V0.1

Glossary

This glossary defines the terms used in the semantic draft. The relationship rules and cardinalities are stated in Identity relationships.

Term	Definition	Does not imply
Account	Authentication/access relationship through which a Principal may act.	Ownership or a grant.
Acceptance receipt	Recoverable record that Passport accepted one assertion operation.	Local installation, distributed atomicity, or later authority.
Binding assertion	Time-limited evidence for a particular association/binding ceremony.	A standing grant or proof that state remains current.
Consumer	Registered relying application with its own local references and mapping lifecycle.	Permission to bypass Passport authorization.
ConsumerIdentityRef	Opaque, random, consumer-instance-scoped reference to one bound target.	Passport ID, Root-derived value, or transferable authority token.
Grant	Bounded authority with issuer, grantee, capability, scope, provenance, constraints, lifetime, and state.	Authority outside its complete valid path.
Passport	Private authority and security container, distinct from governed identities.	An identity or consumer-visible identifier.
Principal	Actor evaluated for an operation; not necessarily an identity holder.	Ownership of every related identity.
Resolution result	Evidence that one reference was authorized at one consistency point.	A lease or permission for a later operation.
Root Identity	A governed identity distinct from its Passport. Every Passport has exactly one Root Identity.	Consumer visibility or implicit scope.
Subordinate Identity	Identity governed by a Passport; an active Subordinate has exactly one authoritative Passport at a time.	Authority over Root or sibling identities.

IP-ID-06 — Non-inference. Authentication, Account association, mapping, identifier possession, and resolution output are separate facts. None creates a grant or authority beyond the exact current request. [ADRs 7D, 8A–8G; canonical domain model and integration boundary.]