Glossary
Look up the terms for authority, governed calls, evidence, rules across calls, containment, and cooperation, with links to their mechanisms.
On this page
A capability names authority; a capability token carries it as signed data. Guards run before dispatch, while output checks inspect what a tool returns. Receipts record decisions. Settlement performs accounting or value transfer, which signing a receipt does not do.
Code identifiers and schema values keep their own spelling, so a decision reads allow or deny exactly as a receipt records it.
Authority is granted, narrowed, and revoked
- agent
- A software actor that requests work and uses authority. In a governed call it can exercise only the authority in the capability it presents. The mediated call
- capability
- The authority a capability token describes: who issued it, who may use it, which operations it covers, and until when. Capabilities
- capability token
- The signed, scoped, time-bounded data that carries a capability. It can hold delegation links and the constraints that narrow it. Capabilities
- grant
- One named portion of a capability’s scope: a tool, resource, or prompt, the operations allowed on it, and constraints on its parameters. Capabilities
- trusted issuer
- A key the kernel accepts as the signer of capability tokens. A token signed by any other key is refused, however well formed. Capabilities
- delegation
- Issuing downstream authority from authority already held. Each step is one signed link in the child token’s chain, naming the delegator, the delegatee, and the narrowing. Delegation and attenuation
- attenuation
- A narrowing of delegated authority along a stated dimension: scope, cost, count, time, or a constraint. Delegation can narrow a grant and never widen it. Delegation and attenuation
- aggregate invocation budget
- A cap on invocations across every grant in one capability, or across every descendant of one delegation family. Splitting work among delegated agents does not multiply the permitted count. Invocation limits
- revocation
- Making an issued capability token invalid from a recorded time. The kernel checks the token and every link of its chain, so revoking a parent refuses its descendants. Autonomy with authority
- workload identity
- The cryptographic identity bound to a running workload or agent process. It is not an operator account, an issuer identity, or a signing key. Workload identity
The kernel decides each call
- kernel
- The trusted mediator at the governed-call boundary. It verifies authority, runs the guards, records the decision, and dispatches an allowed call. The mediated call
- governed call
- A tool call that reaches its resource only through the kernel, which admits or refuses it and signs a receipt either way. The mediated call
- policy
- Declarative rules loaded for evaluation, identified by name, version, or hash. A policy is neither a guard nor a verdict. Write a policy
- guard
- A check in the pre-dispatch pipeline that inspects a request and returns an authorization outcome for that call. Guards
- guard pipeline
- The ordered guards evaluated for a call. The first denial stops the call before it runs, and later guards do not run. Guards
- output check
- A check on what a tool returns, after dispatch. It can refuse the result; it cannot undo an effect the tool already had. The mediated call
- decision
- The kernel’s recorded outcome for a call, reported by its schema value, such as
allow,deny,cancelled, orincomplete. Receipts - approval
- A person’s signed decision, bound to one exact request, when policy requires one. It authorizes that request once. Human-in-the-loop
- threshold approval
- A requirement that a signed proposal collect at least its threshold of approvals from an eligible key set before its deadline. Each distinct eligible key counts once. Threshold approvals
- budget
- A declared spending or usage limit. The kernel reserves against it before dispatch with a budget hold. Budgets and metering
- metering
- Measuring usage or cost for a stated unit, scope, and period. Metering alone does not authorize, charge, reconcile, or settle. Budgets and metering
- reconciliation
- Adjusting an authorized hold to the realized cost after the call returns. Budgets and metering
- settlement
- Final accounting or value transfer for a run or an obligation between parties. Signing a receipt is not settlement. Budgets and metering
- execution adapter
- The component that performs an admitted operation on the resource. The host must make it the only route there. Connect an application
- confinement
- Linux limits on a native tool process. Its cage profile denies filesystem and network access by default, then adds the resources the grant names, never beyond the operator’s ceiling. Process confinement
- process host
- The component that gives long-running work a durable identity, retained checkpoints, and named calls, so a replacement worker can resume it. What survives a crash
Evidence records what was decided
- receipt
- A signed record of an evaluated call, refusals included. Its kind fixes what it can claim: a mediated decision, a trace observation, or an advisory evaluation. Receipts
- checkpoint
- A signed Merkle root over a batch of receipts, chained to the checkpoint before it. Verifiable evidence
- inclusion proof
- The sibling hashes along one receipt’s path to a checkpoint root. A verifier holding the checkpoint can check that receipt without the rest of the batch. Verifiable evidence
- canonical JSON
- The one byte encoding of a JSON value that Chio signs and hashes, so every party computes the same digest for the same value. Determinism and replay
- delivery contract
- The rule that an allow under a grant carrying an output digest holds only if the delivered output hashes to that digest. On a mismatch the kernel signs a
denythat charges nothing. The delivery contract - model
- The bounded formal or operational representation over which a property is analyzed. Formal assurance
- theorem
- A formally stated result in a named proof system, with its property, its model, and its assumptions. Formal assurance
- invariant
- A property meant to hold across stated transitions, together with the boundary that enforces or proves it. Formal assurance
- assumption
- A condition that a proof, model, or deployment claim depends on, stated beside the claim it limits. Assurance model
- refinement witness
- A concrete request that a proposed policy admits and the policy it replaces denies, confirmed by evaluating it under both policies. Finding one makes the result
does_not_refine. What a policy permits
Restrictions follow the work across calls
- session journal
- The hash-chained record of a session’s governed calls: each entry’s tool, server, agent, bytes read and written, and whether it was allowed. Session-aware guards read it through one snapshot. Session-aware guards
- sequence rule
- A rule on the order of a session’s tool calls: a required first tool, a required predecessor, a limit on consecutive calls, or a forbidden transition. It compares tool names, never arguments or data. Session-aware guards
- information label
- The restrictions that must survive a transfer of data: its owners, the readers each owner permits, and the compartments a destination must preserve. Labels and clearances
- join
- Combining two labels so both sets of restrictions survive. Readers are intersected for an owner both labels name, and compartments are combined, so a public input cannot reset a restricted session. Labels and clearances
- destination clearance
- The restrictions a destination accepts, in the same vocabulary as a label. Chio permits ordinary flow to it only when the destination preserves every source owner’s policy and contains every required compartment. Control egress
- tool flow declaration
- A tool’s signed information contract: the label its output carries, the clearance its input needs, whether it sends data outside the session, and the declassification purposes it accepts. Tool flow declarations
- persistent taint
- The restrictions a read leaves on later work for a principal, its delegation lineage, or a session. Chio stores them before releasing the information, so a replacement worker inherits them. Persistent taint
- isolation epoch
- A verified boundary that clears a principal’s accumulated taint while its lineage and the fresh session’s inherited taint remain. Persistent taint
- declassification grant
- A signed, single-use exception that permits one disclosure for one purpose, bound to the request, the source label, the target label, the destination, and the tool. Retained taint stays in place. Declassification
Detection leads to bounded containment
- tripwire
- A controlled artifact whose contact can be traced to a registered owner and tenant. Contact shows that something reached it; intent needs separate investigation. Decoys and tripwires
- decoy
- A tripwire shaped like something an agent might use, such as a canary capability, a honey tool, or a credential file. Reading a decoy and presenting it for use are different contacts and support different conclusions. Decoys and tripwires
- blast radius
- The reach of a finding, resolved by a bounded walk of its recorded lineage. A complete walk yields the affected set; an incomplete walk yields none. Blast radius
- affected set
- The exact capabilities a finding’s lineage reaches, resolved by a bounded walk. No containment plan, automatic or governed, proceeds without one. Blast radius
- quarantine
- A bounded response that restricts a resource for a reviewed scope and duration, retained as its own contribution. Lifting it removes only that contribution, so another response’s restriction stays. Quarantine and recovery
Operators exchange authority and evidence
- federation
- A standing relationship between operators for exchanging authority and evidence. An internal cluster is not a federation. Federation and swarms
- federation peer
- Another operator’s kernel. A treaty sets how authority and evidence cross between the two. Federation and swarms
- model card
- A signed declaration about particular model weights that bounds the scopes and tools a provider binding may request. A binding outside it is refused, and the first failing gate is reported. Model cards
- finding
- The seller-signed, content-addressed record sold on the Cognition Market. It commits to a sealed payload by digest and carries no payload bytes. Markets for agent work