Glossary

Activation — The strict definition of a qualified trial: two providers you own connected, a hundred intents, a webhook endpoint configured and a delivery received, a policy of your own, a second person invited, a savings report reviewed. Measured from events; never ticked by hand.

Approval request — The record behind dual control. Bound to exact content, single-use, expires in 24 hours.

Attempt — One hand-off of a payment to a provider. A payment intent owns all of its attempts.

Attestation — What the platform has verified about a seller, by whom, with what result. Your own submissions are recorded as PENDING, never as a verdict.

Beneficiary — A payout destination: masked account, tenant-keyed fingerprint, provider registration, name-match assessment. Never the account number.

Beneficiary change — A request to point a seller at a different destination. Cooling-off, out-of-band notices, dual control.

Candidate — A connection the routing engine considered. Every one is recorded, including those that failed a filter.

Case — A file about a subject: evidence, an action ledger, appeals.

Connection — One provider credential, validated, encrypted, bound to one environment and merchant account.

Cooling-off — The wait between requesting a beneficiary change and being able to approve it. 24 hours by default; 72 when the Gate holds it.

Demo pool — Pehmen's own sandbox accounts, referenced by credential-free pooled connections in a demo workspace.

Dual control — Two different people. The requester never approves.

Entitlement — The per-workspace grant that unlocks the Live environment. NONE for every workspace today.

Envelope (VCE) — A signed, versioned record created before payment and updated through fulfillment: who is paying whom, for what, under which protection terms. Verifiable against the public key endpoint.

Evidence tier — 1: source-authenticated system event. 2: signed platform event with replay protection. 3: buyer confirmation. Release policies require tier 2 or better for large payouts.

Fingerprint — Eight hex characters derived from a credential. Shown instead of the key.

Fulfillment event — Your signed statement that an order was fulfilled (or reversed). Evidence for payout release.

Gate — The decision engine. Six words, reason codes, versioned policies.

Hard filter — One of the nine yes-or-no checks a connection passes before it can be scored.

Health rank — 0 healthy, 1 impaired. Compared before score when routing.

Idempotency key — A header on every mutation that makes a retry safe.

Intent — See payment intent.

Merchant account — The routing scope inside a workspace and environment.

Name match — What the payout provider said about the account holder's name: EXACT, PARTIAL (provider-verified only), LOCAL_NORMALIZED, NONE, UNCHECKED.

Order — What is being bought.

Out-of-band notification — The email to the old and the new verified channel when a beneficiary change is requested.

Outcome unknown — The provider did not answer clearly. Query before anything else; no retry, no failover.

Payment intent — The decision to collect for an order. Owns attempts, route decisions and Gate decisions.

Payout instruction — An instruction to a licensed provider to send money. Approval and release are separate acts.

Policy — A versioned JSON rule set of type TRUST or ROUTING.

Published head — The policy version in force for a type.

Reason code — A word from the fixed registry that says why.

Replay — Running a draft policy over stored decisions to see what would change.

Route decision — The stored trace of a routing choice.

Seller — A party you pay.

Step-up — A second factor verified in the last five minutes.

Tombstone — Evidence whose bytes were destroyed; the record, hash and provenance remain.

Workspace — Your organization. Everything belongs to one.