## Questions, answered without naming who asked

An FAQ is a list of questions somebody wished they had been asked. **[Questions](questions.html)**
is the other thing: questions put to us by people outside this company, in public, reproduced as
they were meant rather than as a prompt for a pitch. In the *More* menu.

**The standing rule is that we never name the asker.** Every question is paraphrased and dated,
and the person who asked it is not identified — they asked in a conversation, not for a marketing
page, and the answer is useful without the name attached. Nothing in this release names anybody.

**And where the answer is that we do not do the thing, that is the first line.** Not a caveat at
the bottom, not a redirect to something adjacent that we do. Both answers currently on the page
contain a *no*, and in both cases it is in a red panel near the top.

**Q01 — what happens when one authority path is revoked and another survives?** We do not model
revocation as removing an edge. The recorded object is the *authorisation closure* — the union of
everything reachable, not the nominal grant. So revoking one relationship while another survives
gives the deliberately unflattering result: the nominal grant shrinks and the closure does not
move, and that non-movement is what gets recorded. The worked example is the commit author, where
revoking somebody's keys changes nothing while a contents-write token can still set `author`
through the API. The no: nothing we produce intervenes before the action commits. In that example
the only thing that does is a branch rule requiring signed commits, server-side, at push.

**Q02 — once everyone shares the vocabulary, what is actually enforced?** The premise is right and
is not conceded reluctantly: vocabulary stops being a differentiator the moment it is adopted,
which is the outcome we want. The page answers all five sub-questions directly, and then runs the
test as it was set — three stress cases where the *behaviour* diverges rather than the terms:
revoke one authority path while another survives; change the model router on a Tuesday afternoon;
add a policy layer. A nominal-grant model shows an improvement where closure shows none; a model
counting the vendor refusal layer as a control holds its score where the pessimistic minimum
drops; and additive union can only widen where intersection with terminal denial can only narrow.
The first of those is runnable against any repository with two authority paths to the same
capability, which is most of them.

**Two of those answers are true about us and not yet adopted by us**, and the page says so rather
than leaving it in the Lab: this site is maintained through an agent holding a contents-write path
to its own repository with no signed-commits rule, and the machine that publishes it has a raw
outbound socket to arbitrary public addresses with no allow list in either egress path.

**Still open**: a convention for screenshots. Our own demos are fine; anybody else's product runs
into the no-probing and no-verdicts rules, so the Lab's drawn mockups remain the pattern until
that is decided. Recorded as owed on [the brief register](briefs.html), which now carries six
documents and five instructions.