How to use this index
Each term links to its entry in the elan1 glossary, which expands the definition and says where the term shows up across the platform. The “In the docs” links go to the section of these docs that uses the term in an API or record context.
Definitions here are the same one-sentence definitions as the glossary, word for word. If a docs page and the glossary ever seem to disagree, the glossary is the reference and the docs page is the defect.
Terms A–Z (39)
A
- AI agent governance
The controls that decide what an AI agent may change, who must approve it and what evidence is kept.
- AI audit trail
A linked record of every action an AI system proposed, the rules checked, who approved it and the outcome.
- Allow
Govern's decision that a write may happen. Only elan1 Govern produces one; a model never does.
Glossary entry: AllowIn the docs:Core conceptsThe Right Path
- Assurance level
A level of claim about the evidence (L1, L2, L3), never a product tier.
Glossary entry: Assurance levelIn the docs:Modes and assurance levels
- Autonomy level
How much an agent may do alone, A0 to A5; recorded on every proof record.
Glossary entry: Autonomy levelIn the docs:Rung 6 · autonomy
C
- Conformance
Passing a published test suite before making a claim: K1–K7 for Run components, C1–C14 for third-party agents.
Glossary entry: ConformanceIn the docs:Conformance
- Contract
One of ten versioned `fusion.*/v1` capability contracts in elan1 Run, each with two licence-clean implementations.
Glossary entry: ContractIn the docs:fusion.*/v1 contracts
D
- Declaration
A process's rules in seven blocks: what may change, under which gates, who approves. Versioned.
Glossary entry: DeclarationIn the docs:DeclarationsQuickstart · declare the rules
- Design partner
An early-adopter organisation that puts one real process on the governed path with us and shapes what comes next. Ten places.
Glossary entry: Design partnerIn the docs:Quickstart
F
- Fail toward a human
When anything is unclear or unavailable, elan1 stops and asks a person.
Glossary entry: Fail toward a humanIn the docs:Failure behaviour
G
- Gate
A check a write must pass. Pre-gates G1–G9 run at rung 3; six can never be skipped.
Glossary entry: GateIn the docs:Pre-gates G1–G9
- Governed action
One consequential write that passed the Right Path and was committed; Govern's meter unit.
Glossary entry: Governed actionIn the docs:The meter
- Governed write path
The one route through which every AI agent change to a system of record must pass. The route is checked, approved and recorded.
- Guardian agent
Gartner's term for software that inspects agent actions and allows, blocks or holds them for a person.
H
- Hash chain
Records where each one carries the digest of the one before, so altering one breaks every later link.
- Human-in-the-loop approval
A named person decides before a consequential change is made, with enough context to say no.
K
- Kernel
elan1 Govern's core: one write function behind KernelPort. No other product builds gates, approvals, proof or a meter.
Glossary entry: KernelIn the docs:Two seams
- KernelPort
The only door into the kernel: define, assert, seal, verify, scope, refuse.
Glossary entry: KernelPortIn the docs:KernelPort v1
L
- L1 Guarded
Records hash-chained so any change is evident to you. Available.
Glossary entry: L1 GuardedIn the docs:LevelsProof record
- L2 Attested
Adds signatures, outside timestamps and a free offline verifier. Available.
Glossary entry: L2 AttestedIn the docs:Levels
- L3 Proven
Evidence that survives the vendor. Starts when an outside auditor accepts an L2 bundle in writing; no date.
Glossary entry: L3 ProvenIn the docs:Levels
- Line
A module of elan1 Work for one kind of work (ERP, Revenue, Voice, Commerce). Every line writes through elan1 Govern.
Glossary entry: LineIn the docs:Four layers
M
- Maker-checker
One party prepares a change and a different, named party approves it. For AI, the model is the maker.
- MCA audit trail (edit log)
India's rule that a company's accounting software must keep an edit log of every change. The log cannot be disabled.
- Meter
The one unit each layer charges for: credit, decision, governed action, node-year.
Glossary entry: MeterIn the docs:The meter
- Mode A (Enforced)
elan1 in-process, holding the write credential. No write reaches the system of record without a gate decision and a proof record.
Glossary entry: Mode A (Enforced)In the docs:Mode A
- Mode B (Attested advisory)
elan1 over MCP or HTTP, without the credential. Every write intent is evaluated and recorded.
Glossary entry: Mode B (Attested advisory)In the docs:Mode BMCP serverHTTP API
- Module
A named part of one platform, always shown with its platform at first mention (elan1 Decide Router, then Router). Never a separate product or brand; each has a detail page under its platform. Work's modules are called lines; L1, L2 and L3 are levels of a claim, not modules.
Glossary entry: ModuleIn the docs:Four layers
P
- Pack
Configuration of Govern for a rule set — ledger1 (MCA), invoice1 (GST), collect1 (RBI). Never code, never a brand.
Glossary entry: PackIn the docs:Declarations
- Plane
One of nine architecture levels, P0 residency to P8 packs; the kernel is P3.
Glossary entry: PlaneIn the docs:Two seams
- Proof record
The 16-field record written for every action, allowed or refused; SHA-256, chained. "No seventeenth field, ever."
Glossary entry: Proof recordIn the docs:Proof record
R
- Refusal
A typed "no" from any rung. It still writes a proof record and costs 40% of one governed action.
Glossary entry: RefusalIn the docs:Errors and refusals
- Residency domain
A region with its own database and signing key. Today there is one: "in" (Mumbai).
Glossary entry: Residency domainIn the docs:Tenancy and residency
- Right Path
The fixed route every write takes, from rung 0b STOP to rung 9 METERED.
Glossary entry: Right PathIn the docs:The Right Path
- Rung
One step on the Right Path: stop, identity, write door, pre-gates, evaluate, guardrail, autonomy, act, proof, metered.
Glossary entry: RungIn the docs:All ten rungs
S
- Seal
The method that turns a proof record into its digest: Seal v6, frozen.
Glossary entry: SealIn the docs:Proof recordKernelPort · seal
- Single writer
Only one component writes to the system of record, with a 10-minute single-use credential.
Glossary entry: Single writerIn the docs:Rung 7 · act
T
- Tamper-evident
A record where any later change can be detected. It does not claim that a change is impossible.
W
- Write intent
A typed proposal to change a record. Agents and Decide may produce one; only Govern turns it into an allow.
Glossary entry: Write intentIn the docs:KernelPort · assertQuickstart · assert
API identifiers
Field names, headers, outcomes and suite names that appear in the API and on the record. Field names and response shapes are fixed in KernelPort v1, as are the 16 record fields and Seal v6.
write_idField · F04Your identifier for one write intent. Sent again as the Idempotency-Key; replaying it returns the original outcome, never a second write.
In the docs:HTTP API
Idempotency-KeyHTTP headerCarries the write_id on writes, so a retried request after a timeout cannot write twice.
In the docs:HTTP API
prev_digestField · F03The digest of the record before this one in the tenant's chain. It is what links the chain.
In the docs:Proof record
seqField · F02A record's position in its tenant's chain. It only ever goes up by one, so a gap shows.
In the docs:Proof record
outcomeResponse fieldOne of committed, refused or escalated. Every outcome writes a proof record.
In the docs:Quickstart
escalatedOutcomeThe write is above the actor's autonomy ceiling and waits for a named approver who is not the asker. Expiry is a refusal.
In the docs:The Right Path
obligationResponse fieldThe identifier of the approval an escalated write is waiting on.
In the docs:The Right Path
evaluate()Rung 4Applies versioned policy rules and returns allow, refuse or escalate. Never a score, never a model.
In the docs:The Right Path
blast radiusRung 5How many records, which ledgers and what value a write may touch, as declared per write type.
In the docs:The Right Path
act · ro · ctlToken scopesSend write intents and read outcomes; read-only access; control-plane operations. A ctl token cannot read any record.
In the docs:HTTP API
read · stage · actMCP tool classesThe three classes of the 34 MCP tools: 18 read, 10 stage, 6 act.
In the docs:MCP server
X-Fusion-ContractHTTP headerNames the fusion.*/v1 contract a call is made under, never the vendor behind it.
In the docs:fusion.*/v1 contracts
K1–K7Conformance suiteBlocking-green tests every elan1 Run component passes before it replaces the one in service. Runs offline.
In the docs:Conformance
C1–C14Conformance suiteTests a third-party agent passes before it may claim to run on elan1 Govern.
In the docs:Conformance
elan1-verifyTool · from L2The free offline verifier for evidence bundles, on your own machine, without us.
In the docs:Proof record
Frozen names
Three identifiers are frozen. A change ships under a new identifier, never by editing the old one, so code may depend on them by name.
| Identifier | What it names |
|---|---|
| kernelport/v1 | The interface into elan1 Govern: six calls. |
| elan1.proof.seal.v6 | The method that turns a 16-field record into its digest. |
| action-receipt/1 | The Action Receipt specification. Publishing it, so others can implement it, is a requirement for L3. |
Product names are fixed too: elan1, elan1 Govern, elan1 Work, elan1 Decide, elan1 Run and elan1 Work for small firms. Modules are always written with their platform at first mention, such as elan1 Decide Router, then Router.