Binding boundary
Candidate associations are not confirmed vulnerabilities and require target applicability validation.
Candidate contractResources RES-003
External security glossary
External security glossary turns the relevant external-security concept into a bounded, evidence-led decision. A useful security resource should make the next decision easier without flattening uncertainty or turning candidate evidence into a finding.
Bounded, non-exploitative Authorised external assessment.
Bounded evidence. Explicit responsibility. No hidden inference.
The useful answer
External security glossary turns the relevant external-security concept into a bounded, evidence-led decision.
External security glossary turns the relevant external-security concept into a bounded, evidence-led decision. External security glossary turns the relevant external-security concept into a bounded, evidence-led decision. A useful security resource should make the next decision easier without flattening uncertainty or turning candidate evidence into a finding.
Route-specific context
The decision this page is designed to support
- Intended reader
- Non-technical reader, practitioner
- Decision supported
- Understand product and protocol terminology. External security glossary turns the relevant external-security concept into a bounded, evidence-led decision.
- Evidence discipline
- Tenant isolation, delegated access, AAL2 controls and bounded signed downloads protect customer evidence. Evidence basis: Candidate contract.
01
02
03
A deliberate path
From permission to retained evidence
- 01
Start with the decision described by understand product and protocol terminology.
- 02
Apply the protocol, responsibility and evidence boundaries to the real target before changing a control.
- 03
Use a comparable reassessment or exact supporting record to verify the outcome rather than relying on the guide alone.
Evidence before assertion
What the product can support
This guide follows the same language as the product: observed facts, attribution, responsibility, uncertainty and closure evidence remain separate throughout. Tenant isolation, delegated access, AAL2 controls and bounded signed downloads protect customer evidence.
Binding boundary
Shared or provider-managed infrastructure is dependency context and is not automatically customer exposure.
Responsibility and attribution contractBinding boundary
Missing, stale, disputed or unavailable evidence cannot be treated as safety.
Capability reconciliation contractBinding boundary
The Overall Signals Grade covers governed externally assessable evidence, not the organisation's complete security or breach likelihood.
Grade policy v11Direct answers
Questions a careful reader should ask
What does External security glossary establish?
External security glossary turns the relevant external-security concept into a bounded, evidence-led decision. It establishes only what the governed evidence supports.
What does it not establish?
It does not prove complete organisational security, exploitability, breach likelihood or the absence of unobserved weaknesses.
How can I verify the conclusion?
Use the linked evidence or capability record to inspect source, observation time, target, responsibility and the condition required for closure.