a rule set that decides, from NAMES alone, which keys may sign which data - turning authorization into a mechanical check on name relationships instead of a human judgment call.
The rule at work: the walk, the fences, and the gate.
Hand-authored SVG for this glossary, 2026. Fences per trust.rs (depth 16, steps 4096); freshness window per revoke.rs.
Etymology and backstory
the concept crystallized in the NDN project's 2015 paper "Schematizing Trust in Named Data Networking" (Yu, Afanasyev, Clark, claffy, Jacobson, Zhang): since NDN names both data and keys hierarchically, you can write schemas like "a key named /univ/alice may sign data under /univ/alice/blog" and let the verifier walk the rules. The insight is that naming discipline IS an access policy, checkable offline by anyone.
Ecosystem
NDN applications, the LVS language (next entry) as its modern form; spiritually related to X.509 name constraints (a rarely-used extension doing a weaker version of the same thing) and to capability path restrictions in systems like UCAN.
In codexproof
the V1 rule, implemented in trust.rs - a node authorizes only if its signature verifies, its signer's certificate chain terminates at a consumer anchor, and both the data name and every signer name nest under the anchor's namespace. The schema predicate is existential (one valid nesting chain suffices, line 141), the walk is fenced (MAX_CHAIN_DEPTH 16, MAX_WALK_STEPS 4096), and the paper presents the fixed nesting rule as implemented with declarative LVS-style rules named as the generalization - the honest-scope decision.