Documentation · The Lagstyr handbook

Glossary

What the words on these pages mean, written for somebody deciding something rather than for somebody learning the schema. These entries are generated from the same catalogue your console uses, in the same groups and the same order, so a term means exactly one thing in both places. If a term is used in your console and is not here, that is a defect worth reporting.

Deciding

Proposal: A change somebody or something has asked for, frozen with the payload that would be applied. Nothing in this product changes authoritative state except through one.
Risk tier: What a skill is allowed to touch: read, write_safe, write_governed, write_kernel. The kernel routes on it and an agent cannot choose its own — which is why the four tiers are the one vocabulary the product names in colour.
Approval route: The instrument that says who may approve this kind of change, and how many of them. Installation data: a fresh install has none, and a governed proposal with no matching route is refused rather than quietly auto-approved.
Cooling-off: A minimum age before a proposal may be approved. Stated on the decision card as a refusal with the time remaining, not as a disabled button.
Materiality: How much the proposer says this change matters: low, medium, high, critical. Declared, not derived — an undeclared materiality is shown as “not declared” rather than as low.
Reversibility: Whether the change can be undone, compensated, or neither. Read it together with the consequence line: an irreversible change whose consequence is an external payment is the one to slow down on.
Authority context: The scope a decision is being made within — legal entity, counterparty, subject, and any spend ceiling. The amount is always shown in major units.
Measurement contract: The commitment to measure whether a material change did what it was supposed to. A material promotion carries one, or it carries a recorded exemption saying why not.

Operating

Ticket: A unit of delegated work with a status, a risk tier and an acceptance test. Its legal next moves depend on its status, and terminal tickets offer none.
Work queue: A view over tickets derived at read time: awaiting approval, awaiting input, blocked, resumable, overdue, failed effect. Not a table anybody writes to.
External effect: Something that happened outside this system because this system asked for it — an email sent, a payment released. The record of the request is an outbound intent; the record of the outcome is an effect receipt.
Effect receipt: What came back from an external system, and whether anybody has verified it. An unresolved receipt is not a failure; it is an external action nobody has established the outcome of.
Verification state: pending, verified, failed, partial, unknown, compensated. “Unknown” is a real answer and the most important one: it means the request went out and the answer was lost.
Compensation: The act that undoes an external effect that should not have happened. Available, requested, succeeded, failed — or not applicable, when nothing could undo it.
Obligation: Something this company owes under a contract, with a due date and an owner. Overdue obligations are on the landing page because nobody else will raise them.
Contract journey: The five stages a supplier contract passes through — evidence, promotion authority, scheduled work, external effect, measurement — and where this one has stopped.

Governing

Action class: A bounded class of thing an agent may do, with limits, evidence requirements and demotion triggers. The unit that gets promoted, paused and demoted — not the agent.
Promotion state: candidate, promoted, demoted, retired. Where this action class sits in its own lifecycle, independent of whether it is currently paused.
Execution mode: How much autonomy a promoted action class runs with (t0, t2, t3). Lower is more supervised.
Demotion trigger: A pre-declared condition that pulls an action class back — a scorecard regression, a feedback error budget, a policy breach, a dependency or verification failure. Declared before it fires, not after.
Policy exception: A time-boxed waiver of a control, with an owner and an expiry. The effective status is derived from the clock, so an exception past its expiry shows as expired even while it is stored active.
AI system: A registered system that uses a model, whether procured, embedded or built. Carries a lifecycle, an owner, workflow contracts and impact assessments.
Impact assessment: The recorded judgement about what an AI system could do to people, and under what controls it was accepted. Reassessed on a cadence.
Spot-check: A sampled write_safe agent action shown to a human for a verdict. The verdict is feedback, not an approval: the action already happened.

Access

Access role: A role that carries declared access meaning, with a sensitivity, a grant ceiling and a review cadence. A role kind with no declared access meaning grants nothing and is not access.
Sensitivity: standard, elevated, critical. Elevated and critical roles carry a grant ceiling and a review cadence enforced at the schema, not by advice.
Entitlement: What a position gives. A birthright entitlement arrives when somebody takes the position and leaves when they do; a requestable one is available to the position and held only after a request.
Access case: A joiner, mover or leaver change, planned as a set of intended effects and enacted in one transaction through an approved proposal.
Carried access: On a move: access the person holds that neither position entitles. It survives the move untouched, and it is part of what they will hold afterwards.
Segregation of duties: Pairs of roles that must not be held together. Checked against the roles the person would end up holding, not against the request. A prohibited pair is a finding; a compensating-control pair may have been approved with one.
Two-person review: The administrator-access review. The second reviewer is a recorded name, not a second authenticated identity, and the review is retained against the exact inventory it was performed on.

Reading this console

Typed id: Every record has one: a three-letter prefix and a ULID, like prp_ for a proposal or acx_ for an action class. Ids are opaque and never reused. Where the console has a page for a prefix, the id is a link.
Authoritative vs projection: An authoritative row is the record. A projection — a brain page, a scorecard — is derived and disposable, and always declares its freshness.
Freshness: Whether a projection is current, stale, rebuilding or never built. A stale page is shown with its staleness named rather than hidden or silently rebuilt.
Source reliability: How far a fact's origin can be trusted: authority, high, medium, low, unknown. Reads answer as authoritative only from a high-or-better active source; everything else comes back with its provenance attached.
not declared: The field exists and nobody filled it in. Shown rather than hidden, everywhere, because silence must never read as “safe”.
Unavailable: The read failed. Distinct from empty, which means the read succeeded and the answer was nothing — and a queue that could not be read is never counted as clear.
Showing the first N: A bounded window, not page one of many. The order says which end of the data you are holding, and there is no second page.
Refused, rejected, denied: Three vocabularies, deliberately not merged. Denied is a person turned away at the door — a login or an administrative act. Refused is an assessor's verdict on an AI system. Rejected is a proposal or a ticket decided against, and terminal.
Paused vs suspended: Paused is a capability stopped: an action class or AI system, held with its reason and its pauser recorded, and restorable by a governed act. Suspended is an actor's authority withdrawn — an agent or a mandate, standing down until somebody reinstates or revokes it.
Applied vs enacted: Applied means an approved proposal's payload actually ran and the change is in the record; approved alone is only permission. Enacted means an access case's every item landed in one transaction, which is what makes a partly offboarded person impossible.