Reference
The vocabulary of computable authority
A field in formation needs terms that mean the same thing to everyone using them. These definitions are working definitions — precise enough to argue with, and revised when the argument is better.
02
One of the first practical domains of computable authority.
The practice of representing institutional rules, obligations, permissions, constraints, authority boundaries, and decision logic in a form machines can interpret and execute, providing methods for expressing institutional rules in executable form.
04
Turning a decomposed policy into an executable artifact.
The process of converting a structured policy — definitions, rules, exceptions, conditions, decision logic — into an authority artifact that a runtime can evaluate without further human interpretation.
05
Separating a policy into its structural parts.
The unit operation of policy engineering: reading an instrument and extracting its definitions, operative rules, conditions, exceptions, decision points, and unresolved ambiguity as distinct elements.
06
Same artifact, same facts, same outcome — always.
The property that evaluating a given authority artifact against a given set of facts produces the same outcome and the same reasoning path on every run, on any conforming runtime.
Determinism is what makes an outcome auditable. Without it, a decision cannot be replayed, only re-argued.
08
Binding every decision to the authority that governed it.
The discipline of issuing authority artifacts under immutable versions so that any past decision can be replayed against the exact rules in force when it was made.
See alsoAuthority Artifact
09
The practitioner who makes authority executable.
A practitioner who decomposes institutional instruments, resolves ambiguity with the authority holder, compiles artifacts, and maintains them across versions — sitting between legal drafting and systems engineering.
See alsoPolicy Decomposition
10
The environment that evaluates authority artifacts.
The execution environment that loads authority artifacts, evaluates them against facts, enforces the resulting permissions and prohibitions, and emits a verifiable record of each evaluation.
12
An institution whose authority is computable by default.
An organisation that issues its rules as authority artifacts rather than prose alone, so that human and machine actors operate from the same executable, versioned source of authority.
See alsoComputable Authority
13
The unwritten system an institution actually decides by.
The effective decision structure an institution operates on, distinct from the one it has documented — composed of stable judgement heuristics, recurring exception handling, and implicit thresholds that govern outcomes without ever having been authored.
Its existence is structural rather than pathological. Documentation states intent; the latent system produces outcomes, and the two diverge continuously in every institution.
See alsoDecision BoundaryReconciliationAuthority Translation Gap
14
The point at which an institution's answer changes.
The threshold on a given field at which a decision flips from one outcome to another, expressed as the field, the value, and which side of it is the permissive region. The unit of comparison between a documented policy and an observed one.
A boundary is not a rule. A rule is authored and may never be exercised; a boundary is where the institution's behaviour actually turns, and can be recovered from records whether or not anyone has written it down.
See alsoLatent Decision SystemReconciliationPolicy Decomposition
15
Whether a decision record can support any claim at all.
The prior question of whether a body of recorded decisions is capable of evidencing a boundary — assessed on volume, outcome variety, completeness of the policy-relevant fields, and temporal coverage — determined before any inference is attempted.
A record in which every decision produced the same outcome carries no information about where the boundary lies, however large it is. Admissibility is a precondition, separate from the weight of what is later found.
See alsoDecision BoundaryReconciliation
16
Comparing the documented policy against the observed one.
The comparison of a documented boundary against an observed boundary on the same field, yielding one of: faithful (they agree within tolerance), divergent (they differ, with a derivable direction), undocumented (practice holds a boundary the document never states), or dormant (the document states one practice never exercises).
The comparison is made boundary to boundary, not text to text. Two rules can share nearly every word and impose different thresholds; two can share no vocabulary and impose the same one.
17
A measured divergence between documented and observed authority.
The difference between where a policy places a decision boundary and where practice places it, expressed with a direction — toward permissiveness or toward caution — derived from which way the permissive region moved.
Direction is derived from the geometry of the boundary, not inferred from the language of the rule. Whether drift is harmful is a separate claim requiring outcome evidence.
18
Judging whether a divergence is actually harmful.
The separate step of establishing, from outcome evidence rather than from the divergence itself, whether observed drift improves or degrades results — adjusted for confounders, corrected for having tested many rules at once, and permitted to return no verdict.
Detection and judgement are distinct operations. A method that always returns a verdict is not measuring anything; inconclusive must remain an available result.
See alsoDriftReconciliation
19
A recurring way a decomposed policy conflicts with itself.
One of the structural conflicts that surface only once a policy is expressed as structure: threshold conflicts, role conflicts, ghost terms, rule collisions, and layer divergences between an instrument and the one it sits under.
Prose can hold two contradictory provisions indefinitely because they never meet on the same page. Structure forces them to meet, which is why detection belongs before an artifact is issued, not after.
21
One exact action, carried with everything needed to prove it legitimate.
A self-verifying package carrying an action (type, subject, parameters), the sealed authority and certificates it acts under, testimony, consents, an audience naming the relying party, a single-use nonce and a validity window. An Act has no signature from the carrier.
Defined in NOMOS-SPEC-008 §2; R-19 §3.4
22
The system of record that would make the change, and verifies before it does.
The system of record for the state an action would change: a ledger, a registry, an API in front of its own database. It pins its own root, keeps a nonce ledger, holds its own state, may keep its own record of which version of each authority is in force, and commits exactly the action it verified or nothing.
Defined in R-19 §3.2; NOMOS-SPEC-008 §6, §8
See alsoActPinned RootReceipt
23
Whoever assembles and submits an Act, usually an AI agent.
The party that assembles an Act and submits it. It has no key that appears anywhere in verification, and the model treats it as an adversary: it may choose certificates, versions, statements and omissions.
Defined in R-19 §3.2, §3.5
See alsoCarrier IndifferenceAct
24
The formal content of 'the agent is not an input'.
A verifier is carrier-indifferent if, whatever Act the carrier constructs, a verdict of AUTHORIZED implies that legitimate, current authority applied to the true facts permits the action, or that the required people approved exactly it.
The carrier can choose which action to propose, and nothing else that matters: not the certificates, their order, the version presented, which statements it adds or leaves out, or what it says itself.
Defined in R-19 Definition 1
25
What the equation's inputs must satisfy for carrier indifference.
C1, the authority is genuine (recognized from a pinned root) and current (the version in force). C2, the facts are proven: each arrives through its declared channel with its declared type, and absence is undecided. C3, the action is bound: every consent signs a digest of exactly this action, authority, testimony, audience, nonce and window. C4, the verdict is computed where the change lands, by the component holding the only credential able to make it.
Refined into six obligations; each is necessary, and together they are sufficient.
Defined in R-17; R-19 §3.7
26
The institution that authors and seals an authority.
An institution that authors and seals authorities, holding a sealing key. One of the three roles that cannot be computed into existence, because it confers authority rather than exercising it.
Defined in R-18; R-19 §3.2
27
A party certified to state particular facts.
A party whose key is certified, by claim, to state particular facts about a subject. A witness's honesty is a governance assumption: certification bounds which facts a key may assert, not whether its assertions are true.
Defined in NOMOS-SPEC-007 rev. 1.8 §2; R-19 §3.2
28
A person certified to consent in a particular role.
A person whose key is certified to consent in a role. Every key of one person carries the same approver identifier, so consents are counted by person, not by key.
Defined in NOMOS-SPEC-007 rev. 1.9 §3.7; NOMOS-SPEC-008 §4.4
29
One key certifying another to sign, within a scope, until an expiry.
A signed statement by a parent key that a child key may sign within an optional scope until an expiry, verified entirely offline against a root the relying party pinned. The certified public key is carried inline: there is no directory to resolve it from.
Defined in NOMOS-SPEC-007 §3
30
The key a relying party has decided, out of band, to trust.
The root public key a relying party configures itself, never accepted from the presenter. It is the whole trust boundary: every issuer, witness and approver key must chain to it.
Who should operate a shared root is an open question of the discipline (R-09).
Defined in NOMOS-SPEC-007 §4, §5; R-09
See alsoKey CertificateRelying Party
31
The limits of a delegation, which may narrow and never widen.
A set of dimension:value terms in a certificate: artifact, industry and jurisdiction (matched against what an artifact declares), claim and consent (matched against the statement a key signs), suite and approver. Narrowing along a chain is monotonic, and a dimension a verifier does not recognize fails closed.
Defined in NOMOS-SPEC-007 §2; rev. 1.9 §3.6–§3.8
32
Resolving a key from itself back to the root, the same in any order.
Enumerating candidate certificate paths from the key to be resolved back toward the pinned root, trying them in certificate-fingerprint order, so that the same set of certificates reaches the same verdict however it is presented. A candidate whose scope does not admit the purpose is a failed candidate, and the next is tried.
Defined in NOMOS-SPEC-007 rev. 1.8 §4.2a; rev. 1.9
See alsoEffective ScopeKey Certificate
33
What a key may do, as accumulated along its path.
The accumulation of every certificate's scope along the path that resolves a key, with each term placed where its dimension first appears. A purpose (sealing an artifact, stating a claim, consenting in a role) admits or refuses it.
Defined in NOMOS-SPEC-007 rev. 1.9 §3.8
See alsoScopeTarget-First Resolution
34
A key certified to testify or consent, which can never seal rules.
A key whose effective scope contains a claim or consent term. It may not seal an authority, and a key without a claim term may not testify. The party that writes the rules and the parties permitted to state the facts they read are separated by construction.
Defined in NOMOS-SPEC-007 rev. 1.8 §2
35
A witness's signed statement of one fact about one subject.
A signed statement (claim, value, subject, validity window, key) from a witness certified for that claim. Invalid testimony rejects the whole Act; it is never silently dropped.
Defined in NOMOS-SPEC-008 §3
See alsoWitnessFact Channel
36
A person's signed approval of exactly one Act.
A signed statement by an approver over an Act's binding digest, in a role. It approves that exact action, under that exact authority, with those exact facts, for that audience, once.
Defined in NOMOS-SPEC-008 §4
37
What every approval signs.
A hash over the Act's identity, nonce, window, audience, action, the authority's seal hash and the testimony. Changing any parameter, swapping the rules, substituting a fact or readdressing the Act invalidates every consent.
Defined in NOMOS-SPEC-008 §4.3
38
n approvals means n distinct people, never n keys.
An escalation requiring n consents is satisfied only by consents from n distinct approvers. Two keys of one person count once, and if the admitted paths to a key disagree about whose it is, the consent is refused, so the carrier cannot choose who a consent counts for.
Defined in NOMOS-SPEC-008 0.6.0 §4.4
See alsoApproverConsentEscalation
39
The declared route by which each fact may arrive.
Every input an authority reads declares one source: action (the parameters, exactly what is committed), testimony (certified witnesses), relying_party (the relying party's own state), or presenter (the carrier's word, accepted explicitly). A fact through any other channel, or of the wrong type, rejects the Act.
Defined in NOMOS-SPEC-008 §7, §7.1
See alsoTestimonyThree-Valued Evaluation
40
An absent fact is undecided, never false.
Every condition evaluates to true, false or undecided. A condition that reads an absent fact, or an operand of the wrong kind, is undecided, and the connectives follow Kleene's strong three-valued logic. Absence decides exists() only where it is authoritative: the action and the relying party's own state.
Defined in NOMOS-SPEC-008 §6.2
See alsoINCOMPLETEOmission Safety
41
The verdict that commits nothing while a fact could still change the outcome.
Returned when the result would permit or escalate but a block or escalate rule that outranks it is undecided on the facts presented. It names the open rules and the facts that would decide them, and no consent can stand in for a missing fact.
Defined in NOMOS-SPEC-008 §6.2
42
Withholding facts cannot gain an authorization.
If an Act is authorized, or escalated to a particular escalation, then completing the facts it withheld can never make it denied or incomplete, nor move it to a different escalation. Withholding a fact cannot buy a weaker approval path.
Proved in Lean 4 for exactly the specified semantics.
Defined in R-19 Proposition 1
43
A rule's outcome that reserves the decision for a person in a role.
An outcome naming the role whose consent the action requires and how many distinct approvers. An escalated Act commits only when those consents, bound to exactly it, are present; two equal-priority escalations naming different escalations cannot be sealed.
Defined in NOMOS-SPEC-001 v2.2.0 §3.7; amendment 2.3.0; NOMOS-SPEC-008 §4.4
See alsoConsentCounted by PersonApprover
45
How a relying party establishes which version is in force.
Declared per authority, with no default: record (only the relying party's own record of the in-force version) or record_or_statement (its record where it keeps one, otherwise an issuer-signed in-force statement). Under record, a stolen sealing key cannot authorize anything new.
Defined in NOMOS-SPEC-008 §5.5
See alsoAuthority in Force
47
Not knowing what is revoked is not the same as nothing revoked.
A relying party's established view of current revocations, dated by the newest list whose signer its root recognizes. When that knowledge is older than the relying party's maximum age, it refuses to commit rather than treating silence as 'nothing revoked'.
Defined in NOMOS-SPEC-007 rev. 1.10 §5.3, §5.6
48
A short-lived proof that a key was not revoked as of a time.
A statement signed by a key's own certifying parent that the key is not revoked as of a time, attached by the presenter for a verifier with no revocation source of its own. It can raise confidence from unchecked to staple, never to live.
Defined in NOMOS-SPEC-007 §5.5
See alsoRevocation Knowledge
49
The record that lets anyone re-run the verdict later.
What a relying party records for each verification: the Act's digest, the verdict, the deciding rule, the verification time, the relying-party facts it evaluated and how currency was established. With a retained copy of the Act, a third party can reproduce the verdict without access to the agent or any service.
Defined in NOMOS-SPEC-008 §9
50
Exactly the certificates an Act relies on.
The set of certificates reaching every key an Act relies on (its seal, each witness, each approver), drawn from all certificates available to the carrier. Deterministic, so two carriers present the same set, and complete, so the relying party evaluates every path.
Defined in NOMOS-SPEC-009 0.2.0 §6.5
51
One closed set of rules for every signature.
The registry of suites a verifier accepts (Ed25519, ES256, WebAuthn-ES256), each fixing the key type, the bytes signed and one canonical encoding. There is no negotiation and no fallback, so keys can stay in KMS, HSM and passkey custody.
Defined in NOMOS-SPEC-010
See alsoCanonical Encoding
52
Every object has exactly one byte form.
The rule that every signed object, key and signature has one canonical form (RFC 8785 JSON, fixed key encodings, low-S signatures), so a hash or signature cannot change without a change in meaning.
Defined in NOMOS-SPEC-001 §8.1; NOMOS-SPEC-010 §2–§4
53
A constraint that depletes, such as a budget.
A constraint whose remaining capacity changes as authority is exercised. It lives in a state layer beside evaluation (reserve, settle, release), with evaluation reading the current state as an explicit fact, so the evaluation itself stays pure.
Defined in R-12; R-13
See alsoRelying Party
Whoever defines the vocabulary defines the field. If a term here is wrong, imprecise, or missing, that disagreement is part of the work.
Discuss terminology