Glossary

114 terms, in the sense this mechanism uses them. The platform glossary has every term across all mechanisms.

ABAC: Attribute-based access control: a rule is evaluated at request time over attributes of subject, object, action and environment.
Action: In access control, what a principal wants to do to an object: read, write, delete. A permission check asks whether this principal may perform this action on this object.A principal is anyone or anything that can make a request: a person, a program, a scheduled job. An object is the thing they want to touch: a table, a file, a column. An action is what they want to do: read, write, delete. Almost all access control answers one question: may this principal perform this action on this object, right now?.
Adaptive adversary: An attacker who studies the design and then chooses the weakest path.
Adversary: An adversary is whoever you defend against. A threat model is a written statement of which adversaries you defend against, and with what abilities. Without it, "secure" has no meaning.
AEAD: Authenticated encryption with associated data: encrypts and checks integrity in one step.
AES-NI: CPU instructions that make AES encryption very fast.
Attestation: A trusted party (scheduler, hypervisor, hardware) signs a statement about what code runs where.
Audience restriction: A token names the one service allowed to accept it.
Authentication: Proving who is asking.Authentication (often shortened to "authn") means proving who you are. Authorization ("authz") means the system deciding what you may do, once it knows who you are. Authentication is the badge check at the door; authorization is which rooms your badge opens.
Authorization: Deciding what an identified principal may do.Authentication (often shortened to "authn") means proving who you are. Authorization ("authz") means the system deciding what you may do, once it knows who you are. Authentication is the badge check at the door; authorization is which rooms your badge opens.
Auxiliary dataset: Other data an adversary already holds (a voter list, a news article) and can link to a release.
Bearer token: A token where whoever holds it gets the access.
Blast radius: The part of the system or the number of users affected when one failure happens.How much damage one mistake or one stolen secret can cause.
Break-glass: Emergency access that overrides normal rules; should be self-service, loud and time-bounded.
Break-glass access: A designed emergency path that bypasses normal approval, with audit.
Cardinality: The number of distinct values a label can take. The series count is the product over all labels.2 other meanings →The number of distinct things in a set. "20 million files" is a statement about cardinality. Metadata size follows cardinality (how many objects), not bytes.
Chokepoint: A single place that every request must pass through. If you put a guard at a chokepoint, you guard everything behind it. If there is a second door, the guard is useless.
Clamping: Capping each person's contribution so a sum has bounded sensitivity.
Clean room: A managed environment where two parties combine data under rules, usually with output controls.
Compress-then-encrypt: The required order, because ciphertext cannot be compressed.
Confidential computing: Running code in a hardware-protected enclave that the host cannot read.
Confused deputy: A program with high authority that is tricked into using it for a low-authority caller.
Consent propagation: Carrying per-person, per-purpose consent through the datasets derived from the data.
Controls decay toward permissive: Without a forcing function, controls drift to allow more over time.
Credential: Anything presented to prove identity or authority: a password, a private key, a token.A secret is a value only the right party should know (a password, a private key). A key is a secret used by a cipher to lock or unlock data. A token is a small piece of data that proves a right to access. A credential is the general word for anything you present to prove identity or authority.
Credential vending: The catalog issues short-lived, narrowly scoped storage credentials per request.
Crypto-shredding: Deleting data by destroying its key.
Data key: A key that encrypts bulk data locally and is itself wrapped by the key service.
Data minimization: Collecting only the data you need.
Data residency: A rule that certain data may not leave a country or region.
Decision caching: Caching authorization answers, which makes revocation as slow as the cache TTL.
Definer's rights / invoker's rights: A view runs with the privileges of its creator or of its caller.
Degenerate approval: A second approver who approves without looking, turning two-person control into a log entry.
Deterministic encryption: Encryption where equal plaintexts give equal ciphertexts.
Differencing attack: Subtracting two aggregate answers to isolate one person's value.
Differential privacy (DP): A bound that any output changes by at most a factor e^epsilon when one person's record is added or removed.
Dynamic masking: Transforming a value at read time according to policy.
Egress: Data leaving the controlled environment.
Encryption: Turning readable plaintext into unreadable ciphertext with a key. Symmetric encryption uses one key and is fast; asymmetric encryption uses a public and a private key and is slower, used for identity and exchanging keys.A cipher transforms plaintext (readable data) into ciphertext (unreadable data) using a key. Without the key, the ciphertext should be useless. Symmetric encryption uses one key for both locking and unlocking and is fast (gigabytes per second). Asymmetric encryption uses a pair: a public key anyone may use to lock, and a private key to unlock or to sign. It is slower and is used for small things such as proving identity or exchanging keys.
Envelope encryption: A data key encrypts data; a master key in a key service wraps the data key.
Epsilon (privacy budget): The number that sets the DP guarantee; spent by queries and not refilled.
Equivalence class: The rows of a release that share the same quasi-identifiers.2 other meanings →
Event-level DP: DP that protects a single event, not a whole user.
Exfiltration: Copying data out of the organization, usually an authorized read followed by an export.
Federation: Trusting an identity provider you do not run for who a person is, not for what they may do.1 other meaning →
Format-preserving encryption (FPE): Encryption whose output has the same format as its input.
Friction displaces rather than prevents: A control slower than its workaround is routed around; friction is a security parameter.
Generalization: Replacing a value by a coarser one (birth date to birth year).
Grant option: The right to pass a permission on to others.
Hardware security module (HSM): Tamper-resistant hardware that holds keys and performs crypto operations.
Hash: A hash function turns any input into a fixed-size fingerprint. The same input always gives the same fingerprint. It is meant to be one-way: from the fingerprint you should not be able to recover the input.
Hash chaining: Each log entry includes the hash of the previous one, so edits are detectable.
Hashing: A one-way function; weak for identifiers because inputs can be enumerated.
Inheritance: Permissions granted on a container apply to objects inside it.
Key: A secret value a cipher uses to encrypt or decrypt data. Whoever holds the key can read the data.2 other meanings →A secret is a value only the right party should know (a password, a private key). A key is a secret used by a cipher to lock or unlock data. A token is a small piece of data that proves a right to access. A credential is the general word for anything you present to prove identity or authority.
Key management service (KMS): A service that holds master keys, wraps and unwraps data keys and audits every use.
Keyed hashing: Hashing with a secret key or global secret salt.
l-diversity: Each equivalence class has at least l distinct sensitive values.
Laplace distribution: A sharply peaked distribution whose noise is used for DP counts, with scale sensitivity/epsilon.
Leakproof function: A function proven not to reveal its input through errors or side effects.
Legal hold: An outside order forbidding deletion of certain data.
Linkage attack: Joining a release to an outside dataset to find a person.
Machine unlearning: Making a trained model forget some training data; no cheap general solution exists.
Malleable ciphertext: Ciphertext an attacker can change in controlled ways because it is not authenticated.
Masking: Hiding a sensitive value while the record remains visible.1 other meaning →
mTLS (mutual TLS): TLS where both client and server prove their identity with certificates.
Multi-party computation (MPC): Cryptography that lets parties compute a joint function while learning only the output.
Multi-tenancy: Several customers or teams sharing one platform.
Narrowest-waist rule: A control binds at the narrowest point that all data passes through.
Nonce: A number that must be used only once with a given key.
OAuth: A protocol for delegation without sharing a credential.
Object: One thing a database stores and names: a row, a key, a file. Each write creates a new version of it, and consistency models say which orders of reads and writes of objects are allowed.An object is one thing the database stores and names (a row, a key, a file). Each write to it creates a new version. A history is the list of all reads and writes the system performed, in the order each observer saw them. This mechanism is about which histories are allowed.
OIDC: OpenID Connect: adds an identity token on top of OAuth.
Only bounds compose; states do not: Guarantees about a process add up; properties of one table do not combine.
Order-preserving encryption: Encryption that keeps ranking, so range queries work and ranking leaks.
Permission drift: Access slowly growing past what anyone intended.
Policy-as-code: Policy stored as a versioned, testable, reviewable file, separated from enforcement.
Preserved properties are published properties: Any property kept through a transformation is revealed by it.
Principal: The identity (user or role) on whose behalf a query runs.A principal is anyone or anything that can make a request: a person, a program, a scheduled job. An object is the thing they want to touch: a table, a file, a column. An action is what they want to do: read, write, delete. Almost all access control answers one question: may this principal perform this action on this object, right now?.
Private set intersection (PSI): MPC for finding the overlap of two lists.
Pseudonymization: Replacing identifiers with substitutes; still personal data.
Purpose limitation: Data collected for one purpose may be used only for it.
Quasi-identifier: An attribute that, combined with others, identifies a person.A piece of data that does not name a person by itself (a postcode, a birth year) but, combined with others, can single one out. We meet this in the privacy discussion later; keep the word in mind.
Rainbow table: A precomputed lookup from hash to input.
RBAC: Role-based access control: permissions attach to roles, people attach to roles.
ReBAC: Relationship-based access control: access is reachability in a graph of relationships.
Result cache key: The key a cache uses to store results; unsafe if it omits identity and policy version.
Reverse ETL: Pushing data from the warehouse into operational systems.
Right to be forgotten: A person's right to ask for their data to be deleted.
Role explosion: Roles growing about 2^d when policy depends on d independent dimensions.
Root of trust: The starting point of an authentication chain, set up outside the system.
Row- and column-level security: Predicates that filter rows or hide columns at read time.
Salt: Extra data added to the input of a hash.
Schema-on-read: Storing raw data now and deciding its meaning at query time.
Secret: A value only the right party should know, such as a password or a private key.A secret is a value only the right party should know (a password, a private key). A key is a secret used by a cipher to lock or unlock data. A token is a small piece of data that proves a right to access. A credential is the general word for anything you present to prove identity or authority.
Security barrier: A boundary the optimizer may not move predicates across.
Sensitivity: The most one person can change a query's answer.
Separation of duties: Requiring two independent principals for a harmful action.
Side channel: Information leaking through behaviour (timing, errors) and not through data.
Some budgets are depleted by reading: A privacy budget is consumed by queries and cannot be refilled.
Static masking: Producing a second, masked dataset at write time.
Suppression: Deleting rows that still stand alone after generalization.
Synthetic data: Records sampled from a generative model fitted to real data.Fake data produced by a program for testing.
t-closeness: Each class's sensitive-value distribution is close to the global distribution.
Tamper-evident log: An audit log where changes to old entries are detectable.
Tenant: One customer, department or team sharing a platform.
Threat model: An adversary is whoever you defend against. A threat model is a written statement of which adversaries you defend against, and with what abilities. Without it, "secure" has no meaning.
TLS: Transport Layer Security: confidentiality, integrity and server authentication on a network channel.
Token (tokenization): A reference with no computable relation to the original value; mapping kept in a vault.A secret is a value only the right party should know (a password, a private key). A key is a secret used by a cipher to lock or unlock data. A token is a small piece of data that proves a right to access. A credential is the general word for anything you present to prove identity or authority.
TTL: Time to live: how long an entry may be served before it expires.A lifetime attached to a cache entry. After the TTL expires, the entry is dropped or treated as missing.
User-level DP: DP that bounds each user's total contribution.
Vault: The protected store of the token-to-value mapping.
Workload identity: Identity derived from where code runs, not from a secret it holds.
Wrap / unwrap: Encrypt or decrypt a data key under a master key.