Skip to content

tutorials

Intended Documentation

Glossary

Glossary of key Intended terms — authority runtime, decision token, policy, intent, enforcement, tenant, trust boundary, connector, and more.

beginner4 min readimplemented

Glossary#

This glossary defines the key terms used throughout the Intended documentation. Terms are organized alphabetically.

A#

Action#

The specific operation an actor intends to perform on a resource. Actions are defined as part of an intent and evaluated against policies. Examples: execute, read, deploy, configure.

Actor#

The identity performing an action. An actor can be a human user, a service account, or an AI agent. Actors are always scoped to a tenant.

Audit Event#

A structured, immutable record of an action within the platform. Audit events capture intent submissions, policy evaluations, token issuance, and enforcement outcomes. See Audit API.

Authority Runtime#

The core Intended execution model. An authority runtime provides cryptographic authorization for AI execution by evaluating intents against policies and issuing decision tokens that gate downstream actions. Unlike traditional access control, the authority runtime treats authorization as a first-class runtime concern rather than a perimeter check.

C#

Circuit Breaker#

A resilience pattern that prevents cascading failures. When a component exceeds its failure threshold, the circuit breaker trips and returns immediate deny responses without contacting the failing service. See Fail-Closed Controls.

Connector#

A runtime adapter that bridges Intended authorization to an external AI service or tool. Connectors enforce decision tokens at the boundary between Intended and the downstream service. Examples: OpenAI connector, database connector, internal API connector.

D#

Decision Token#

A short-lived, cryptographically signed artifact that encodes the result of a policy evaluation. Decision tokens are issued by the Token Service after a successful evaluation and presented to enforcement points to gate actions. Tokens carry scopes, expiry times, and a reference to their originating evaluation. See Enforcement Lineage.

Default Deny#

The security posture where any request without an explicit "allow" decision is denied. Intended uses default deny at every layer. See Fail-Closed Controls.

E#

Enforcement#

The act of applying an authorization decision at a specific point in the execution chain. Enforcement verifies that a valid decision token exists and that its scopes match the requested action.

Enforcement Lineage#

The cryptographically verifiable chain from policy to evaluation to decision token to enforcement. Lineage guarantees that every authorization outcome can be traced to its origin. See Enforcement Lineage.

Enforcement Point#

The location in the system where a decision token is validated and an action is permitted or denied. Enforcement points are typically located at connectors or service boundaries.

Evaluation#

The process of assessing an intent against the active policy set to produce an authorization decision (allow or deny). Evaluations are performed by the Policy Engine and produce an evaluation record.

F#

Fail-Closed#

A failure mode where system unavailability results in denied requests rather than permitted ones. Intended is fail-closed by design. See Fail-Closed Controls.

I#

Intent#

A structured declaration of what an actor wants to do. An intent specifies the actor, action, resource, and context. Intents are submitted to the Intended API for evaluation. See Intents API.

json
{
  "actor": "svc_data-pipeline",
  "action": "execute",
  "resource": "model:gpt-4/inference",
  "context": {
    "environment": "production"
  }
}

P#

Policy#

A versioned, declarative rule set that defines what actions are permitted or denied for specific actors and resources. Policies are the source of truth for authorization decisions. See Policies API.

Policy Engine#

The service responsible for evaluating intents against policies. The Policy Engine applies all matching rules, resolves conflicts using default deny semantics, and produces an evaluation record.

R#

Resource#

The target of an action. Resources are identified by structured identifiers (e.g., model:gpt-4/inference, database:analytics/query). Resources can be scoped to specific capabilities or sub-resources using path notation.

T#

Tenant#

An isolated organizational boundary within Intended. Each tenant has its own policies, actors, connectors, audit trail, and configuration. Tenants cannot access each other's data or policies. Multi-tenancy is enforced cryptographically — not just logically.

Trust Boundary#

A security perimeter between components where verification is required. Intended defines multiple trust boundaries: external (client to API), service (between internal services), data (service to data store), and operator (operator to control plane). See Trust Model.

Token Service#

The service responsible for signing and issuing decision tokens after a successful policy evaluation. The Token Service manages signing keys and enforces token TTL configuration.