Glossary
Authority layer vocabulary
Canonical definitions for the forming category — action authority, pre-execution authorization, evidence bundles, and controlled autonomy.
Authority layer
A control plane that authorizes each high-risk action at execution time — not via standing credentials or after-the-fact logs.
Action authority
The question of whether this exact action is authorized right now — distinct from who can reach a system (IAM).
Protected workflow
A high-risk automation path guarded end-to-end: policy check, optional approval, and evidence preservation.
Pre-execution authorization
Every guarded action is evaluated before it runs. Control happens upstream of execution.
Identity continuity
Recognition of who or what is acting over time — not just at login. Behavior is compared against prior patterns.
Behavioral risk / risk signals
Advisory signals that score how abnormal an action looks. Risk advises; it never blocks on its own.
Authority Sensors
Humbleaf Authority Sensors — a read-only view of your authority surface: which actors are stable, which need watch, and where approval burden concentrates.
Stable unit of authority
One decision record binding who asked, what was requested, which policy applied, the outcome, and replayable evidence — invariant as workflows compose.
Invariant decision semantics
The five questions every consequential action must answer; the proof shape does not change when tools, delegates, or routes multiply.
Authority topology
The map of who and what can propose, approve, execute, or move value — used to prioritize guards and find weak receipt coverage.
Human approval bound to the exact action
A named approver authorizes one specific action. The approval is single-use, expiring, and cannot be swapped or reused.
Evidence bundle
A replayable record of a decision: what was proposed, which rules applied, who acted, risk context, and approval when required.
Authority Stress Matrix
Adversarial stress tests verifying unsafe cases fail closed — revoked authority, reused approvals, unavailable risk, and more.
Shadow mode
Observe-only rollout: risk is recorded but nothing is enforced until human-reviewed readiness promotes gating.
Authority Surface Map
A deliverable mapping which actions to allow, deny, or escalate — produced from workflow docs, no credentials required.
Authority Readiness Model (L0–L6)
A maturity ladder from bearer-key automation (L0) to optimized controlled autonomy (L6). Most enterprises sit at L1–L2.
Allow / deny / require approval
The three control routes for a proposed action. Policy decides which route applies; evidence records the outcome.
Tamper-evident / hash-bound
Evidence is bound to exact meanings — action, policy, identity, risk, approval — so replay is possible years later.
Signed receipt (onchain)
Where supported for onchain actions, a signed allow/deny record bound to the exact transaction. Details on the onchain authority page.
