Glossary

Every term this documentation uses, with the canonical page that defines it. Each definition lives in exactly one place and is linked from everywhere else.

Currentengine 9.0.0Verified 2026-08-30

Each term is defined once, on its own page. Everything else links here rather than restating it.

A to C

Term	Definition
Account metadata	Which account was assessed, and its organisation context
Artifact separation	Deliverable, evidence and snapshot uploaded separately
Assessment run	One execution of the pipeline against one account
Assessment snapshot	The fingerprinted record used for the next comparison
Attributable session name	How your CloudTrail tells one engagement's access from another
Board attention items	What the pack raises for directors, derived not curated
Board decision lens	Where governance attention converts into risk reduction
Board pack	The deliverable
Board pack structure	The order of the pack, and why
CloudFormation authorization	How the access grant is presented
Closure evidence	What would demonstrate a finding is closed
Comparability gating	When a comparison is withheld, and why
Comparison and movement	What changed since the previous assessment
Complete control index	Every failed control, at every severity
Confidence gate	The rule that withholds a rating below High confidence
Control	A single governance check
Control checks	The scanner's results, and why both outcomes are needed
Control evidence format	The record format control results arrive in
Control identifier	The scanner's stable name for a check
Control pass rate	The proportion that passed, weighted by severity
Control population	How many distinct controls were evaluated
Control severity	The scanner's judgement of a check in the abstract
Control vs finding	The distinction the whole methodology rests on
Cost telemetry	Spend and evidenced waste, from your own billing
Coverage ratio	The resilience unit of measure

D to M

Term	Definition
Data-plane deny	The denials that override every permission
Delivery repository evidence	Optional, collected, and not scored
Determinism and pinning	Why every score-affecting input is pinned
Domain weighting	How the three scored domains combine
Engagement	One customer, one account, one lifecycle
Evidence capture state	The eight states a collector can end in
Evidence collector	One script reading one class of evidence
Evidence confidence	How many governance domains were scored
Evidence manifest	What every collector actually did
Evidence retention	How long each artefact survives
Executive summary	The opening statement of position
Exposure banding and provenance	Where the bands come from, and what they are not
Exposure range	An indicative magnitude, not a loss estimate
Failed control	A control evaluated and not satisfied
Failing resource	A specific resource a control failed on
Finding lifecycle	The five states between two assessments
First action	The single next step for a failed control
GitHub OIDC federation	Short-lived credentials with no stored secret
Governance assessment	The category this product belongs to
Governance domain	An area scored independently, then weighted
Governance implication	What a failed control means, from the mapping
Indeterminate record	A result that cannot be classified either way
Materiality	How far a failure reaches in this account
Materiality band	Estate-wide, broad, contained, not determinable
Materiality rules M0 to M6	The seven rules that assign a band
Methodology page	The page that makes the score checkable

N to Z

Term	Definition
90-day action matrix	What management should do next
No silent renormalisation	Why a missing domain withholds the overall score
OIDC subject and audience	The two claims your trust policy pins
Offering	The product an engagement is recorded against
Overall RAG floor	Why the overall band cannot beat security
Overall score	The weighted mean of the three domains
Population minimums	The floors below which no rating is issued
Preventive vs detective	Whether a control stops or notices
Private link delivery	How a pack reaches you without being public
RAG band	Red, amber, green, and what constrains them
Read-only assurance	Observation without alteration, enforced by IAM
Reassessment	Running it again, and the comparison window
Resilience posture	Five coverage ratios, and what is not observed
Resource identity and fingerprinting	Named for action, fingerprinted for comparison
Resource reach	How much of an account a failure touches
Risk level	The words used in place of a colour
Risk register row	One line of the register a board reads
Scan scope	The account and regions actually covered
Scanner	The external tool producing control results
Scanner contract	The pinned version and severity scope
Scope and reproducibility page	What it would take to reproduce the result
Scoring fingerprint	Which constants a result was produced under
Security Hub posture	Whether the account observes its own security
Severity vs materiality	Two measures that are routinely conflated
The assessment IAM role	The single role created in your account
Unclassified control	Reported in full, and given no interpretation
Waste ratio	The cost unit of measure
Weighted pass rate	The security domain calculation