Glossary

Access level - A named rung on the permission ladder: Viewer, Reader, Contributor, Editor, Manager, or FullControl. Each contains everything below it. A grant that does not match a rung exactly, or that carries any deny bits, is classified as Custom.

ACL entry - An access-control entry: one grant on a folder or document, naming a subject and its allow and deny masks.

ACL subject - Who an access-control entry names. One of four kinds: a user, a role, a department, or an organisation unit.

Allow mask / deny mask - The two bitmasks on an access-control entry. Deny always wins: effective permission is allow & ~deny. A single entry may not allow and deny the same bit.

Append-only - A table the running application may insert into but not update or delete, enforced by database grant rather than application logic. The audit log and workflow action history are append-only.

Audit seal - A signed record covering a contiguous range of audit rows and chained to the seal before it. Verification recomputes seals to detect rows that were changed, removed or inserted.

Break-glass - An action authorised by the administrator override rather than an ordinary permission grant. Marked as such in the audit log.

Capability - A named administrative permission, such as audit read or retention configuration, granted to roles. Screens are gated by capability rather than by role name.

Check-out - An exclusive lock on a document, preventing others from uploading a new version while it is held. Released by checking in or by discarding the check-out.

Content address - A keyed value computed from a file’s content with an installation secret. It decides where the encrypted file is stored, so identical content is stored once, without the path revealing anything about the content.

Content host - An optional second hostname, served by the same application, from which documents are delivered through short-lived signed links and without the session cookie.

Data key - The key that encrypts one stored file. Kept in the database only in wrapped form, unwrapped with the Data Protection key ring.

Content type - A definition of a kind of document and the typed metadata fields it carries. Every document has one; unclassified documents carry the seeded Unclassified type.

Cursor - An opaque, encoded position in a result set, used instead of a page number so that paging deep into a large set stays fast. Malformed cursors are rejected as validation errors.

Erasure - Replacing a person’s identity with a pseudonym everywhere it is stored, while keeping business records such as documents and signatures.

Effective permissions - The final permission mask for one user on one resource, after combining every applicable subject’s masks, applying deny precedence, and layering any document override over the folder result. Materialised into tables rather than resolved per request.

Fallback mode - Search executing with a LIKE predicate because no full-text index is available. Correct, but not sargable, so it scans rather than seeking.

Folder policy - Rules attached to a folder that apply to its subtree: permitted content types, per-type size limits, a default content type, an approver workflow, or signing capability.

Invitation - An email link, sent when an administrator creates an account, with which the new user sets their own password.

Instance - One document travelling through a workflow definition. Distinct from the definition, which is the reusable shape.

Numbering scheme - A pattern that produces formal document identifiers, with sequence values allocated server-side so two simultaneous requests cannot collide.

Permission bit - One of the eight capabilities that make up a mask: Preview, Download, Upload, EditMetadata, EditContent, Delete, ManagePermissions, ManageWorkflow.

Permission template - A reusable named combination of permissions, applied when creating an access-control entry.

Network identifier - An IP address or browser user agent recorded on an event. Cleared automatically after the configured lifetime.

Quarantine - The directory holding content that failed an antivirus scan, kept encrypted and outside the normal content store so nothing can serve it by accident.

Redaction ledger - A signed record of each lawful change to an audit row made by retention or erasure, so verification can tell a redaction from tampering.

Rendition - A generated derivative of a document: a preview image, a thumbnail, or a signed rendition combining the original with applied signatures.

Sargable - A predicate a database can satisfy with an index seek. A leading-wildcard LIKE is not sargable, which is why search fallback mode scans.

Schema ledger - dbo.DmsSchemaVersions, recording every applied deploy script with its SHA-256 checksum. Independent of Entity Framework’s own migration history.

Share link - A token granting access to a folder or document, with an expiry, an optional password, an optional use limit, and an access level that can never exceed the creator’s own.

Signing requirement - A definition of who must sign a document - people or groups, in order or in any order, with an optional threshold - tracked across versions.

Signing base - The persisted PDF form of a document used as the canvas for signature placement. Kept so that an Office conversion is not repeated for each signing session.

Soft delete - Removal that moves an item to the recycle bin rather than destroying it. It can be restored until retention purges it.

Step - A point in a workflow definition where someone must act. A step instance is one step within one running workflow instance.

Subject - See ACL subject.

Tamper-evidence - Detecting a change after the fact, rather than preventing it. Audit seals make the audit log tamper-evident; signature verification detects a signed version being pointed at different content. Neither is a cryptographic digital signature conferring non-repudiation.

Transition - A connection between workflow steps, specifying which outcome leads where.

Two-principal model - The deliberate separation between the database identity that deploys schema and the least-privilege identity the running application uses. Verified at startup.

Watermark - An overlay composited onto a generated preview. It applies to the preview, not to the stored file - a download returns the original bytes.

Workflow definition - The reusable shape of a process: steps, transitions, and assignees. Definitions are archived rather than deleted, so completed instances stay interpretable.