--- title: "Glossary" description: "Look up the key terms used across Guardian." source: "Guardian Platform" --- Definitions of terms you'll encounter across Guardian. ## Structure | Term | Definition | | :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Organization** | The top-level account in Guardian. All projects, members, and policies belong to an organization. | | **Project** | A distinct scope of work — a product, initiative, system, or agent — that your team wants to bring into compliance. | | **Policy** | A structured set of compliance requirements. Policies may represent regulations, RMFs, or internal SOPs. | | **Applied policy** | A policy that has been applied to a project, activating the policy's controls and enabling your team to start tracking compliance. | | **Policy Library** | The collection of all policies available to apply to your project. The Policy Library is scoped to your organization. With agent certification on, the sidebar calls it **Library**, which holds Policies and Programs. | | **Control** | A discrete mandate within a policy, or one requirement within a Governance Program. | ## Compliance workflow | Term | Definition | | :------------------- | :------------------------------------------------------------------------------------------------------------------------ | | **Declaration** | A statement describing how a control has been implemented, or, in an assessment, how an agent meets a program's controls. | | **Review** | A statement describing whether a control's implementation is satisfactory, or whether an agent meets a program control. | | **Attachment** | A file submitted to support a declaration or review. | | **Control status** | A snapshot of a control's current state. A control's status updates based on the last action taken on that control. | | **Credential** | An attestation that a project has met a specific policy. An individual agent's counterpart is an agent certification. | | **Report** | A point-in-time record of a project's compliance status toward a specific policy. | | **Integrity action** | An action that is cryptographically signed and hashed at the moment you take it, making it permanent. | ## Indicators | Term | Definition | | :----------------------- | :-------------------------------------------------------------------------------------------------------------------------------------- | | **Indicator** | An automated evaluation that determines whether a system, environment, or function matches machine-readable criteria you define. | | **Event** | Data your systems send to an indicator's ingestion endpoint to be evaluated. | | **Ingestion endpoint** | The endpoint an indicator connects to. | | **Extraction Rule** | A rule that tells the indicator where to look in an event (using a JSONPath) and what value to expect there (using Success Criteria). | | **JSONPath** | An expression used to select a value from incoming event data. | | **Success Criteria** | The conditions that determine whether an evaluation results in Success or Failure. | | **Evaluation status** | The result of an indicator's most recent evaluation (or lack thereof): Awaiting Evaluation, Success, Failure, or Evaluation Error. | | **Declaration Template** | The template used to define the declaration an indicator submits to the controls it's applied to when an evaluation results in Failure. | ## Agent certification | Term | Definition | | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Governance Program** | An organization's standard for certifying an individual agent: a set of controls, the configuration fields a certification binds, and how long a certification lasts. | | **Program version** | One immutable version of a Governance Program, addressed as `slug@version` and identified by its Manifest CID. A change to a program is published as a new version. | | **Assessment** | An agent's case for certification under one program version: the pinned configuration and operating profile, declarations, and not-applicable claims. | | **Submission** | A numbered, frozen copy of an assessment's draft, sent to the program's reviewers. A later submission supersedes it. | | **Agent certification** | A signed credential that one agent, running one configuration, met every control of one program version. It never covers a project or a later configuration. | | **Configuration** | The fields of an agent's setup that its requests capture, such as its permissions, skills and settings files. | | **Configuration CID** | The fingerprint of a configuration. The same settings always give the same CID, and a change gives a new one. | | **Operating profile** | The owner's versioned declaration of what an agent is for, the systems it reaches, and what it must never do. | | **Configuration standing** | How an agent's keys stand against the configuration a certification names: Current, Partly Drifted, Drifted, or Idle. Guardian shows None or Can't Tell when there is no standing to read. | | **Drift** | An agent instance running a configuration its certification doesn't name. Wherever a certification is required, the gateway refuses that instance's requests unless another certification names what it runs. | | **Cordoned** | The state of an agent key whose newest request ran a configuration its certification doesn't name. It clears once the key runs a certified configuration again. | ## Integrity and verification | Term | Definition | | :---------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CID** | A CID (Content Identifier) is a unique fingerprint derived from a piece of content. | | **DID** | A DID (Decentralized Identifier) is a unique identifier for a user, organization, or even system, used to sign actions such as declarations and reviews. | | **UUID** | A UUID (Universally Unique Identifier) is a standard identifier used to distinguish records such as projects and evaluations. | | **Governance Manifest** | A machine-readable file (manifest.json), included in a report's .zip, that lists the CIDs and DIDs of every declaration, review, and attachment so the report can be independently verified. | | **Verified** | A record is verified when its cryptographic proof is confirmed intact — its content matches its original CID and its signature traces back to the signer's DID. | | **Certified** | The mark an applied policy carries once it has an active credential: a seal after its name at the top of its Overview, and a badge beside its name in the project's list of applied policies. For an agent's key, the state of one whose newest request ran the configuration its certification names. | | **Lineage Manifest** | A cryptographically verifiable record of how a dataset, model, or other asset is produced. This file can be viewed as a Lineage Graph in Guardian. | ## Related - [Key Concepts](./key-concepts.mdx) — fuller explanations of the core concepts and the actions tied to them - [Integrity Actions](./integrity-actions.mdx) — which actions are signed, permanent, and included in a report - [Indicators](./indicators.mdx) — configure extraction rules, success criteria, and declaration templates - [Reports](./reports.mdx) — what a report's .zip and governance manifest contain - [Lineage Graphs](./lineage-graphs.mdx) — view a lineage manifest as an interactive graph - [Agent Certifications](./agent-certifications.mdx) — what a certification covers, and how drift is enforced