Skip to content

reference

Intended Documentation

Glossary

Precise definitions of Intended terms — IntentRequest, authority decision, Authority Token, audit hash chain, evidence bundle, LIM, Open Intent, connector, tenant, and more.

beginner6 min readimplemented

Glossary#

Definitions for the terms used throughout the Intended documentation, grounded in the platform code. Terms are alphabetical.

A#

Actor#

The identity on whose behalf an action is proposed. In an IntentRequest, the actor is { id, type } (for example { "id": "svc-ci-bot", "type": "service" }). Actors are always scoped to a tenant.

Audit Entry#

One record in the per-tenant audit hash chain (AuditEntry). Each entry carries tenantId, correlationId, intentId, actorId, actorType, eventType, payload, previousHash, entryHash, createdAt. Entries are SHA-256 hashed over canonical JSON and linked by previousHash. See Enforcement Lineage.

Audit Hash Chain#

The authoritative, tamper-evident decision history. A per-tenant chain of audit entries where each entryHash incorporates the previous entry's hash, so any alteration breaks the chain. Verified by verifyAuditChain, which recomputes both content and linkage. Distinct from the audit run stream.

Audit Run#

An unsigned, unchained narrative stream (AuditRun / AuditRunEvent) used for human-readable replay and export of a run. Convenient, but not the integrity substrate — for tamper-evidence, rely on the audit hash chain.

Authority Decision Token (Authority Token)#

A short-lived Ed25519 JWT minted only for an APPROVED decision (packages/tokens). Header { alg: "EdDSA", typ: "JWT", kid } with a mandatory kid. Claims include intentId, tenantId, adapterId, adapterTarget, targetSystem, proposedAction, decision: "APPROVED", issuedAt, expiresAt, nonce; the signer adds iss: "intended-authority", aud: <adapterId>, iat, exp. TTL is 300 seconds — the default and the hard maximum. It is single-use: the nonce is atomically consumed against a DB-unique constraint, so a replay is rejected. (It is Ed25519/EdDSA — not RS256 or ES256/ECDSA — and there is no tid claim.)

Authority Permission Token#

A separate HMAC-SHA256 token (packages/authority-tokens) — a JSON object, not a JWT, with no kid. Fields include tokenId, tenantId, intentId, policyPack, ruleId, decision ("allow|review|deny"), riskScore, issuedAt, expiresAt, signature. TTL defaults: allow = 300 s, review = 3600 s. Do not conflate it with the Authority Decision Token.

Authority Runtime#

Intended's core execution model: it evaluates an intent against the tenant's policy set and, for permitted actions, mints an Authority Token that gates downstream execution. Authorization is a first-class runtime concern, not a perimeter check.

C#

Connector / Adapter#

A runtime adapter (@intended/connector-sdk) that bridges an authority decision to an external system. BaseAdapter.execute() is fail-closed: it always verifies the Authority Token (Ed25519 signature, kid pinning, tenant/adapter/target match, decision === "APPROVED", expiry, and single-use nonce) before running the action, and never runs the action if verification fails.

Correlation ID#

An identifier that ties together the records for a single request across the runtime — present on audit entries and in the /intent response — so a decision can be traced end to end.

D#

Default-DENY#

The runtime posture where the absence of a matching allow rule yields a deny. Applied at the policy engine (no match → DENY) and across the gate. See Fail-Closed Controls.

Decision#

The outcome of evaluation. Two vocabularies, kept distinct: POST /intent returns APPROVED / ESCALATED / DENIED; the modern POST /authority/evaluate returns ALLOW / DENY / REQUIRE_APPROVAL / ESCALATE. Conflicts resolve most-severe-wins (DENY > REQUIRE_APPROVAL > ESCALATE > ALLOW).

E#

Evidence Bundle#

A self-contained export for a single intent (generateEvidenceBundle). It carries the events, an integrityHash (sha256: over canonical events), and a signature = HMAC-SHA256(tenant signing key, intentId:integrityHash). Because the signature is symmetric HMAC keyed off the tenant's stored secret, verifying a bundle requires possession of that tenant secret — it is not publicly or asymmetrically verifiable.

Enforcement#

Applying an authority decision at the point of execution. The adapter verifies the Authority Token before any side effect; "no token, no action."

Enforcement Lineage#

The recorded, verifiable path from policy through evaluation to token issuance and enforcement, captured in the audit hash chain. See Enforcement Lineage.

F#

Fail-Closed#

The principle that when a decision cannot be established, the runtime denies. A failure in the authority loop on /intent returns 500 AUTHORITY_LOOP_FAILED — a denial, not a retryable allow.

I#

IntentRequest#

The structured request submitted to POST /intent. Its shape is:

json
{
  "tenantId": "tenant_acme_prod",
  "actor": { "id": "svc-data-pipeline", "type": "service" },
  "targetSystem": "acme/platform-api",
  "proposedAction": "dispatch release workflow",
  "riskContext": {
    "baseRiskScore": 42,
    "policyCompliant": true,
    "requiresPrivilegedAccess": false,
    "touchesProduction": false,
    "containsSensitiveData": false
  }
}

Note the fields are actor, targetSystem, proposedAction, and riskContext — not action / resource / subject.

K#

kid (Key ID)#

The identifier of the signing key, carried in the Authority Token header and mandatory. The verifier pins the expected kid, so a token signed under a different key is rejected. Key rotation is expressed by issuing under a new kid; format is ${tenantId}-${ts}-${rand}.

L#

LIM (Language Intent Model)#

The interpretation layer (packages/intelligence-engine) that compiles natural language into structured intent. It emits ranked hypotheses; only the primary hypothesis drives the decision — alternates are audit-only. LIM signals can only upgrade decision severity, never downgrade. Today the text LIM classifies a small action set, not all 173 Open Intent categories.

O#

Open Intent#

Intended's intent taxonomy (oi-taxonomy.json, version 2.0: 29 domains / 173 categories), with domain codes OI-N00 and category codes OI-NNNN. At runtime, OI-NNNN codes are emitted by the physical classifier; the text LIM does not yet classify into all 173 categories.

P#

Policy#

A versioned, declarative rule set governing what is permitted for a tenant. The policy engine matches rules by bindings and conditions and resolves conflicts most-severe-wins with default-DENY. See Policies API.

R#

Risk Score#

A 0–100 score: baseRiskScore + (requiresPrivilegedAccess ? 20) + (touchesProduction ? 20) + (containsSensitiveData ? 15), capped at 100. The modifiers are tenant-overridable.

T#

Tenant#

An isolated organizational boundary. Each tenant has its own policies, actors, keys, and audit chain. Cross-tenant access is rejected with 403 TENANT_MISMATCH. Isolation is cryptographic — per-tenant Ed25519 keys — not merely logical.

Trust Boundary#

A perimeter where verification is required: external (client → API), service (between services), data (service → store), and operator (operator → control plane). See Trust Model.

Glossary | Intended