	The public half of the identity that signs your receipts, held by you and obtained out of band. An anchor fetched from the service it is used to check is that service asserting its own identity.
two named humans	The gloss on the quorum in the example policy, where it is two: named in advance, in signed policy, rather than whoever holds a role at the time.