Glossary.

The registered agent and its operator answer one of the six questions every action needs. An identifier lets a service recognise the actor and hold the operator responsible; it says nothing about what the citizen has allowed. Authority comes only from a mandate, and the decision only from the service.

It is the authority acting automatically, which is a different thing from a citizen’s agent expressing the citizen’s intent as a representative. Discretionary decisions still need a specific act, the person keeps the right to personal contact and to be heard, and an automated act must say that it was issued automatically and explain its decision principles. The amendment at Riigi Teataja; this gloss is unofficial.

The service, not the agent, renders the authoritative details through a trusted channel; agent-generated text cannot substitute for them. A changed payload invalidates the approval, and the approval is consumed once and rechecked at commit. Whether an action needs ordinary authentication, explicit approval or a qualified electronic signature is a legal and service-policy question, decided per action by the service owner.

The mandate fixes the maximum. A request that asks for more delegation than the mandate allows is denied before the action is considered further; the evaluator on this site reports that check as AUTHORITY_DELEGATION.

Token exchange can produce a new token from evidence, but the standard does not attenuate authority or link parent and child revocation. Narrowing every child grant is a rule the implementation must enforce.

A government service cannot outsource its final authorization decision to the citizen’s agent, to a model gateway or to a national registry. The decision combines verified evidence with current ownership, eligibility, workflow state, cumulative limits and policy. Stronger authentication cannot repair missing authority; a new or expanded mandate is a separate process.

The key is bound to principal, mandate, action and payload digest. If a command times out after dispatch and its result is uncertain, the system reconciles the original operation rather than issuing a second one blindly.

The mandate record is owned by the mandate issuer or registry and lives as long as the use case needs; a tax-declaration mandate that legitimately spans a month is not a bug. “Minutes, not months” applies to the execution tokens derived from it, never to the mandate itself. Revoking a mandate must invalidate every dependent grant within a declared bound.

It carries only the claims a service needs and points at a status list the verifier can check. It is bounded and longer-lived than a token, but it remains evidence about authority, not authority: the receiving service decides.

Rich authorization requests carry structured details and token exchange represents actor relationships, but neither guarantees that derived authority only narrows. The rule belongs to the architecture, and the service rejects any derived grant that widens.

The authorization outcome and the command execution result are different layers: a replayed, already-committed request may be permitted while nothing executes again. The evaluator on this site returns exactly these three words and a list of reasons.

A presentation reveals the required facts and proves control of the holder key for this transaction only. Setting an audience cannot create service authority, and a matching string supplied by the agent is not a binding. A fresh presentation must never silently become an unlimited execution credential.

The service authenticates the principal with an accepted eID and, where someone acts for an organisation, checks the right of representation against an authoritative source and records when it was checked. Only a principal who can legally grant an authority can create a mandate for it.

The model proposes a structured action; trusted code validates it against a fixed schema and the active mandate. A non-exportable key is still a signing oracle if an attacker can invoke it without constraint, so the client reduces exposure while the public service remains the final enforcement boundary.

A receipt records the actor and authority chain, the decision basis and the committed result. The citizen’s data tracker retrieves receipts from services rather than becoming a second central log of payloads.

Revocation does not undo a completed transaction; it prevents future use once the verifier has accepted fresh status. Dependent service tokens and internal grants must be invalidated as well. A status snapshot older than the permitted signed age fails closed for protected writes, and fetching the same stale snapshot again does not make it fresh.

A service authorisation server issues it when repeated calls are needed, as the OAuth security best current practice recommends. It does not freeze the service’s business permission: enforcement, status freshness and resource state are checked again at every protected operation.

The agent cannot request what it was never granted; the service cannot be talked into more than its own policy allows; the citizen’s per-transaction and cumulative limits cap both. The evaluator names the bound that decided each result.

In the X-Road pattern the central server distributes membership and security-policy configuration while security servers mediate the actual requests. “Outside the data path” does not mean “never contacted”: issuance, periodic status distribution and exceptional identity resolution still touch the control plane. What the baseline forbids is a synchronous national lookup on every ordinary action.

A SPIFFE identity, for example, names a workload inside an operator’s trust domain and may be shared by replicas, so it is not a globally unique process identifier. Personal identifiers and mandates never belong in it. A valid mandate presented by the wrong workload must fail; a correctly attested workload without authority from the citizen must also fail.