Questions, answered without naming who asked

An FAQ is a list of questions somebody wished they had been asked. Questions↗ is the other thing: questions put to us by people outside this company, in public, reproduced as they were meant rather than as a prompt for a pitch. In the More menu.

The standing rule is that we never name the asker. Every question is paraphrased and dated, and the person who asked it is not identified — they asked in a conversation, not for a marketing page, and the answer is useful without the name attached. Nothing in this release names anybody.

And where the answer is that we do not do the thing, that is the first line. Not a caveat at the bottom, not a redirect to something adjacent that we do. Both answers currently on the page contain a no, and in both cases it is in a red panel near the top.

Q01 — what happens when one authority path is revoked and another survives? We do not model revocation as removing an edge. The recorded object is the authorisation closure — the union of everything reachable, not the nominal grant. So revoking one relationship while another survives gives the deliberately unflattering result: the nominal grant shrinks and the closure does not move, and that non-movement is what gets recorded. The worked example is the commit author, where revoking somebody's keys changes nothing while a contents-write token can still set author through the API. The no: nothing we produce intervenes before the action commits. In that example the only thing that does is a branch rule requiring signed commits, server-side, at push.

Q02 — once everyone shares the vocabulary, what is actually enforced? The premise is right and is not conceded reluctantly: vocabulary stops being a differentiator the moment it is adopted, which is the outcome we want. The page answers all five sub-questions directly, and then runs the test as it was set — three stress cases where the behaviour diverges rather than the terms: revoke one authority path while another survives; change the model router on a Tuesday afternoon; add a policy layer. A nominal-grant model shows an improvement where closure shows none; a model counting the vendor refusal layer as a control holds its score where the pessimistic minimum drops; and additive union can only widen where intersection with terminal denial can only narrow. The first of those is runnable against any repository with two authority paths to the same capability, which is most of them.

Two of those answers are true about us and not yet adopted by us, and the page says so rather than leaving it in the Lab: this site is maintained through an agent holding a contents-write path to its own repository with no signed-commits rule, and the machine that publishes it has a raw outbound socket to arbitrary public addresses with no allow list in either egress path.

Still open: a convention for screenshots. Our own demos are fine; anybody else's product runs into the no-probing and no-verdicts rules, so the Lab's drawn mockups remain the pattern until that is decided. Recorded as owed on the brief register↗, which now carries six documents and five instructions.