Glossary

Access level - A named rung on the permission ladder: Viewer, Reader, Contributor, Editor, Manager, or FullControl. Each contains everything below it. A grant that does not match a rung exactly, or that carries any deny bits, is classified as Custom.

ACL entry - An access-control entry: one grant on a folder or document, naming a subject and its allow and deny masks.

ACL subject - Who an access-control entry names. One of four kinds: a user, a role, a department, or an organisation unit.

Allow mask / deny mask - The two bitmasks on an access-control entry. Deny always wins: effective permission is allow & ~deny. A single entry may not allow and deny the same bit.

Append-only - A table the running application may insert into but not update or delete, enforced by database grant rather than application logic. The audit log and workflow action history are append-only.

Blob - A stored file’s bytes, held in the content-addressed store under a path derived from its hash. Several documents may reference one blob.

Check-out - An exclusive lock on a document, preventing others from uploading a new version while it is held. Released by checking in or by discarding the check-out.

Content-addressed storage - Storing a file under a path derived from the SHA-256 hash of its contents. Identical content is stored once and referenced many times, which is why deleting a document does not immediately free disk space.

Content type - A definition of a kind of document and the typed metadata fields it carries. Every document has one; unclassified documents carry the seeded Unclassified type.

Cursor - An opaque, encoded position in a result set, used instead of a page number so that paging deep into a large set stays fast. Malformed cursors are rejected as validation errors.

Effective permissions - The final permission mask for one user on one resource, after combining every applicable subject’s masks, applying deny precedence, and layering any document override over the folder result. Materialised into tables rather than resolved per request.

Fallback mode - Search executing with a LIKE predicate because no full-text index is available. Correct, but not sargable, so it scans rather than seeking.

Folder policy - Rules attached to a folder that apply to its subtree: permitted content types, per-type size limits, a default content type, an approver workflow, or signing capability.

Instance - One document travelling through a workflow definition. Distinct from the definition, which is the reusable shape.

Numbering scheme - A pattern that produces formal document identifiers, with sequence values allocated server-side so two simultaneous requests cannot collide.

Permission bit - One of the eight capabilities that make up a mask: Preview, Download, Upload, EditMetadata, EditContent, Delete, ManagePermissions, ManageWorkflow.

Permission template - A reusable named combination of permissions, applied when creating an access-control entry.

Quarantine - The directory holding content that failed an antivirus scan, kept outside the normal blob store so nothing can serve it by accident.

Rendition - A generated derivative of a document: a preview image, a thumbnail, or a signed rendition combining the original with applied signatures.

Sargable - A predicate a database can satisfy with an index seek. A leading-wildcard LIKE is not sargable, which is why search fallback mode scans.

Schema ledger - dbo.DmsSchemaVersions, recording every applied deploy script with its SHA-256 checksum. Independent of Entity Framework’s own migration history.

Share link - A token granting access to a folder or document, with an expiry, an optional password, an optional use limit, and an access level that can never exceed the creator’s own.

Signing base - The persisted PDF form of a document used as the canvas for signature placement. Kept so that an Office conversion is not repeated for each signing session.

Soft delete - Removal that moves an item to the recycle bin rather than destroying it. It can be restored until retention purges it.

Step - A point in a workflow definition where someone must act. A step instance is one step within one running workflow instance.

Subject - See ACL subject.

Tamper-evidence - What signature verification provides: a recorded content hash is compared to detect change after signing. It is not a cryptographic digital signature and confers no non-repudiation.

Transition - A connection between workflow steps, specifying which outcome leads where.

Two-principal model - The deliberate separation between the database identity that deploys schema and the least-privilege identity the running application uses. Verified at startup.

Watermark - An overlay composited onto a generated preview. It applies to the preview, not to the stored file - a download returns the original bytes.

Workflow definition - The reusable shape of a process: steps, transitions, and assignees. Definitions are archived rather than deleted, so completed instances stay interpretable.