Attributes
Overview
Keymate's attribute model separates schema, ownership, stored values, applicability policy, effective resolution, and token release. These concepts are related, but none is a synonym for another. Product pages use the following canonical views:
| View | Meaning |
|---|---|
| Direct Values | Stored value records for one explicit owner. No inheritance is implied. |
| Defaults and Policies | Definition defaults and applicability rules that may contribute to resolution. They are inputs, not an effective result. |
| Effective Values | A server-resolved result for a verified context, including provenance, applied rules and conflicts. |
The current public /attributes/facts operation is a direct, single-owner read. It is not the
Effective Values contract described above. The verified effective and diagnostic surface is
BLOCKED while KEOPS #80
and its related delivery work remain open. See
Attribute Capability Status.
When to Read This Section
Read this section before defining an attribute, building an administration screen, resolving values, or projecting an attribute into a token.
Who Should Start Here
- Analysts defining canonical product language
- Architects and developers integrating Attribute owner contracts
- Operators and security reviewers evaluating capability evidence
Key Topics
Attribute Definitions
Use stable definition identity and semantic keys to govern attribute schemas.
Subject and Governance Scope
Distinguish the entity an attribute describes from the realm-bound scope that governs it.
Direct and Effective Values
Separate stored owner values from server-resolved results for verified contexts.
Bindings and Applicability
Understand how selectors, precedence, overrides, and editability contribute to resolution.
Provenance and Conflicts
Use ordered server evidence instead of inferring a winning value in the browser.
Sensitivity and Data Handling
Separate evidenced attribute controls from broader security and compliance requirements.
Capability Status
Check which attribute capabilities are delivered, blocked, or awaiting integration evidence.
When no binding applies, behavior is direct-only/no-inheritance. A definition default does not by itself prove that a value has been inherited or released to a token.
Representative Journeys
- I want to model a governed attribute → Attribute Definition Model
- I want to distinguish stored and resolved values → Attribute Values and Resolution
- I want to evaluate token release → Identity Attributes and Claims
- I want to verify delivery state → Attribute Capability Status
- I want to operate or diagnose the capability → Attribute Capability Verification
Recommended Reading Order
- Attribute Definition Model
- Attribute Values and Resolution
- Sensitivity and Data Handling
- Attribute Capability Status