Skip to content
OpenDome

Glossary

One line per term. Where these docs and the OSL research paper use different words for the same thing, both are given, so you can read either with the other’s vocabulary.

Core objects

Section titled “Core objects”
Term One line
dome A tenant’s governed enclosure — the single policy boundary around all of that tenant’s data, structured and unstructured. The dome is the thing you own; the cell is its runtime.
cell The self-contained, per-tenant Kubernetes namespace that implements a dome: the lakehouse (Iceberg + Lance), the pipelines, the OSL engine and the policy enforcement point.
OSL The OpenDome Semantic Layer — the open (Apache-2.0) semantic-model spec and the sole consumption surface of a cell.
OSL-SQL The semantic SQL dialect of POST /osl/query — five bounded forms (structured, RETRIEVE, TRAVERSE, Joint record, cross-modal equijoin), lowered default-deny to a closed operator IR.
JointEntity The cross-plane bridge: a logical object whose primary key comes from a structured model and whose attributes draw from both planes.
facet (UnstructuredFacet) A governed Lance collection (chunks + embeddings + ACL) attached to the semantic model — the paper’s content facet.

Docs ↔ paper bridge

Section titled “Docs ↔ paper bridge”

The paper — E. Arranz, OSL: A Multimodal Semantic System with Governance by Compilation (2026, preprint — link forthcoming) — uses systems-research vocabulary for the same machinery these docs describe operationally:

These docs The paper Meaning
PDP — policy decision point policy compiler Composes every policy binding each principal, then compiles the chain’s result onto every physical read — SQL row/column rewriting, retrieval prefilters, redaction routing — before any data is touched.
PEP — policy enforcement point governed seams / governed backends The only code paths that reach a physical engine (Trino SQL, Lance retrieval, traversal, joint hydration); each applies the compiled policy and fails closed.
policy facts policy-compilation input The denormalized tuples (fqn, owner, sensitivity, pii, acl_source, cell_hints) that osl compile emits per governed object — what the PDP indexes.
MEET (chain composition) chain-meet Intersection across the delegation chain: a value is granted only if every link grants it, required redactions union, and an un-authored link collapses the meet to deny.
effective policy effective policy Φ The single compiled outcome of the chain-meet for one request — the object the leak-safety theorem quantifies over.
ActorToken v2 attested delegation chain The signed JWT whose payload is the chain (root → leaf); signature verification is what makes the chain attested rather than a trusted header.
audit chain one audit chain The immutable, hash-chained record of every decision — allowed or denied — emitted from the single decision point.
redaction version exact redaction-version selection A named, pre-materialized variant of a facet (separate Lance table, independently embedded); the engine serves the exact version the subject’s chain requires, or denies — never a fallback.
sealed key cleartext sealed-key equijoin The only cross-modal join: equality on a scalar, authoritative entity key, refused unless that key is granted cleartext under Φ.
Section titled “Related”