# The Lexicon: Grant, Mandate, Delta, And The Ordering Rule That Comes Before All Of Them

**pack** Grant and Mandate · draft-1 · 26 August 2026
**role** The scoped vocabulary, in the sibling graphs site's format: each term defined by its edges rather than its label, with its source, its inverse where it has one, and the one rule that orders the whole flow.

---

## The ordering rule, stated before any term

Every term below sits inside one sequence, and the sequence is a constraint, not a preference:

```
   REALITY     the agentic environment, as installed and configured
   TWIN        that installation — the thing every fact attaches to
   FACTS       the GRANT (measured, dated, provenance per node)
               the MANDATE (authored, signed, with an interval)
   FINDING     the DELTA (computed, not argued)
   RISKS       derived, at each altitude, in that altitude's language
   DECISIONS   separate nodes: named acceptor, interval
```

A term used out of order breaks the flow. A *risk* named before a *fact* is a guess; a *decision* recorded before a *delta* accepts nothing measurable. The graphs-site discipline applies: a node carries no inherent meaning, and what a term *is* emerges from the edges traceable from it — here, from where it sits in this chain and what it is computed against.

## The terms

### Grant
**What the environment can actually do**, as installed and configured. A tree of capability nodes, each carrying what it reaches, the control standing in the way (or nothing), the tier of that control, an evidence class, and a date. Generated by **measurement**, never authored. Signed by whoever ran the measurement. Carries a *measurement date*, not an interval. `grant` is an **artefact**, not a principal — it gets an identifier, a hash and a signature, never a keypair.
*Inverse edge:* a capability *is-reached-by* a grant node.
*Source:* the environment itself, measured (v0.33.62 permissions brief).

### Mandate
**What the environment is expected to do.** Authored by a person, signed by an **issuer**, naming a **subject**, carrying an **interval** — *without one it is a grant under another name.* Stored as an **allow-list** (the enforceable form); **prohibitions** are a generated rendering of the allow-list's complement, with their own date. `mandate` is an artefact too — issuer-signed, never keyed.
*Source:* a person, authored (the one document nothing in the industry currently provides).

### Delta
**The finding, computed and never stored.** A stored delta is stale the moment either side moves; the interesting property is that it can be recomputed at any time (the same rule that keeps a register entry free of a history array). The delta has two directions:

### Excess authority
`grant − mandate`: what the environment can do that nobody asked for. Blast radius measured from the other end, **unaccepted by construction**, defaulting to critical. The security direction.

### Shortfall
`mandate − grant`: what was asked for that the environment cannot do. The operations direction — the agent fails and it looks like a bug. **It matters as much as excess**, because a mandate the grant cannot satisfy is what produces the next over-broad credential. Harder to detect, because it needs the mandate enumerated against real capability names.

### Blind spots
`library − self-report`: what the environment is *known* to grant that this agent did *not* report. The third term's product, and the argument for the library: it is the only thing that makes a self-report falsifiable, and it measures the agent as much as the environment.

### Tier
The strength of a control, by one test: **a control bounds a grant only when it is enforced by something the grant does not include.**

| Tier | Enforced by | Worth |
|---|---|---|
| **Boundary** | Something *outside* the grant: OS, separate account, container, network policy, a remote service | Real — holds against a compromised agent |
| **Setting** | The tool itself, running *inside* the grant | Bypassable by anything that can run code as that grant |
| **Expectation** | Nothing — it is written in a prompt or a policy file | None; it is a mandate, and a mandate is not a control |

*Note carried from the measurement:* a control that *evaluates in a separate process outside the agent's loop* is a boundary for the agent even when it is configuration for the platform operator — which is why hooks and Cedar are the natural compilation targets, and why a prompt is not.

### Evidence
Per grant node, and the four are not equally trustworthy: `read` (from a settings file) · `observed` (by running a command) · `documented` (stated in docs) · `inferred` · and `none` — a node that could not be evidenced, marked rather than dropped.

### History (the time axis)
Whether the environment retains a record of prior sessions, and over what window. With it retained, the grant is a **union over history** rather than a tree over the present. Changes the meaning of every other node, so it is a top-level field on the grant document.

### Library entry
A measured, dated grant for one environment, published in the **registry**, carrying **no personal data**. Referenced — never copied — by an instance in the **risk product**.

### Self-report
What *this* agent, in *this* session, noticed it has. A floor, not a census. Must be **structured before it is compared**, or the blind-spot delta is a judgement rather than a computation.

### Pack
The shareable output: a list of library references plus a mandate plus the computed deltas. Discloses which products you use and **nothing about your machine** — which is what makes it sendable.

## Why the vocabulary is this precise

The whole product turns on one distinction — *what was decided* versus *what merely exists* — so a term that blurs it (implicit authorisation for the grant; a stored delta that goes stale; a self-report treated as a census) does not just read badly, it reintroduces the confusion the pack exists to remove. The lexicon is the design; the screens are a rendering of it.

---

*CC BY 4.0.*