Glossary

Ack token — A server-attested, single-use credential required at the moment of checkout. See Ack tokens.

Bad-actor registry — The cross-customer, anonymized store of device fingerprints that have previously scored high enough to BLOCK. See Entity graph.

Completeness gate — The mathematical enforcement of the Golden Rule: a session with too little behavioral evidence has its probabilistic score component capped, regardless of what it would otherwise be. See The scoring engine.

Deterministic rule — A rule that's an identity fact (a UA string matches, or it doesn't) rather than a fuzzy behavioral read — passes through ML fusion at full value, ungated by completeness.

Entity graph — The per-customer graph linking devices to identities (user IDs, emails) across requests.

FORGE — The initial, per-session challenge: proof-of-work, ECDH key exchange, encrypted collection payload, signed session cookie. See How it works.

GHOST — A fast-path or late-override session state that forces BLOCK for the highest-confidence cases. See Session modes.

Golden Rule — Absence of a signal must never itself score as suspicious. See Why KaizoCore.

Impossible travel — A flag on two consecutive requests from the same identity implying a physically impossible travel speed. See Impossible travel.

MIRROR — A shadow-routing state for borderline-scoring traffic; the session gets a normal response but is also logged for review. See Session modes.

PULSE — The continuous, 4-second behavioral heartbeat sent for the life of a session. See PULSE.

Session token — The signed identifier the collector SDK generates, passed to /v1/decide to link a decision request to its session's accumulated evidence.

Stage A / B / C — The rollout weighting for how much ML fusion trusts its models relative to deterministic rules. Stage A (today) is deliberately rules-dominant.