Glossary

Anchor — an Ed25519 signature over the current head of the hash chain, taken periodically. Anchors make the tamper-evidence time-stamped: the chain up to an anchor cannot be modified without modifying the anchor. Public keys travel with exports.

Approval gate — a gate that pauses execution pending human approval, with quorum rules, an SLA, and an escalation path.

Cedar — the AWS-published authorization language used for Orkena policy packs, evaluated in-process by Cedar’s Rust evaluator via cedarpy bindings (BE-17, landed 2026-08-16). Packs validate against the meridian-v1 schema.

Checkpoint — the persisted state of a run at a step boundary. Checkpoints make runs durable and resumable.

Consolidation — the overnight (or on-demand) process of merging duplicate memories, surfacing contradictions and proposing rule refinements. Nothing proposed activates without a human veto window and an eval gate. See Memory consolidation.

Deny — a policy verdict meaning the action is not permitted to execute. A denial is a control that fired, not an incident that was noticed.

Deterministic replay — reproducing a run byte-for-byte from the recorded non-deterministic inputs. The primary artifact for interrogating a decision after the fact.

Edge — a connection between two nodes in a graph; every edge traversal is a policy decision point.

Evidence bundle — a signed archive: ledger slice, anchors, public key, readable report, dependency-free verify.py. Verifiable offline on any machine.

Eval suite — a first-class evaluation dataset plus judge rubric. Promotion to production is gated on passing the suite.

Fork — an alternate run created from a checkpoint, with one or more variables changed. The fork stays linked to the original in the ledger.

Graph — a versioned definition of an agent workflow: nodes and edges. Authored on canvas or in DSL; the two are code-parity.

HITL — human-in-the-loop. A gate that requires human approval before execution continues.

Irreversible action — an action with permanent effect (payment, credential change, data deletion). Irreversible actions derived from tainted input are denied by default.

Ledger — the per-tenant append-only hash-chained record of every authorization, execution, approval and administrative action.

Memory — the cross-run store of what agents learned, governed by consolidation and human veto.

Node — one step in a graph. There are 19 types; see Nodes.

Permit — a policy verdict meaning the action may execute.

Policy pack — a versioned set of authorization rules in Cedar, evaluated in-process by Cedar’s Rust evaluator against every proposed action.

Principal — the identity under which an action is evaluated. Each agent is its own principal with scoped credentials; there is no shared key.

Run — one execution of a graph from trigger to terminal node. Runs are durable state machines.

Taint — a provenance marker applied to content from untrusted sources (tool results, retrieved documents, inbound mail). Taint propagates; irreversible actions derived from tainted content are denied by default.

Tenant — an isolated organization with its own row-level security scope and its own hash chain.

Verdict — the outcome of a policy evaluation: permit, deny, or hold for human approval.

Workspace — a scoped area within a tenant: one graph, one policy pack set.