Skip to main content

Governance Kernel Glossary

1. Purpose​

This glossary defines key terms used across the UPOS Governance Kernel documentation.

The Governance Kernel is the computational governance core of UPOS. It evaluates, records, explains, and emits authoritative governance state for products, actors, intents, policies, entitlements, trust, risk, evidence, Digital Product Passports, relationships, lifecycle events, and runtime usage across the ProductVerse.

This glossary is intended to keep terminology consistent across:

  • governance-kernel-overview.md
  • governance-kernel-architecture.md
  • governance-kernel-decision-model.md
  • governance-kernel-policy-model.md
  • governance-kernel-trust-model.md
  • governance-kernel-entitlement-model.md
  • governance-kernel-evidence-model.md
  • governance-kernel-risk-model.md
  • governance-kernel-dpp-integration.md
  • governance-kernel-signals.md
  • governance-kernel-interfaces.md
  • governance-kernel-relationship-to-pvep.md
  • governance-kernel-relationship-to-pdep.md

2. Core Governance Kernel Terms​

Governance Kernel​

The UPOS computational governance core that evaluates, records, explains, and emits authoritative governance state across the ProductVerse.

It evaluates policy, entitlement, trust, risk, evidence, DPP, lifecycle, relationship, and runtime context.

The Governance Kernel is not a UI, committee, static policy document, or marketplace badge system.

In short:

Governance Kernel = computational decision and assurance core

Governance State​

The authoritative condition of a product, actor, action, relationship, lifecycle event, entitlement, policy, risk, trust signal, evidence record, DPP, or runtime interaction with respect to governance.

Examples include:

  • access allowed,
  • access denied,
  • DPP valid,
  • evidence expired,
  • trust downgraded,
  • risk tier changed,
  • publication blocked,
  • external sharing prohibited,
  • entitlement revoked.

Governance Decision​

An authoritative outcome emitted by the Governance Kernel after evaluating a product-related action, actor, intent, relationship, lifecycle event, or runtime interaction against applicable policies, entitlements, risk, trust, evidence, DPP, and contextual constraints.

Example decision outcomes include:

  • allow,
  • deny,
  • conditional allow,
  • approval required,
  • exception required,
  • escalation required,
  • pending,
  • insufficient context.

Governance Signal​

A structured event, notification, state change, alert, decision emission, or assurance update that communicates a governance-relevant condition across UPOS.

Examples:

  • DPP_EXPIRED
  • ENTITLEMENT_REVOKED
  • RISK_TIER_CHANGED
  • EVIDENCE_MISSING
  • POLICY_VIOLATION_DETECTED
  • LIFECYCLE_GATE_FAILED

Governance signals keep the ProductVerse synchronized with current governance reality.

Governance Interface​

A structured interaction boundary through which a UPOS component, product, actor, agent, registry, runtime, marketplace, or experience plane submits governance context to the Governance Kernel or receives governance state from it.

Examples include:

  • decision interface,
  • policy interface,
  • entitlement interface,
  • trust interface,
  • evidence interface,
  • risk interface,
  • DPP interface,
  • lifecycle gate interface,
  • signal interface,
  • audit interface.

Governance Context​

The set of contextual facts needed to evaluate a governance question.

Governance context may include:

  • subject,
  • action,
  • product,
  • product kind,
  • product version,
  • output port,
  • purpose,
  • environment,
  • jurisdiction,
  • entitlement,
  • policy,
  • trust state,
  • risk state,
  • evidence state,
  • DPP state,
  • lifecycle state,
  • relationship context,
  • time.

A governance decision without sufficient context is weak or incomplete.

Context Resolution​

The process by which the Governance Kernel enriches a decision request with product metadata, actor context, policies, entitlements, trust evidence, risk posture, DPP state, relationships, lifecycle state, and runtime conditions.

Example:

Input:
User requests Product A.

Resolved context:
User belongs to Team X.
Product A is a Data Product.
Purpose is internal analytics.
Output port is SQL.
EU privacy policy applies.
DPP is valid.
Entitlement expires in 30 days.

Assurance​

The process of establishing, validating, recording, and communicating whether a product, actor, relationship, lifecycle state, or governance claim is trustworthy, compliant, evidence-backed, and fit for purpose.

Assurance is broader than a single access decision. It concerns confidence, evidence, traceability, and accountability.

Decisioning​

The process of evaluating whether an action, usage, relationship, entitlement, lifecycle transition, runtime invocation, or product state is allowed, denied, conditional, pending, or requires approval, exception, or escalation.

Audit Record​

A durable record of a governance decision, signal, evidence evaluation, policy evaluation, entitlement decision, DPP check, risk evaluation, lifecycle gate, or exception.

An audit record may contain:

  • actor,
  • action,
  • product,
  • purpose,
  • policies evaluated,
  • evidence referenced,
  • decision outcome,
  • constraints,
  • obligations,
  • timestamp,
  • evaluator,
  • policy version,
  • product version,
  • DPP version.

Auditability​

The ability to inspect, trace, explain, and verify governance decisions and state changes after the fact.

A core Governance Kernel principle is:

A material governance decision that cannot be audited is not trustworthy governance.

Explanation​

A human- or machine-readable rationale for a governance decision or state.

Explanations may be tailored for:

  • consumers,
  • stewards,
  • auditors,
  • developers,
  • governance actors,
  • agents,
  • runtime systems.

Reason Code​

A structured machine-readable code explaining why a governance decision or state was emitted.

Examples:

  • ENTITLEMENT_EXPIRED
  • POLICY_PROHIBITS_EXTERNAL_SHARING
  • DPP_VERSION_MISMATCH
  • EVIDENCE_MISSING
  • RISK_TIER_REQUIRES_REVIEW

Reason codes help agents, systems, and UIs respond consistently.

Constraint​

A restriction that limits what may be done.

Examples:

  • no external sharing,
  • no export,
  • masked access only,
  • read-only access,
  • use only in approved environment,
  • use only with human review,
  • use only until expiry date.

Obligation​

A required action or duty that must be fulfilled.

Examples:

  • audit logging required,
  • DPP summary must be displayed,
  • evidence must be retained,
  • attribution required,
  • steward must be notified,
  • post-event review required.

A constraint limits action. An obligation requires action.

Exception​

A governed deviation from normal policy, entitlement, risk, evidence, trust, or lifecycle requirements.

An exception should be:

  • explicit,
  • scoped,
  • time-bound,
  • authority-approved,
  • evidence-backed,
  • auditable,
  • revocable.

An exception does not erase policy. It records an accountable deviation from policy.

Override​

An explicit authority-backed decision that permits a normally blocked, restricted, or escalated action under defined conditions.

Overrides are especially important for high-risk or emergency situations.

An override should be auditable, time-bound, scoped, and supported by rationale.

Escalation​

The routing of a governance decision or condition to a higher authority, review body, steward, risk function, governance actor, or institutional agent.

Escalation may be required due to:

  • high risk,
  • insufficient authority,
  • unresolved evidence gap,
  • critical product impact,
  • policy conflict,
  • safety concern,
  • emergency condition.

Lifecycle Gate​

A governance checkpoint applied to a product lifecycle transition.

Examples:

  • authoring gate,
  • composition gate,
  • evidence gate,
  • DPP gate,
  • output port gate,
  • publication gate,
  • marketplace listing gate,
  • promotion gate,
  • retirement gate.

Lifecycle gates are commonly used by PDEP.

3. Policy Terms​

Policy​

A governed rule-bearing artifact that defines permissions, prohibitions, obligations, constraints, conditions, controls, or decision criteria for products, actors, purposes, relationships, output ports, lifecycle events, environments, or jurisdictions.

Policies may be human-readable, machine-readable, or both.

Computable Policy​

A policy represented in a form that can be evaluated by systems.

Computable policies enable the Governance Kernel to perform consistent decisioning rather than relying on manual interpretation.

Policy Scope​

The set of products, actors, purposes, actions, environments, jurisdictions, product kinds, output ports, relationships, or lifecycle events to which a policy applies.

Example:

This policy applies to AI Products used for automated decisioning in production.

Policy Authority​

The source of authority for a policy.

Authority may come from:

  • law,
  • regulation,
  • contract,
  • institutional governance body,
  • product owner,
  • domain steward,
  • risk function,
  • compliance function,
  • marketplace operator,
  • delegated authority.

Policy Applicability​

The determination of whether a policy applies to a particular governance context.

A policy may be:

  • applicable,
  • not applicable,
  • conditionally applicable,
  • superseded,
  • conflicting,
  • insufficiently contextualized.

Policy Conflict​

A situation where multiple applicable policies produce incompatible or competing outcomes.

Example:

Domain policy allows export.
Jurisdiction policy prohibits export.

Conflict resolution should be explicit and versioned.

Policy Combining Rule​

A rule that defines how multiple applicable policies are combined.

Common examples:

  • deny overrides,
  • prohibition overrides allow,
  • higher authority overrides lower authority,
  • more specific policy overrides general policy,
  • stricter constraint wins,
  • valid exception may override standard denial within scope.

Policy Violation​

A detected action, state, relationship, or lifecycle event that breaches an applicable policy.

Example:

External export attempted where external sharing is prohibited.

Policy Exception​

A governed, explicit, time-bound deviation from an applicable policy.

Policy exceptions should not be informal workarounds.

4. Entitlement Terms​

Entitlement​

A governed right, permission, grant, subscription, license, approval, mandate, or delegated authority that allows a subject to perform a defined action on a product, output port, product relationship, or lifecycle event within a defined context.

Entitlement answers:

Does this subject have a valid right to act?

Entitlement State​

The current standing of an entitlement.

Examples:

  • granted,
  • denied,
  • pending,
  • provisioned,
  • conditional,
  • suspended,
  • revoked,
  • expired,
  • delegated,
  • inherited,
  • exception-based.

Entitlement Subject​

The entity that holds or requests an entitlement.

Examples:

  • human user,
  • team,
  • organization,
  • application,
  • machine agent,
  • AI agent,
  • institutional agent,
  • product-as-consumer,
  • marketplace account.

Entitlement Object​

The object to which entitlement applies.

Examples:

  • product,
  • product version,
  • output port,
  • product capability,
  • product relationship,
  • product bundle,
  • marketplace listing,
  • DPP,
  • evidence record,
  • lifecycle action.

Entitlement Action​

The action permitted by an entitlement.

Examples:

  • view,
  • use,
  • invoke,
  • query,
  • download,
  • export,
  • share,
  • compose,
  • derive,
  • train,
  • publish,
  • approve,
  • retire,
  • delegate.

Delegated Authority​

Authority granted by one subject to another subject to act on its behalf within a defined scope.

Delegated authority should be explicit, scoped, time-bound, revocable, and auditable.

Delegator​

The subject that grants authority to another subject.

Example:

Organization A delegates procurement recommendation authority to Agent B.

Delegate​

The subject receiving delegated authority.

A delegate may be a human, application, machine agent, AI agent, institutional agent, or product.

Inherited Entitlement​

An entitlement derived from another relationship, such as role membership, team membership, organization contract, marketplace plan, bundle entitlement, or product-to-product relationship.

Inherited entitlements should be explainable and bounded by policy.

Product-to-Product Entitlement​

An entitlement allowing one product to consume, invoke, derive from, compose with, or otherwise use another product.

This is essential in recursive product economies.

Output-Port-Level Entitlement​

An entitlement scoped to a specific product output port.

Example:

User may view dashboard output port but may not access SQL output port.

5. Trust Terms​

Trust​

Evidence-backed confidence that a product, actor, relationship, output port, lifecycle state, or governance claim is fit for a specified purpose under a specified context.

Trust answers:

Can this object be relied upon for this purpose in this context?

Trust State​

A structured representation of trust posture, evidence, purpose, context, constraints, and rationale.

Trust state is more authoritative than a simple trust score or badge.

Trust Posture​

The evaluated trust condition of a product or object in a specified context.

Examples:

  • trusted,
  • conditionally trusted,
  • untrusted,
  • trust unknown,
  • evidence incomplete,
  • evidence expired,
  • trusted for internal use only,
  • not trusted for automated use.

Trust Signal​

A consumer- or system-usable representation of trust state.

Examples:

  • DPP valid,
  • evidence current,
  • lineage incomplete,
  • trust downgraded,
  • trusted for internal analytics,
  • not trusted for external sharing.

Trust Claim​

An assertion about a product or object that requires evidence.

Examples:

  • product is production-ready,
  • product is approved for regulatory reporting,
  • product has complete lineage,
  • product passed safety certification,
  • product has valid redistribution rights.

Trust Score​

A summarized numeric or categorical indicator of trust.

Examples:

  • high,
  • medium,
  • low,
  • 92/100,
  • green,
  • amber,
  • red.

A trust score may be useful for communication, but structured trust state should remain authoritative.

Evidence-Backed Trust​

Trust state derived from evidence rather than reputation, manual badges, or unsupported assertions.

A core principle is:

Trust without evidence is only a claim.

Trust Propagation​

The way trust may be inherited, transformed, degraded, revalidated, or constrained across product relationships, chains, flows, or compositions.

Trust propagation should not be naive. A trusted input does not automatically create a trusted output.

Trust Downgrade​

A change in trust state to a weaker posture.

Example causes:

  • evidence expired,
  • incident detected,
  • DPP invalidated,
  • quality degraded,
  • certification expired,
  • risk tier increased.

Trust Upgrade​

A change in trust state to a stronger posture.

Example causes:

  • evidence refreshed,
  • DPP completed,
  • certification issued,
  • quality improved,
  • risk mitigated,
  • audit completed.

6. Evidence Terms​

Evidence​

A governed artifact, record, signal, observation, attestation, measurement, test result, certification, audit finding, provenance record, or documented proof that supports, challenges, qualifies, or invalidates a product-related claim, governance decision, trust signal, risk state, entitlement, lifecycle event, or policy obligation.

Evidence Record​

A structured record that describes evidence and its relationship to a claim, product, version, purpose, authority, validity period, provenance, visibility, and audit trail.

Evidence State​

The evaluated condition of evidence.

Examples:

  • present,
  • missing,
  • sufficient,
  • insufficient,
  • current,
  • expired,
  • active,
  • accepted,
  • rejected,
  • disputed,
  • invalidated,
  • superseded,
  • restricted.

Evidence Sufficiency​

The determination of whether available evidence is enough to satisfy a governance requirement for a given context.

Evidence sufficiency depends on product kind, purpose, risk, policy, lifecycle stage, and jurisdiction.

Evidence Gap​

A condition where required evidence is missing, insufficient, expired, invalid, disputed, or not applicable to the requested context.

Evidence gaps may block publication, trust, entitlement, product composition, or runtime use.

Claim-Evidence Binding​

An explicit relationship between a claim and the evidence that supports it.

Example:

Claim C
  supported by
Evidence E

Evidence Freshness​

The degree to which evidence remains current enough for a given purpose or governance decision.

Evidence may become stale even if it still exists.

Evidence Provenance​

Information about the origin, custody, generation process, authority, modification history, and approval path of evidence.

Evidence without provenance has weaker assurance value.

Evidence Visibility​

The set of rules defining who or what may view an evidence record, evidence summary, evidence detail, or machine-readable evidence representation.

Evidence visibility may differ for consumers, stewards, auditors, regulators, agents, and public viewers.

7. Risk Terms​

Risk​

The contextual possibility of harm, loss, failure, misuse, uncertainty, exposure, non-compliance, unsafe behavior, degraded trust, or negative impact arising from a product, actor, agent, purpose, output port, relationship, lifecycle event, chain, flow, or ecosystem condition.

Risk State​

A structured representation of risk category, tier, evidence, rationale, controls, constraints, owner, review status, treatment, and decision implications.

Risk Tier​

A categorical representation of risk severity, governance burden, and required controls.

Example generic tiers:

  • R0 — Minimal Risk
  • R1 — Low Risk
  • R2 — Moderate Risk
  • R3 — High Risk
  • R4 — Critical / Prohibited by Default

Risk Score​

A summarized numeric or categorical indicator of risk.

A risk score may be useful for communication, but structured risk state should remain authoritative.

Inherent Risk​

Risk before controls, mitigations, evidence, or restrictions are applied.

Residual Risk​

Risk remaining after controls, mitigations, restrictions, or evidence are considered.

Risk Treatment​

The action taken in response to risk.

Examples:

  • avoid,
  • mitigate,
  • transfer,
  • accept,
  • monitor,
  • escalate,
  • restrict,
  • suspend,
  • retire.

Risk Propagation​

The way risk moves, amplifies, decreases, transforms, or transfers through product relationships, product chains, product flows, or compositions.

Risk Override​

An explicit authority-backed decision that accepts or permits risk that would normally block or restrict an action.

Risk overrides should be scoped, time-bound, evidence-backed, and auditable.

High-Risk Use​

A use context in which product behavior, output, access, or decisioning may create significant safety, legal, regulatory, financial, operational, ethical, or human impact.

Critical Risk​

A risk level that is prohibited by default unless an explicit override or emergency authority exists.

In many UPOS-aligned models, this corresponds to R4.

8. DPP Terms​

Digital Product Passport​

A structured, product-bound trust artifact that describes a product’s identity, claims, provenance, evidence, assurance state, governance context, and usage conditions.

Abbreviation: DPP

DPP State​

The evaluated condition of a Digital Product Passport.

Examples:

  • draft,
  • valid,
  • conditionally valid,
  • incomplete,
  • expired,
  • revoked,
  • superseded,
  • version mismatch,
  • evidence missing,
  • claim unsupported.

DPP Summary​

A concise consumer- or marketplace-facing representation of DPP state.

A DPP summary may show trust posture, risk posture, permitted uses, evidence state, and lifecycle status without exposing restricted details.

DPP Detail​

A richer DPP view for authorized users, stewards, auditors, regulators, or agents.

DPP detail may include evidence references, claim-evidence bindings, provenance, policy context, and audit information.

DPP Claim​

An assertion made within a DPP about the product.

Examples:

  • product is approved for internal use,
  • product has complete lineage,
  • product is safety-certified,
  • product has valid rights evidence,
  • product is suitable for marketplace listing.

DPP Validity​

The determination that a DPP is complete, current, product-version-aligned, evidence-backed, and suitable for a specified context.

A DPP may be valid for one purpose but not another.

DPP Version Alignment​

The condition that a DPP correctly applies to the product version being evaluated.

A DPP for Product P version 1.0 may not apply to Product P version 2.0.

DPP Suitability​

The determination that a DPP is fit for a specific use, such as internal discovery, marketplace listing, external sharing, high-risk use, or product composition.

9. Actor and Agent Terms​

Actor​

Any human, organization, system, application, agent, product, or institution that participates in ProductVerse activity.

Subject​

The actor or entity being evaluated in a governance decision.

Examples:

  • human user,
  • application,
  • AI agent,
  • institutional agent,
  • product-as-consumer,
  • organization.

Agent​

An entity capable of acting on behalf of itself or another subject within a defined context.

Agents may be human, software-based, machine-based, AI-based, institutional, or product-associated.

Agentic​

Pertaining to agents or agency.

In UPOS, agentic does not mean AI by default.

Agentic behavior may be displayed by:

  • human agents,
  • machine agents,
  • AI agents,
  • institutional agents,
  • software agents,
  • organizational agents,
  • products-as-consumers.

Machine Agent​

A non-human agent that performs actions through software, automation, workflow logic, rules, or deterministic execution.

A machine agent may or may not use AI.

AI Agent​

A machine agent that uses AI capabilities for reasoning, planning, generation, tool use, or adaptive behavior.

AI agents are one subclass of agentic actors.

Institutional Agent​

An agent that acts with recognized delegated authority from an institution, organization, governance body, or formal mandate.

Institutional agents require strong entitlement, authority, supervision, and audit controls.

Product-as-Consumer​

A product that consumes, invokes, derives from, composes with, or depends on another product.

Examples:

  • AI Product consumes Data Product,
  • Dashboard Product consumes Analytics Product,
  • Comic Product consumes Image Asset Product,
  • Evidence Product consumes Policy Product.

Delegation​

The act of granting authority from one subject to another subject.

Delegation should be explicit, scoped, time-bound, revocable, and auditable.

Supervisor​

A human, organizational, or institutional actor responsible for overseeing an agent or delegated authority.

10. Product and Relationship Terms​

Product​

A productized entity that can be described, discovered, trusted, governed, consumed, exchanged, reused, composed, or evolved.

Products may be physical, digital, data, AI, creative, governance, evidence, infrastructure, agentic, or hybrid.

Product Kind​

The category or class of product.

Examples:

  • Data Product,
  • AI Product,
  • Software Product,
  • Physical Product,
  • Creative Product,
  • Evidence Product,
  • Governance Product,
  • Infrastructure Product,
  • Agent Product.

Product Version​

A specific version of a product. Governance decisions, DPPs, evidence, trust, and risk state should be product-version-aware.

Output Port​

A product’s exposed consumption interface.

Examples:

  • API,
  • SQL endpoint,
  • dashboard,
  • file download,
  • event stream,
  • model endpoint,
  • reader,
  • physical interface,
  • tool interface.

Output ports often have different entitlement, risk, policy, and enforcement requirements.

Product Relationship​

A typed relationship between products or between products and other ProductVerse objects.

Examples:

  • consumes,
  • depends on,
  • composed from,
  • substitute for,
  • complements,
  • governed by,
  • evidenced by,
  • listed in,
  • entitled to use,
  • exposes,
  • derived from.

Relationship Governance​

Governance evaluation applied to product relationships.

Examples:

  • may Product A consume Product B?
  • may Product C be composed from Product D?
  • does Product E inherit restrictions from Product F?
  • does Product G increase risk for Product H?

Inherited Restriction​

A constraint, policy, license term, or obligation that propagates from one product to another through composition, dependency, lineage, or product-to-product use.

Product Composition​

The creation of a product from one or more source products, components, inputs, or dependencies.

Product composition belongs to PDEP, while the Governance Kernel evaluates whether composition is permitted.

Product Chain​

An ordered sequence of products connected by dependency, transformation, production, consumption, supply, or value-creation relationships.

Product Flow​

The dynamic movement of value, data, materials, energy, decisions, rights, trust evidence, signals, control, or feedback through products over time.

Product Graph​

The formal node-edge representation of products and their typed relationships.

The Product Graph may expose governance-aware edges such as policy, entitlement, trust, risk, evidence, and DPP relationships.

Product Fabric​

The interoperability, governance, trust, identity, registry, policy, and integration substrate that allows independently produced products to work together safely and coherently.

The Product Fabric enforces Governance Kernel decisions at runtime and across interoperability mechanisms.

ProductVerse​

The total universe of productized entities, actors, relationships, markets, experiences, governance structures, trust artifacts, dependencies, and value-creation patterns.

11. Lifecycle Terms​

Product Lifecycle​

The sequence of states and transitions through which a product moves.

Examples:

  • draft,
  • validated,
  • published,
  • listed,
  • active,
  • deprecated,
  • retired,
  • archived.

Lifecycle State​

The current state of a product, DPP, policy, evidence record, entitlement, or other governed artifact.

Lifecycle Transition​

A movement from one lifecycle state to another.

Examples:

  • draft to validated,
  • validated to published,
  • active to deprecated,
  • deprecated to retired.

Publication​

The act of making a product available as a governed product through a registry, marketplace, catalog, output port, or ProductVerse surface.

Marketplace Listing​

A marketplace-facing representation of a product that supports discovery, evaluation, acquisition, licensing, subscription, or access.

Deprecation​

The lifecycle state indicating that a product is still available but is being phased out or replaced.

Retirement​

The lifecycle state indicating that a product is no longer active for normal use.

Retirement should consider downstream dependencies, entitlements, retention obligations, and audit requirements.

Recertification​

A lifecycle activity that renews or revalidates product trust, risk, evidence, DPP, policy, or compliance state.

12. Plane Relationship Terms​

PVEP​

The ProductVerse Experience Plane.

PVEP is the consumer-oriented experience plane through which humans, organizations, applications, agents, and products-as-consumers discover, evaluate, acquire, consume, navigate, trust, and select products across the ProductVerse.

PVEP renders Governance Kernel state.

PDEP​

The Product Development and Execution Plane.

PDEP is the UPOS plane responsible for product authoring, composition, validation, lifecycle control, versioning, publication, deployment preparation, and product evolution.

PDEP applies Governance Kernel decisions during product creation and lifecycle control.

Governance & Trust Experience Zone​

A PVEP zone dedicated to rendering trust, policy, entitlement, risk, evidence, DPP, lifecycle, and assurance state in consumer- and agent-usable form.

Portfolio & Entitlement Experience Zone​

A PVEP zone that presents products, access rights, subscriptions, licenses, delegated authority, and entitlement status for a consumer, team, agent, organization, or product-as-consumer.

Product Select & Assembly Zone​

A PVEP zone where consumers select products, compare suitability, understand constraints, and prepare candidate product sets.

It does not build governed products. If creation intent emerges, the flow transitions to PDEP.

Product Graph Navigation Zone​

A PVEP zone that enables contextual exploration of product relationships and ProductVerse projections.

It may render governance-aware graph overlays such as trust, policy, entitlement, risk, evidence, and DPP relationships.

Marketplace Experience Zone​

A PVEP zone for product discovery, evaluation, acquisition, onboarding, pricing, licensing, subscription, access request, and product listing experiences.

Consumption Experience Zone​

A PVEP zone through which consumers use or interact with product output ports, views, APIs, dashboards, readers, model endpoints, streams, or other consumption interfaces.

Concierge & Agent-Mediated Discovery Zone​

A PVEP zone where human or machine agents help consumers discover, compare, filter, and recommend products based on intent, context, policy, entitlement, trust, and risk.

13. Enforcement and Runtime Terms​

Runtime Enforcement​

The operational enforcement of Governance Kernel decisions by Product Fabric, runtime services, identity services, entitlement systems, API gateways, data filters, agent runtimes, or other enforcement components.

Examples:

  • block access,
  • apply masking,
  • enforce row-level filtering,
  • disable export,
  • require audit logging,
  • block agent tool invocation.

Enforcement Point​

A technical or procedural location where a governance decision is enforced.

Examples:

  • API gateway,
  • data access layer,
  • identity provider,
  • entitlement service,
  • model endpoint,
  • product runtime,
  • agent runtime,
  • marketplace checkout,
  • output port adapter.

Advisory Signal​

A governance signal that informs or recommends action but does not by itself block usage.

Blocking Signal​

A governance signal that requires an action to stop, be prevented, or be remediated before proceeding.

Runtime Violation​

A detected runtime action that breaches policy, entitlement, risk, trust, evidence, DPP, or usage constraints.

Example:

Attempted export of a product output where export is prohibited.

14. Observability Terms​

Governance Observability​

The ability to monitor, measure, inspect, and improve governance behavior across decisions, signals, policies, entitlements, trust, risk, evidence, DPP, lifecycle gates, and runtime enforcement.

Decision Latency​

The time required for the Governance Kernel to evaluate and emit a governance decision.

Decision Quality​

The quality of governance decisions as measured by completeness, correctness, explainability, auditability, reversals, appeals, false denials, false allows, and enforcement success.

Signal Delivery​

The successful routing and consumption of Governance Kernel signals by relevant UPOS components.

Governance Drift​

A condition in which actual product usage, entitlement, trust, risk, policy, evidence, or lifecycle state diverges from intended governance state.

Entitlement Drift​

A condition in which entitlement state becomes broader, older, or less controlled than intended.

Examples:

  • unused access persists,
  • expired role grants remain active,
  • agents retain excessive authority,
  • product-to-product entitlements remain after dependency removal.

Policy Drift​

A condition in which policy implementation, enforcement, or interpretation diverges from the intended policy.

Evidence Gap Rate​

A metric describing how often required evidence is missing, expired, insufficient, invalid, or disputed.

Trust Downgrade Count​

A metric describing how many products, claims, relationships, or DPPs have moved to a weaker trust posture over a defined period.

15. Common Boundary Statements​

This section records recurring boundary principles used across Governance Kernel documentation.

Governance Kernel and PVEP​

Governance Kernel computes governance truth.
PVEP renders governance truth.

Governance Kernel and PDEP​

PDEP builds governed products.
Governance Kernel validates governance conditions.

Governance Kernel and Product Fabric​

Governance Kernel computes governance state.
Product Fabric enforces governance state.

Governance Kernel and Marketplace​

Marketplace displays governance signals.
Governance Kernel provides authoritative governance state.

Governance Kernel and DPP​

The DPP is the passport.
Evidence is the proof.
The Governance Kernel evaluates what the passport means in context.

Governance Kernel and Trust​

Trust is not a badge.
Trust is evidence-backed governance state.

Governance Kernel and Entitlement​

Entitlement grants rights within policy, trust, risk, and context boundaries.

Governance Kernel and Risk​

Risk is contextual governance state, not a static label.

Governance Kernel and Evidence​

Evidence turns governance from assertion into assurance.

Governance Kernel and Agents​

Agentic does not mean AI by default.
Agents require explicit authority, scope, and auditability.

Governance Kernel and Product Creation​

Governance should begin at product creation, not after publication.

Lets recap what this glossary is about...​

The Governance Kernel Glossary defines the key vocabulary used to describe governance across UPOS and the ProductVerse.

The Governance Kernel exists to compute, explain, record, emit, and assure governance state across products, actors, agents, intents, policies, entitlements, trust, risk, evidence, DPPs, relationships, lifecycle events, runtime interactions, PVEP, PDEP, Product Fabric, marketplaces, and Product Graph.

The most important conceptual separations are:

ConceptDistinction
PolicyDefines rules, obligations, permissions, and prohibitions.
EntitlementRepresents rights or grants held by a subject.
TrustRepresents evidence-backed confidence in fitness for purpose.
RiskRepresents potential harm, exposure, or uncertainty.
EvidenceSupports or challenges claims and governance decisions.
DPPCarries product identity, claims, evidence, and assurance context.
PVEPRenders governance state to consumers and agents.
PDEPBuilds and evolves governed products.
Product FabricEnforces governance state at runtime.
Governance KernelComputes, evaluates, records, explains, and emits governance state.

The Governance Kernel Glossary anchors the language needed to make ProductVerse governance computable, explainable, auditable, enforceable, and understandable.