Glossary
Definitions of terms you’ll encounter across Governance Studio.
Structure
Section titled “Structure”Organization
- Definition: The top-level account in Governance Studio. All projects, members, and policies belong to an organization.
Project
- Definition: A distinct scope of work — a product, initiative, system, or agent — that your team wants to bring into compliance.
Policy
- Definition: A structured set of compliance requirements. Policies may represent regulations, RMFs, or internal SOPs.
Applied policy
- Definition: A policy that has been applied to a project, activating the policy’s controls and enabling your team to start tracking compliance.
Policy Library
- Definition: The collection of all policies available to apply to your project. The Policy Library is scoped to your organization.
Control
- Definition: A discrete mandate within a policy.
Compliance workflow
Section titled “Compliance workflow”Declaration
- Definition: A statement describing how a control has been implemented.
Review
- Definition: A statement describing whether a control’s implementation is satisfactory.
Attachment
- Definition: A file submitted to support a declaration or review.
Control status
- Definition: A snapshot of a control’s current state. A control’s status updates based on the last action taken on that control.
Credential
- Definition: An attestation that a project has met a specific policy.
Report
- Definition: A point-in-time record of a project’s compliance status toward a specific policy.
Integrity action
- Definition: An action that is cryptographically signed and hashed at the moment you take it, making it permanent.
Indicators
Section titled “Indicators”Indicator
- Definition: An automated evaluation that determines whether a system, environment, or function matches machine-readable criteria you define.
Event
- Definition: Data your systems send to an indicator’s ingestion endpoint to be evaluated.
Ingestion endpoint
- Definition: The endpoint an indicator connects to.
Extraction Rule
- Definition: A rule that tells the indicator where to look in an event (using a JSONPath) and what value to expect there (using Success Criteria).
JSONPath
- Definition: An expression used to select a value from incoming event data.
Success Criteria
- Definition: The conditions that determine whether an evaluation results in Success or Failure.
Evaluation status
- Definition: The result of an indicator’s most recent evaluation (or lack thereof): Awaiting Evaluation, Success, Failure, or Evaluation Error.
Declaration Template
- Definition: The template used to define the declaration an indicator submits to the controls it’s applied to when an evaluation results in Failure.
Integrity and verification
Section titled “Integrity and verification”CID
- Definition: A CID (Content Identifier) is a unique fingerprint derived from a piece of content.
DID
- Definition: A DID (Decentralized Identifier) is a unique identifier for a user, organization, or even system, used to sign actions such as declarations and reviews.
UUID
- Definition: A UUID (Universally Unique Identifier) is a standard identifier used to distinguish records such as projects and evaluations.
Governance Manifest
- Definition: A machine-readable file (manifest.json), included in a report’s .zip, that lists the CIDs and DIDs of every declaration, review, and attachment so the report can be independently verified.
Verified
- Definition: A record is verified when its cryptographic proof is confirmed intact — its content matches its original CID and its signature traces back to the signer’s DID.
Certified
- Definition: The status a project displays once it has an active credential for a policy.
Lineage Manifest
- Definition: A cryptographically verifiable record of how a dataset, model, or other asset is produced. This file can be viewed as a Lineage Graph in Governance Studio.