Glossary · ZIFFER

One definition per term, in the words the rest of this section uses, with the API's name beside each of the three verdicts.

The words on the left are the ones used everywhere else in this section. Where the API spells something differently, its name is given too, because that is what your code compares against.

Term	What it means
action catalog	The set of action classes your policy names. It is closed: an action outside it has no risk function, and an action with no risk function is refused rather than graded.
`ALLOW`	The API's name for a granted action. A receipt exists; verify it, then act.
anchored externally	Published where a party other than us can read it. A record only one party holds is a record only that party can edit.
append-only ledger	The chain receipts are added to. A receipt cannot be removed later without breaking every receipt after it.
approver	A person who confirms a held action by signing it. The check is on the signing identity, never on the name in the message.
`ATTEST`	The API's name for an action held for a quorum. It is the gate, not a refusal: the proposal is in flight, the receipt attaches to the same decision once the quorum forms, and proposing again would be a second action.
decision record	One decision as a person reads it: what was proposed, how it was graded, who signed, and when.
`DENY`	The API's name for a refused action. Nothing ran.
epoch	The version number of a policy bundle. An integer, and every publish must raise it. The same epoch twice is refused, which is what stops a rollback to older, more permissive rules.
executor	The component on your side that verifies a receipt and then performs the action with your credential. It is yours, and it is the only holder of the credentials that cause an effect.
grant, granted	The decision that an action may run, produced by grading a proposal against signed policy and comparing the grade to a floor. The API answers `ALLOW`. A grant is not an execution: ZIFFER never performs the action.
hold, held	What happens to an action at or above its floor: it waits for signatures rather than being blocked. The API answers `ATTEST`.
policy	The rules that decide: how sensitive each system is, how risky each action is, what can be undone, who is told, who is paged.
policy bundle	The signed files that carry the policy, with a manifest naming the tenant, the epoch and the signature. You sign it with your own key; change one byte afterwards and the signature no longer verifies.
proposal	A request from an agent for one action: what to do, to which resource, with which arguments. It is not a permission, and holding one grants nothing.
quorum	The rule for a held action: how many distinct approvers must confirm before a grant is issued. Two named humans, in the policy this documentation uses as its example. Two confirmations from one approver are one approver.
receipt	The signed record of a grant: the proposal it answers, the grade, the quorum that met, the identities that signed, and the time. Signed with two independent algorithms, and verification requires both.
refuse, refused	The answer when an action is outside policy, or when policy has nothing to say about it. The API answers `DENY`. Distinct from an access denial: a gap in policy refuses rather than grading down.
sandbox	A separate tenant whose held actions are answered by a robot approver. It exercises the real path with nobody in it, and its receipts fail production verification because it signs under its own identity. It is not a dry run: your handler still performs the action.
signing ceremony	The controlled process by which a policy bundle is signed, with an offline key held apart from every runtime key.
tenant	The customer one signed bundle governs. Your API key determines which tenant you are, and a request naming a different one is refused rather than rewritten.
trust anchor	The public half of the identity that signs your receipts, held by you and obtained out of band. An anchor fetched from the service it is used to check is that service asserting its own identity.
two named humans	The gloss on a quorum of two: named in advance, in signed policy, rather than whoever holds a role at the time.