URDAD Model Specification

Analysis and Design - the process for determining the stakeholder requirements and designing a solution fulfilling those requirements referring to BR.

the level of access a security policy grants on a responsibility domain or a whole model. In increasing order: `deny` (the domain is hidden), `read`, `annotate`, `modify` and `manage` (which additionally permits driving the project life cycle and managing project teams).

Access Control List - a list attached to a resource, such as a file, naming which users or groups may access it and how, in addition to or in place of the resource’s basic permission bits.

the last transition of the project life cycle, which merges an approved project’s branch into the main branch once its effective date has arrived, making its work part of the live model.

a step in a process: a service request, a message send or wait, a variable definition, or a construct grouping further activities such as alternate flows or concurrent flows.

the thin, product-specific part of an integration with an external tool: it realises a bridge's contract for one product — GitLab, Azure DevOps, HashiCorp Vault, Kafka — by mapping the contract’s requests and results to that product’s API, and holds no logic that another product would also need.

the generic step-forward transition of the project life cycle, moving a project to its next phase; its counterpart is Revert.

Artificial Intelligence - the field of computer science building systems that perform tasks normally requiring human intelligence. In the tool it means the optional assistance an LLM provides, for instance formalising informal requirements.

Azure Kubernetes Service - Microsoft Azure’s managed Kubernetes platform, on which containers such as an instance’s images can be run.

a branch in a process of which exactly one flow is taken: the first conditional flow, in their modelled order, whose condition holds, or the default flow when none does. All flows rejoin at a merge.

Anti-Money Laundering - the laws, regulations and controls requiring financial institutions to detect and report attempts to disguise the proceeds of crime; they impose record-keeping obligations that can override a request for erasure. Compare KYC.

Advanced Message Queuing Protocol - an open wire-level protocol for message-oriented middleware, used by message brokers such as RabbitMQ to pass messages between systems.

Administrative Normal Form - an intermediate form of a program in which every argument of an operation is a variable or a constant, each intermediate result being bound to a name of its own.

free text attached to a model element and stored with it. Each annotation has a purpose (short or detailed description, informal requirement, comment, concern, question, response or error) and a markup type.

an irreversible processing of personal data that completely prevents the identification of an individual by any means using any of the stored information. Unlike pseudonymised data, anonymised data is no longer subject to data protection regulations like GDPR.

an instance of the modelling tool with no sign-in, on which every visitor is the same anonymous reader who may open its models and change nothing — the configuration the public playground runs.

Application Programming Interface - a set of rules or protocols that enables software applications to communicate with each other to exchange data and functionality.

what a service contract declares, with its reason, when its change to a stored entity instance applies to the instance as it is rather than to an entity version its requester read: an increment computed from the stored value inside the change’s own transaction, or a change meant to win.

the transition from In Review to Approved. It records the approver’s signature and the effective date, and is refused unless every team member has signed off, every mandatory checklist item is signed and the separation-of-duties rules hold.

the project role whose holder moves the project from In Review to Approved with Approve; assigned on top of the holder’s team-membership role.

retiring a project that will not be activated by hiding it from the day-to-day project lists. Unlike deletion it is reversible: the branch, history, audit log and team all survive, and the project can be unarchived.

American Standard Code for Information Interchange - the 7-bit character encoding of the basic Latin letters, digits and punctuation, of which UTF-8 is a superset.

a plain-text markup language for documents, readable as written and rendered by Asciidoctor to HTML, PDF and other formats. The tool writes a model’s generated documentation in it; both manuals are written in it too.

Abstract Syntax Tree - the tree a parser builds from source text, each node standing for one construct of the language, with the punctuation of the concrete syntax dropped.

the append-only, per-project record of every governance-relevant event — phase transitions, sign-offs, approvals, role changes and the like. Rows are never updated or deleted; the actor is recorded as an opaque identifier.

the default role of every project team member, permitting them to modify the model during the Development phase within their security-policy grants.

an activity that stops a process until a message of a named data structure arrives.

Amazon Web Services - Amazon’s cloud platform, offering hosted compute, storage and LLM endpoints among other services.

Business Analyst - a person who elicits, analyses and documents the requirements of a business and its stakeholders, typically one of the modellers of a URDAD model.

a flow of concurrent flows that runs on independently and ends in a flow end of its own instead of arriving at the join.

in domain-driven design, the boundary within which one model, and the meaning of its terms, applies consistently; another context may model the same things differently, and exchanges with it are translated at the boundary.

Business Process Model and Notation - a public standard of the OMG for documenting and diagrammatically representing business processes.

Business Rule - a precise declarative statement that defines or constrains some aspect of an organization’s operations, behaviour or structure. It asserts business knowledge or intent, independent of the systems or manual processes used to implement it.

the tool-neutral component through which the tool integrates with one responsibility domain it relies on outside itself — CI/CD gating, secrets, an identity directory, messages from a broker. It holds everything that does not depend on a product, and delegates the rest, through a logic-free contract, to one adapter per product.

Business Rule Management System - a repository and execution environment for hosting and executing business rules (BRs).

a notation for software architecture that describes a system at four levels of zoom: its context, its containers, their components and their code.

Certificate Authority - an entity that issues the digital certificates with which TLS and similar protocols establish the identity of a server or client.

Change Advisory Board - the body which, in an ITSM change process, assesses, prioritises and approves or rejects a proposed change to a production service.

said of a service contract whose requesters may cancel a request before it is answered. A cancelled request has no net effect: the process realizing it undoes what it committed. A request for a service that is not cancellable is waited for when its requester is interrupted, and then undone through its contract’s compensation.

a model commit, under an environment's current configuration, that the environment has evaluated and that may be promoted to become its pin.

Content Delivery Network - a geographically distributed network of servers that caches and serves a site’s static content from a location close to each visitor.

Common Event Format - ArcSight’s Common Event Format: one line per event, a fixed header of vendor, product, event type, name and severity, then `key=value` extensions. Most SIEMs read it from syslog.

an organisation-wide set of review items, authored by auditors, which can be attached to a project so that each item must be signed before the project may be approved.

Continuous Integration - the practice of building and testing every change automatically as it is integrated; also the pipeline that does so. See CI/CD.

Continuous Integration / Continuous Delivery - the practice of building and testing every change automatically as it is integrated (CI), and of delivering or deploying what passes automatically (CD).

CommonJS - the module format Node.js used before standard JavaScript modules, loading a module with `require` and exporting through `module.exports`.

Command-Line Interface - a program operated by typing commands and arguments in a terminal rather than through a graphical UI.

the party that requests a service: the one the service is offered to, and the one its response is for. A service contract's _Published to_ list names the responsibility domains that may be its clients from outside its own domain. A client need not be a stakeholder, nor a stakeholder a client. The client of one particular request is its _requester_; once a model runs, the identity a request is made as is its _caller_. Not to be confused with a software client, such as the web client or an OIDC client.

the degree to which what a component contains belongs together, because it serves one purpose or one responsibility. Good design seeks high cohesion.

the request that undoes a change a step of a process committed, stated on the step or, as its _Undone by_, on the requested service contract. It runs when the process refuses after the change was made, so that the refusal has no net effect.

the project role representing the compliance function on the project; mandatory for a regulated project.

{def-concurrent_flows}

a named boolean predicate, optionally with a formal specification.

the execution environment's operating tool: the `console` command, which creates environments, applies configurations, promotes and rolls back, and the browser application over the API that `console serve` provides.

Cross-Origin Resource Sharing - the browser mechanism by which a server permits a web page from another origin to call it; a request a server does not so permit is blocked by the browser.

the degree to which one component depends on another, and so must change when the other does. Good design seeks low coupling.

Central Processing Unit - the processor of a computer that executes a program’s instructions.

Create, Read, Update, Delete - the four basic operations on stored records.

Container Storage Interface - the standard interface through which a container orchestrator such as Kubernetes mounts storage — and, through the Secrets Store CSI driver, secrets — into a container.

Cascading Style Sheets - the language in which the presentation — layout, colours, fonts — of an HTML or SVG document is specified.

Comma-Separated Values - a plain-text tabular format with one record per line and its fields separated by commas.

Contract Verifying Interceptor - the component of an execution environment that judges each answer to a service request against the service contract it was made under — its pre-conditions, post-conditions and data constraints.

an id held by one model element that does not or no longer resolves to any element in the model.

the party that decides why and how personal data is processed.

what an entity stores, attribute by attribute: each attribute’s type, role, multiplicity, uniqueness and personal data, the views whose fields of its name are stored in it, and the services that write it and the elements that read it — the entity’s lineage. Generated documentation carries one for every entity.

whoever is accountable for the data a responsibility domain keeps: in an execution environment, the members of the identity-provider groups named for the domain, who accept each change to the shape of an entity it owns before it is promoted into production.

a party that processes personal data.

a structured data type with typed fields. It may specialize another data structure and may carry invariance constraints; a request, a response, an exception and a message are each described by one.

Database - an organised, persistent store of data and the software managing it.

Domain-Driven Analysis and Design - an analysis and design method where requirements and design is specified in terms of domain (business) concepts instead of technical concepts.

a model element that works out a response from a request by rules, as a decision table or a single literal expression. A decision changes nothing, so it is a way of realizing a function service.

a decision made of inputs, outputs and rules, one rule per row; its hit policy says which applicable rules answer.

the design principle that higher-level policy should not depend on lower-level detail, but both on an abstraction; in URDAD, a process and the providers that answer its requests both depend on a service contract.

the lowest verification level, and a new project’s: does each process address its contract’s requirements and state nothing that cannot hold. It does not ask what each request and response carries.

specifying what a component requires and what it guarantees as a contract of pre-conditions, post-conditions and invariants, which its client must satisfy and its provider must honour.

Depth-First Search - a graph traversal that follows each path as far as it leads before backtracking; with three node colours it detects cycles.

Diagram Interchange - the part of the BPMN standard that records the layout of a process’s diagram — each shape’s bounds and each edge’s waypoints — alongside its semantics.

how the organisation’s identity provider tells the tool who has left: over SCIM, or by the tool reading the provider’s directory. A person the feed deactivates or deletes loses access and is later erased; the feed also supplies group names to the policy editor. The modelling server and the execution environment each have one.

Domain Name System - the Internet’s directory, which resolves a host name to the network address of the machine serving it.

Document Object Model - the browser’s in-memory tree of an HTML or SVG document, through which scripts read and change the page.

the PostgreSQL schema in which an execution environment keeps the records of the entities one responsibility domain owns, written only by that domain’s own database role, so that the database itself keeps each domain’s records apart.

Decision Model and Notation - a standard of the OMG for specifying business decisions as decision tables and expressions; its expression language is FEEL.

Digital Operational Resilience Act - an EU regulation which stipulates standards for managing ICT risks, third-party provider oversight, sharing of ICT incidents and for testing and auditing ICT processes.

Data Protection Officer - the person an organisation designates to oversee its compliance with data protection law such as GDPR or POPIA, and the point of contact for data subjects and the regulator.

Data Structure Diagram - the diagram of a URDAD model showing a data structure: its fields and its relationships to other data structures.

Enterprise Architect - a person responsible for the structure of an organisation’s business, information and technology landscape as a whole, and for keeping individual solutions consistent with it.

Extended Backus–Naur Form - a notation for writing down the grammar of a language as rules, each naming the sequences, alternatives, options and repetitions of words a construct is made of; the URDAD-OCL and URDAD-FEEL grammars are written in it, as ISO/IEC 14977 standardises it.

a model whose purpose is to hold definitions shared by several models. A model associates with a fixed published revision of a library and may reference its elements, but never change them.

Eclipse Modeling Framework - an Eclipse framework and code-generation facility for building tools from a model expressed in EMOF (Ecore).

Essential Meta-Object Facility - the compact subset of the OMG's MOF sufficient for defining simple metamodels, in which the URDAD metamodel is also published.

a data object with identity used to store data which is typically persisted in a database.

the property of a data structure naming the entity it is a view of. An entity’s fields are not authored directly but are the union of the fields stated by the data structures that feed it.

the declared steps that carry an entity's stored instances across a change to its shape, which a promotion applies to every instance, each rewrite recorded in the instance’s history.

which version of a stored entity instance was read. The store numbers each instance’s versions and fills an entity’s *version* field on every read; a change to the instance names the version it was decided on, and is refused once the instance has moved past it.

in the execution environment, one running deployment of a model — of kind `development`, `test`, `production` or `preview` — with a configuration saying who answers each service contract, a promotion policy and a current pin.

the deletion of all personal data - a right provided by data protection regulations like GDPR.

a branch in a process whose flow is chosen by an event occurring — a message arriving, a duration elapsing or a clock striking — rather than by a condition being tested.

a named data structure raised to tell a service’s client that a pre-condition was violated and the service has been refused.

the part of a service request that says what the calling process does when the requested service raises a particular exception. Every exception the requested service may raise must be handled.

the highest verification level: is each process formal enough to run in the execution environment. What the environment cannot build or follow, or its promotion gate refuses, is an error at this level.

the optional deployable that runs a model’s processes for real, on Temporal. It is installed and operated separately from the modelling tool, which does not depend on it.

a service request drawn, in a Process View, as the process that realizes the requested service rather than as a box naming it. Expansion is a viewer’s choice of what to see, not part of the model, and what an expanded request shows is read-only.

a pure expression is a mapping of variables onto some value.

Friendly Enough Expression Language - the expression language of DMN, written to read like business prose. URDAD-FEEL, a profile of it, is one of the two notations in which a formal specification may be read and written.

Foreign Function Interface - the mechanism by which code in one programming language calls functions written in another.

one result of model verification or of evaluating a candidate, carrying a severity.

a condition, constraint or expression written in a formal language — URDAD-OCL, or equivalently URDAD-FEEL — so that the tool can check and evaluate it. The model stores every formal specification in URDAD-OCL.

a service whose contract declares it pure: requesting it yields an answer and changes nothing. A process realizing it may only orchestrate other functions.

a requirement a service contract places on the service it specifies — one of its pre-conditions or post-conditions — which a realizing process allocates to the activities that address it.

Foreign Exchange - the exchange of one currency for another, and the market in which it takes place.

the component of an environment through which external systems request the model’s published services.

GNU Compiler Collection - the GNU project’s compilers for C, C++ and other languages.

General Data Protection Regulation - the European Union regulation governing the processing of personal data.

per-project metadata captured during Planning and frozen afterwards: whether the project is regulated, its regulatory regimes, risk and data classification, stakeholders, whether its processes will be executed, and its target activation date.

Graphics Processing Unit - a massively parallel processor, originally for rendering graphics, on which LLMs are run efficiently.

Governance, Risk and Compliance - the coordinated management of an organisation’s governance, its risks and its compliance with laws, regulations and internal policies; also the class of tools that record its controls and the evidence that each is met.

a sequence of records each of which carries a cryptographic hash of its own content and the hash of the record before it, so that altering, removing or reordering a record already written is detected by recomputing the hashes.

in git, the commit a branch currently points to — its latest commit; the HEAD of `main` is the current state of the main branch.

an entity an execution environment's configuration lists as holding too many instances to read whole: a condition reading its population there must be narrowed, by an equality on a stored field or a date-time window, or the promotion is refused.

the rule of a decision table saying which of the rules that apply give its answer — for instance `UNIQUE`, `FIRST` or `ANY`.

Hash-based Message Authentication Code - a code computed from a message and a secret key with a cryptographic hash function, with which a receiver holding the key verifies that the message is authentic and unaltered.

HTTP Strict Transport Security - a response header by which a site instructs browsers to reach it only over HTTPS from then on.

Hypertext Markup Language - the markup language of web pages.

Hypertext Transfer Protocol - the request/response protocol of the web, used by browsers and by systems calling each other’s APIs.

Hypertext Transfer Protocol Secure - HTTP carried over a TLS connection, which encrypts it and authenticates the server.

a request for a service that a person answers. The execution environment offers it to the people of the responsible responsibility domain in the task portal, where one of them claims and completes it.

Internet Assigned Numbers Authority - the body coordinating the Internet’s global identifiers — among them media types, port numbers and, through the time-zone database, the IANA time zones.

a time zone named by its identifier in the time zone database maintained by the Internet Assigned Numbers Authority, such as `Africa/Johannesburg`. It, unlike a fixed offset, accounts for daylight-saving rules.

Information and Communication Technology - encompasses all communication technologies, media, and infrastructure used to capture, process, store, transmit, and display information.

Identifier - a value that names one thing uniquely within some scope, such as a template’s or an event’s ID.

the organisation’s sign-in service, which authenticates people and services and states which groups they belong to. The tool holds no passwords of its own and relies on one speaking OIDC.

a requirement as originally stated, in prose, before it has been formalised into model elements. It is held as an annotation.

the principle of hiding, behind a component’s interface, the design decisions most likely to change, so that changing them does not affect the component’s users.

the part of a unit test run in which all of an environment’s processes run together, so that their interactions are tested.

a constraint which must always hold true, a state where an invariance constraint is not met should not be observable.

see invariance constraint.

the arrangement in which a component does not choose the components it relies on, but has them chosen and supplied by whatever runs it; in URDAD, an environment chooses who answers each service contract a process requests.

Internet Protocol - the protocol addressing and routing packets between hosts on the Internet; an IP address identifies one host or network interface.

Intermediate Representation - a data structure a compiler or engine translates its input into before producing its output, so that several front ends can share one back end.

International Organization for Standardization - the international body that develops and publishes standards such as ISO 8601 and ISO/IEC/IEEE 42010.

ISO 8601 Date and time — Representations for information interchange - the international standard for writing dates, times and amounts of time, such as `2026-10-15T09:30:00+02:00` or the duration `PT72H`.

ISO/IEC/IEEE 42010:2022 Software, systems and enterprise — Architecture description - the international standard for describing the architecture of software, systems and enterprises. It requires a rationale to be recorded for architectural decisions.

Information Technology - the computer systems, networks and software through which an organisation stores, processes and communicates information, and the function that runs them.

IT Service Management - the discipline by which an organisation designs, delivers, operates and changes the IT services it offers, including the requesting, approval and recording of each change to them; also the class of tools, such as ServiceNow, that support it.

Jakarta Messaging (formerly Java Message Service) - the Java API for sending and receiving messages through message-oriented middleware.

JavaScript - the programming language of the web browser, also run on servers by Node.js.

JavaScript Object Notation - a lightweight, text-based format for structured data. Models, exports and configurations are stored and exchanged in it.

JSON Web Key Set - a JSON document, published by an identity provider, holding the public keys with which the signatures of the tokens it issues are verified.

JSON Web Token - a compact, signed JSON token carrying claims about a subject, such as the access and ID tokens an OIDC identity provider issues.

Key-Value - a store or cache addressing each value by a key. An LLM runtime’s KV cache holds the attention keys and values computed for a prompt prefix, so a repeated prefix is not recomputed.

Know Your Customer - the regulatory obligation on financial institutions to verify the identity of their customers and assess their risk, with records they must retain. Compare AML.

one of the flows into which a construct branches a process: a flow of concurrent flows or alternate flows, one outcome of a service request, or one parallel instance of a multi-instance request.

the tool’s component, written in Rust, that lays out and draws every diagram of a model — in the browser as WASM, and on the server for generated documentation and the manuals.

Large Language Model - a machine-learning model trained on large amounts of text, able to read and produce natural language. The tool calls one, through providers an administrator configures, for its AI assistance.

the branch of a model’s git repository holding the live, approved model. It changes only when a project is activated.

Modified Condition/Decision Coverage - a test-coverage criterion requiring that every condition in a decision be shown, by a pair of tests differing in that condition alone, to affect the decision’s outcome independently; required by some regulatory regimes.

the most recent commit that a project's branch and the main branch have in common; the common ancestor of a three-way merge.

the statement, on a wait for a message, of which running instance of a process the message is for: a key read from the message and the value that key must match.

the part of a service request that says what the caller does with a message the requested service declares it may send. It runs as a background flow.

a small, independently deployable service, owning its own data, that provides the capabilities of one business responsibility.

Markets in Financial Instruments Directive II - an EU directive that, together with Regulation (EU) No 600/2014, provides a legal framework for securities markets, investment intermediaries and trading venues.

Multipurpose Internet Mail Extensions - the type label of a file or message body, such as `text/html` or `application/json` (also called a media type), registered with IANA.

the top-level element of a URDAD model, which contains its responsibility domains; an access right granted on it applies to the whole model.

the modelling tool’s panel showing a model’s elements as a tree of responsibility domains and their contents, from which an element is selected, opened or acted on.

the tool’s on-demand, deterministic check of whether a model is internally consistent — that its references resolve and its processes discharge what their contracts require. It reports findings at a chosen verification level.

Meta-Object Facility - the OMG standard for defining metamodels, such as that of UML; EMOF is its essential subset.

one watcher of a stretch of monitored activities: a triggering event — a message, a duration or a clock — and the activities run when it fires, either *interrupting* the monitored activities or running beside them.

a stretch of a process watched for something happening while it runs, by one or more monitors. BPMN’s event sub-process, and its boundary events.

a service request asking one service of several providers, either in parallel or in sequence.

Network File System - a protocol through which a host mounts a file system served by another over the network.

a message announcing that something has happened. Any number of parties may react to it, and none is obliged to. Compare work item.

Object Constraint Language - a standard of the OMG for writing precise constraints and queries over a model. URDAD-OCL, a profile of it, is the language in which the model stores every formal specification.

OpenID Connect - an identity layer on top of OAuth 2.0 through which an application lets an identity provider authenticate its users and learns who they are and which groups they belong to.

Object Management Group - the standards consortium that maintains, among others, BPMN, DMN, OCL and UML.

a random identifier, such as `u_9f3c1a…`, that stands for a user in every permanent record. Only the user directory links it to a person, so deleting that one entry de-identifies the person everywhere; see pseudonymisation.

a vendor-neutral format for describing HTTP APIs, from which documentation and client code can be generated.

a way of keeping concurrent changes from overwriting one another without locking: a change names the version of the data it was decided on, and is refused if the data has changed since. URDAD does this with entity versions.

Operating System - the software managing a computer’s hardware and providing common services to the programs running on it.

OpenTelemetry Protocol - the vendor-neutral protocol by which OpenTelemetry exports logs, traces and metrics to a collector or observability back end.

the responsibility domain that directly contains an entity. In an execution environment only a realization of a service contract of that same domain may write or delete the entity’s instances; another domain asks for a change through one of the owning domain’s contracts.

Portable Document Format - a fixed-layout document format that renders the same on any device or printer.

Privacy-Enhanced Mail - the text encoding of keys and certificates as Base64 between `-----BEGIN …-----` and `-----END …-----` lines.

any information that can identify a specific person, such as names, addresses, email addresses, and even IP addresses.

one of the six stages a project moves through: Initiation, Planning, Development, In Review, Approved and Active. Each phase constrains what the team may do.

the checks the server runs before a transition into In Review or Approved — among them that the branch is not stale, that no semantic conflict exists and that no reference dangles.

Personally Identifiable Information - see personal data.

the model commit and configuration revision on which an environment starts new executions.

Proof Key for Code Exchange - an extension of the OAuth 2.0 authorization-code flow that protects the code from interception, allowing a browser application, which cannot keep a secret, to sign in safely.

Public-Key Cryptography Standards - a family of standards for public-key cryptography; PKCS #8, for instance, is a format for private keys.

Portable Network Graphics - a lossless raster image format.

Protection of Personal Information Act - South Africa’s data-protection legislation similar to Europe’s GDPR.

an architectural style, also called hexagonal architecture, in which an application’s core interacts with the outside world only through technology-neutral interfaces, its ports, each connected to a particular person, system or technology by an adapter. The tool’s integration adapters are one instance of it.

Portable Operating System Interface - the IEEE family of standards for Unix-like operating systems, which also fixes the syntax of `cron` schedules and of time-zone strings.

a condition which must hold true after the service has been provided. A post-condition typically specifies a required result of some of the activities performed in a process realizing the service contract.

a condition which must hold true for the service to be provided. If a pre-condition does not hold true, the service is to be refused.

an expression which returns true or false.

an environment that runs a project's branch rather than the main branch, so the team can try its processes before approval. It may exist only for a project that has consented to it.

the business process realizing a service contract: the activities it carries out, and the control flow connecting them.

the project role accountable for the business process the project models — the A of RACI; without their sign-off the project cannot be approved.

the unit in which a model is changed. A project works on its own branch of the model, cut from the main branch, and moves through a fixed sequence of phases until it is activated or archived.

the project role that drives the project through its life cycle, held automatically by every user on the project’s leads list.

making a candidate an environment's current pin, automatically or by a person according to the environment’s promotion policy.

the evaluation an environment makes of each candidate before it can be promoted, producing findings.

a path over the data a service request can reach, saying which provider of the requested contract is asked. Left empty, whoever provides the contract is asked.

the process of replacing direct identifiers in a dataset with artificial codes or references, such that the data can no longer be attributed to a specific individual without access to a separately held “key” or mapping table. This is less rigid than anonymisation and data protection regulations like GDPR still apply to pseudonymised data.

Payment Services Directive 2 - an EU directive that aims to enhance the safety and security of payment services and promote innovation and competition in the market. It covers topics such as authorisation, supervision, information, rights and obligations, and access to accounts and payment systems.

the entities an owning domain lets other named responsibility domains read directly, entity by entity (an entity’s *Readable by*). A domain listed may read the entity’s stored fields that are not personal data; every other domain asks the owner’s query services.

the set of responsibility domains that may request a service contract. An empty set means the service is internal to its own domain.

the deletion of every record a retired environment leaves in the execution environment, its audit log included, so that nothing of it remains and its name may be used again. It cannot be undone.

a service contract declared a function that answers what an owning domain keeps about one instance of its entity: *get<Entity>* by its identifying field, and *find<Entity>By<Field>* by each field marked unique. The modelling tool generates them from the entity’s view, and another domain’s condition applies one rather than reading the owner’s records.

Responsible, Accountable, Consulted, Informed - a matrix assigning, for each task or decision, who does it, who answers for it, who is consulted and who is kept informed.

Responsibility Domain - short for responsibility domain.

how a service contract is met. In the model, by a process or a decision; in an environment, by whatever its configuration names — a process, a decision, a person, a coded implementation, an external system or a stub.

bringing a project's branch up to date with the main branch by a three-way merge, written as a single new commit on top of main. The server does this automatically whenever main moves.

a project whose governance profile marks it as subject to compliance requirements. It receives the compliance checklists and cannot be approved without a Compliance Officer’s sign-off.

a body of regulation a project falls under, such as GDPR or DORA. Regimes are maintained by auditors and decide which checklist templates attach to a regulated project.

a typed SQL view of one entity's current records, which an execution environment on PostgreSQL makes at each promotion for other systems to read: one column per stored field that is not personal data, read by a reporting role that can read nothing else.

what testing a project could not cover — a partition the generator could not decide, a check that reached no verdict, an unreachable branch, a service the integration run answered with a stand-in; each item must be disposed of on the residue checklist before the project is approved.

Representational State Transfer - an architectural style for HTTP APIs in which resources are addressed by URLs and manipulated with the standard HTTP methods.

the project role indicating that its holder has been asked to take part in the In Review sign-off.

Request for Comments - a document in the series through which the Internet Engineering Task Force publishes Internet standards, such as RFC 7636, which defines PKCE.

Static Analysis Results Interchange Format - an OASIS standard JSON format in which static-analysis and security-scanning tools report their findings.

Simple Authentication and Security Layer - a framework by which connection-oriented protocols such as AMQP and Kafka’s negotiate an authentication mechanism, for instance `PLAIN` or `SCRAM`.

Static Application Security Testing - the analysis of an application’s source code, without running it, for security vulnerabilities.

Sassy CSS - the syntax of the Sass style-sheet language, a superset of CSS adding variables, nesting and mixins, compiled to CSS at build time.

Software Development Kit - a set of libraries and tools for building software against a particular platform or service, such as Temporal’s SDK for writing workers.

the activity at which a process requests a service, naming the service contract it requires rather than a particular provider.

the packaging unit of a URDAD model, mirroring an organisational unit or an external party. It owns service contracts, data types, processes and nested responsibility domains, and is what security policies grant access to.

an environment whose retirement has been decided: its components are stopped, its executions cancelled and its stored data deleted, while its record and audit log are kept until it is purged.

the generic step-back transition of the project life cycle, returning a project to an earlier phase.

the statement on a service contract that its service runs on the calendar’s initiative: a cron expression and the IANA time zone it is read against.

System for Cross-domain Identity Management - an open standard (RFC 7643, 7644) by which an identity provider provisions people and groups to an application — creating, updating, deactivating and deleting them — rather than the application asking. The tool’s directory feed may take this form.

the name a configuration gives a credential instead of the credential itself — `ai-gateway-api-key`, `directory-client`. The tool resolves it, when the credential is needed, from an environment variable, an owner-only file or the deployment’s secret store, so no configuration file, response or log line holds the value.

where a deployment keeps the credentials its secret references name: the organisation’s vault (HashiCorp Vault, Azure Key Vault), or the tool’s own local store of owner-only files when it has none.

an administrator-defined rule granting users whose identity-provider groups match its selector an access right on a responsibility domain or a whole model.

the case in which a project and the main branch have both changed the same model element since their merge base. The tool reports it for a person to reconcile rather than choosing a side.

SoD - the principle that no one person both produces a change and approves it. The tool enforces it at the Approve gate.

the specification of a service’s functional requirements: its request and response data structures, pre-conditions, post-conditions and the stakeholders requiring them. It is offered to its clients. A contract may specialize another.

how a finding is to be read. An error says the model states something that cannot hold; a warning, that the model is silent where it could speak; information, that a default applies.

Security Information and Event Management - the system in which an organisation’s security operations centre collects, correlates and searches security events from its applications and infrastructure, and raises alerts on them. The tool streams its own to one (security event export).

a team member’s declaration, during In Review, that the project is acceptable and ready to be approved. Every team member must sign off before Approve.

the design principle that a component should have a single responsibility, and hence a single reason to change.

Service-Level Agreement - an agreement between a service’s provider and its consumer on the service’s measurable qualities, such as its availability and response time.

Server Message Block - the network file-sharing protocol of Windows, also served by Samba.

Simple Mail Transfer Protocol - the protocol by which e-mail is sent and relayed between mail servers.

an EU directive that codifies and harmonises the EU insurance regulations covering aspects like the capital that an insurance company must hold to prevent insolvency.

the relation in which one service contract or data structure extends another, its base. A specializing contract inherits its base’s requirements, may add post-conditions and may waive, but never add, pre-conditions.

the middle verification level: each request and response says what it carries, each contract promises what it must and each field has a type, without saying how a payload is built.

Structured Query Language - the standard language for defining, querying and changing data in a relational database.

Secure Shell - a protocol for authenticated, encrypted remote login and command execution, also used to authenticate git over the network.

Single Sign-On - an arrangement in which a user signs in once with an identity provider and is then signed in to several applications.

a party with an interest in a service, and hence one that may place requirements on it — among them the business itself, a regulator, legislation on behalf of the population as a whole, and even a service provider that needs something in order to provide the service. In a model, a service contract's stakeholders are the parties, usually responsibility domains, that its pre-conditions and post-conditions name as requiring them. A stakeholder need not be a client. A project's governance profile lists the stakeholders of what the project delivers.

the state of a project whose merge base is no longer the head of the main branch because main has moved since; the opposite is fresh.

Scalable Vector Graphics - the XML-based vector image format of the web, in which the tool renders its diagrams.

the standard way (RFC 5424) of sending log messages over the network to a collector; the transport most SIEMs accept, usually carrying CEF.

the web page on which people claim and complete the human tasks of their responsibility domains. Each task service serves it for its environment.

the component of an environment that holds its human tasks and the tasks external systems claim, and serves the task portal.

Technology Compatibility Kit - a suite of tests published alongside a specification to check that an implementation conforms to it, such as the DMN TCK.

Transmission Control Protocol - the Internet protocol providing reliable, ordered byte streams between two hosts, over which HTTP and AMQP run.

an open-source durable-execution platform that keeps the state of long-running workflows so they survive restarts and failures. The execution environment runs a model’s processes on it.

one instance of the modelling tool, serving one organisation; tenants are separate instances rather than partitions of one.

combining two versions of a model using the version they share, their merge base, element by element and field by field. A change made on one side only is carried through; one made on both sides is a conflict.

Transport Layer Security - the cryptographic protocol securing network connections, such as HTTP as HTTPS.

a deliberate move of a project between phases: Advance, Revert, Approve or Activate. Each is recorded as a git tag, an audit-log row and a notification.

a shared language with defined concepts which is understood across business and technical role players as well as across responsibility domains. Terms map directly onto responsibility domains, data types and entities, and onto services and operations.

User Interface - the part of a system through which a person operates it, such as the modelling tool’s browser client.

Unified Modeling Language - the OMG's general-purpose graphical language for specifying, visualising and documenting software and business systems.

URDAD Modeling Tool - a tool enabling cross-functional teams across the organization to collaboratively develop and maintain an URDAD business model.

a step that undoes everything its process has committed so far, by the same compensations a refusal runs, and then carries on. It is how a process takes back what it did when the outcome is not a refusal, such as a withdrawal after acceptance.

a run of an environment's processes — typically a project’s preview — against cases generated wholly from the model: each process on its own with what it requests stubbed, then all of them together in the integration run.

Use-Case/Responsibility Driven Analysis & Design - a systematic Domain-Driven Analysis and Design method used to develop and maintain an organization-wide business model containing service contracts, business process specifications across levels of granularity and domains of responsibility.

the organisation-scoped role, conferred by membership of an identity-provider group, of administering the tool: creating models and libraries, defining security policies and configuring the instance.

the organisation-scoped role, conferred by membership of an identity-provider group, of auditing: reading every audit log and maintaining the checklist templates and regulatory regimes.

the profile of FEEL in which a formal specification may be read and written instead of URDAD-OCL.

the profile of OCL in which the model stores every formal specification: pre- and post-conditions, invariances, flow conditions and loop continuation conditions.

Uniform Resource Identifier - a string identifying a resource, such as an OIDC redirect URI; a URL is a URI that also locates the resource.

Uniform Resource Locator - the address of a resource on the web, such as `https://urdad.example.org`.

a service a stakeholder requires, specified in URDAD by a service contract and realized by a process.

Coordinated Universal Time - the world’s primary time standard, against which every time-zone offset is stated.

Universally Unique Identifier - a 128-bit identifier generated so that it is, for practical purposes, unique without any central coordination.

User Experience - the overall experience of a person using a product, including how easy and pleasant it is to use.

a data object used to exchange information.

what model verification asks of a model, depending on what it is for: one of three ordered levels, the descriptive, specified and executable, each asking everything the one below it does. A project’s level is set on its governance profile and can be raised, never lowered.

Virtual Machine - a computer emulated in software on a physical host, running its own operating system.

a pre-condition inherited from a base contract that a specializing service contract does not impose, so that the specialization accepts requests its base would refuse.

Write-Ahead Log - a database’s log of changes, written before the changes themselves are applied, from which it recovers after a crash and through which a replica or backup is kept up to date.

WebAssembly - a portable binary instruction format that browsers execute at near-native speed; the tool’s diagram layout engine, written in Rust, runs in the browser as WASM.

a message dispatching a unit of work that exactly one consumer must discharge, however many are listening. Compare notification.

the component of an environment that executes its processes, polling Temporal for work, and offers the coded implementations of `automated` realizations.

an identity a cloud platform gives a running workload — an Azure managed identity for a host, a workload identity for a Kubernetes pod — with which it obtains tokens for other services without holding any key or secret of its own.

Extensible Hypertext Markup Language - HTML expressed as well-formed XML, as Confluence’s storage format requires.

XML Metadata Interchange - the OMG standard for exchanging models and metamodels as XML.

Extensible Markup Language - a markup language for structured documents and data, nesting named elements carrying attributes.

YAML Ain’t Markup Language - a human-readable data-serialisation format, a superset of JSON, used chiefly for configuration files.