Glossary: access and authorization
Terms for containers, grants, access manifests, and how access is derived.
Published from docs/glossary/access.md (GitHub)
Part of the glossary.
Access Epoch
The monotonically advancing epoch of an access manifest or encrypted content key. Document updates are epoch-bound: clients decrypt an update only with the document key material for the update’s epoch.
Related docs:
Access Event
A signed mutation statement for an access-relevant change, such as
container.grant, document.link, or attachment.bind. The event commits to
the object, previous manifest, dependency manifests, event body hash, signer
identity, timestamp, and signature.
Related docs:
Access Manifest
A canonical, client-verifiable snapshot derived from signed access events. A manifest commits to object identity, organization, epoch, predecessor, event hash, structural state, grants, referenced principal heads, and key-target hash. Projection rows are caches of manifest state; they are not authority.
Related docs:
Access Plane
The protocol plane that owns authorization state and key-target derivation. It includes signed principal policies, access manifests, container KEKs, content-key bundles, and write headers.
Related docs:
Authorizing Container Path
A verified chain of container manifest heads from an access root toward a target container. The path proves that a user has read, write, or admin access through signed container state rather than through a server-authored ACL row.
Related docs:
Container
The tree-structured object where access control is applied. A container carries direct grants, parent linkage, a metadata document id, and a current container KEK epoch. Documents appear under containers through document link-set manifests; a document may be linked to more than one container in the same organization.
Related docs:
Document Link-Set Manifest
The access manifest for a document’s linked container set.
It names the containers that project the document into navigation
and access decisions, and it is advanced by signed document.link and
document.unlink events.
Related docs:
Effective Access
The access level derived by walking the relevant signed manifest graph, such as the root-to-target container path and referenced managed-principal policy heads. Effective access is computed from verifiable state, not trusted from a single mutable projection row.
Related docs:
Fail Closed
The rule that missing, stale, malformed, or inconsistent policy and key material causes rejection instead of fallback to a weaker authorization path. Unavailable verification material is an availability failure, not permission to bypass checks.
Related docs:
Grant
A signed read, write, or admin container assignment to a
user or group, inherited along container paths. Group grants require active
signed group policy; organizations
receive no grants and use the reserved groups instead.
Related docs:
Root Container
The top container for an organization. It has no parent container and anchors the container hierarchy used for path-based access resolution.
Related docs: