ATCE glossary: every term in the section, defined

Short answer

This glossary defines every term a reader meets in the ATCE section. ATCE, the Adaptive Trust, Compliance and Execution Engine, is the part of the JIL Layer-1 that rules on an act before value moves. Each entry is one to three sentences, comes from the design documents and the code, and links to the page that explains the term in depth.

What do the terms mean?

Jump to a letter: A · B · C · D · E · F · G · H · I · J · L · P · R · S · T · V · W · Z

Agentic review

The review ATCE calls before its final ruling. It challenges the rules, because an act can satisfy every rule and still look wrong. It can deny or hold an act the rules passed and never releases an act the rules denied, and a person decides after a hold. Status, 2026-11-02: live on jil-mainnet-2, together with the attester and the reviewer bridge. Explained in: Agentic review.

Allow

The outcome that lets the act proceed. Its reason code is 0. On an allow the chain consumes the review, records the ruling and then executes the transfer. Explained in: The ruling.

Annex

The leaf of a sovereign site's tree. An annex sits under a hub, holds local allow rules and local limits, holds nothing under it, and does not open a corridor. The ruling design calls annexes Tier 2. Explained in: Two layers.

Arrival gate

The receiving cell's ATCE check on a value release that crosses a corridor. The sending cell enforces its departure policy before it signs the release; the arrival gate applies the receiving cell's pinned policy. A release with no ATCE context is refused. Explained in: Two layers.

ATCE

The Adaptive Trust, Compliance and Execution Engine, the part of the JIL Layer-1 that rules on an act before value moves. It is deterministic, runs in consensus and returns a verdict, a reason code and a SHA-256 commitment. ATCE is patent pending. Explained in: ATCE hub, What is ATCE.

Attestation

A signed statement of fact about an account, such as its identity level, that ATCE reads instead of trusting what the sender claims. A ruling with no usable attestation on either party is denied with reason code 8, missing attestation. Explained in: Identity and attestation.

Attester

The off-chain service that reads the latest KYC and KYB result for an account and signs the on-chain identity record. It signs the lowest level the evidence supports and never rounds up. Status, 2026-11-02: live; without an attested identity record an act is denied (reason code 8). Explained in: Identity and attestation.

Built, not deployed

A status marker. The code is written and merged, and it does not run in production. On this site it applies to the record writer. Explained in: Status ledger.

ConfigureAtce

The chain message that pins the attester key, the reviewer key, the site profile, per-asset limits and the enforcement switch. Only the reserved ATCE system account, jil1atce, may send it. Explained in: Policy and activation.

Consensus halt on divergence

The fault rule of the live chain: 100 percent of responding validators must agree, and the chain halts if they diverge. All validators are operated by JIL, so the rule bounds accident and partial compromise. It is not Byzantine fault tolerance against the operator. Explained in: Refusals and failure modes, Verification.

Context

The facts ATCE judges an act on: identity level, whether an attestation exists, origin and destination jurisdiction, amount, risk score and sanctions flag. In the ruling design the chain builds the context from attested identity records, and a context a holder puts in a transaction is ignored. Explained in: The ruling.

Corridor

The bilateral, ruled link between two sovereign sites. It is the second layer of ATCE; the first layer runs inside a site. A corridor credential stays on the Tier 1 root, and hubs and annexes do not open corridors. Explained in: Two layers, The Corridor Journal.

Corridor journal

The designed full listing of a corridor hop: the policy text, the transaction, who bought and who sold, the source of funds and each party's ATCE accreditation. Status, 2026-11-02: designed; a release does not yet write it. Explained in: The record, The Corridor Journal.

Corridor profile

The policy a cell pins for corridor arrival. It is the packed policy word of scalar gates plus an allowed-jurisdiction list that is exactly the two corridor endpoints. The built arrival gate runs ATCE only when this profile is pinned. Explained in: Policy and activation.

Crypto-shredding

The way a WORM record is erased under a legal erasure order: the per-record data key is destroyed, and the locked object, its digests and the on-chain commitment remain. The body can no longer be read or recomputed. Explained in: The record.

Currency Object

A native managed instrument on the Digital Currency Platform, with an issuer, reserves and a rulebook. Every transfer of a Currency Object goes through the same ATCE evaluation. Explained in: Limits and currencies.

Demonstration

A status marker. The item exists to show a mechanism, such as a cell demo or a worked example, and is not connected to production or to a live rail. Explained in: Status ledger.

Deny

The outcome that refuses the act. The transaction reverts, gas is still charged, and the rejection log carries the reason code and the commitment. Explained in: The ruling, Refusals and failure modes.

Designed

A status marker. The mechanism is written in a design document and is not built, or exists only as a demonstration. It applies to the production record store and its retention, the InterOp multi-hop router and negotiated per-hop rates. Explained in: Status ledger.

Determinism

The property that every validator re-runs the same evaluation over the same inputs and reaches the same answer. Consensus calls no network service and reads no clock; the agentic review enters as a signed, recorded result. Explained in: Verification.

Digital Currency Platform

The JIL platform that issues digital currencies as Currency Objects. It is one of two callers of the ATCE evaluation; the other is the corridor arrival gate. Explained in: Limits and currencies.

Enforcement switch

The one-way chain-state marker that makes rulings mandatory. ConfigureAtce sets it, and it is refused until the attester, the reviewer and the site profile are pinned and every activation account holds a usable identity record. Status, 2026-11-02: on for every transfer on jil-mainnet-2. Explained in: Policy and activation, Status ledger.

Exempt flow

A protocol payment whose sender is jil1staking, jil1gov or jil1ibcescrow. It is still ruled as exempt, with a recorded reason and its own hash. The genesis allocation accounts are not exempt. Explained in: Policy and activation.

Expiry

The block height at which an identity record stops counting. A record that is missing, revoked or expired at the current height has no attestation, and the ruling denies the act. Explained in: Identity and attestation.

Fail-closed

The default that a missing input is a denial. A missing record, review, pinned profile or anchor denies; a per-act limit of 0 permits no transfer; an empty jurisdiction list denies everything. Explained in: Refusals and failure modes.

Financial DNA

The name for the rules that travel with a Currency Object and are evaluated on every transfer: identity, jurisdiction, limits and a live risk score. ATCE is the evaluation behind it. Explained in: Limits and currencies.

Freeze

An account-level restriction. A freeze on either the sender or the recipient denies the act, in both directions, with reason code 12. Explained in: The ruling, Limits and currencies.

Gated garden

The description of a sovereign site: anything that leaves the site goes through ATCE and a corridor. ATCE also runs inside the site. Explained in: Two layers.

Hold

A deny that waits for a person. ATCE has only two outcomes, allow and deny; public copy calls a deny a hold when the review denied the act (reason code 10) or no review result exists (reason code 9). A hold never becomes an allow by itself, and a person decides what follows. Explained in: Agentic review, The ruling.

Hop

One ruled step: a corridor hop between two sites, or a rail leg from a site out to an external rail. Each hop gets its own ruling and its own reference hash. Explained in: Two layers.

Hub

The middle tier of a sovereign site's tree. A hub sits under one Tier 1 root, holds hub rules and holds annexes. It does not open a corridor, and a hub under a hub is rejected. Explained in: Two layers.

Identity level

A number from 0 to 4: none, basic, KYC, KYB, institutional. The site profile sets the level a counterparty must hold, and for a transfer between two accounts the ruling uses the lower of the two levels. Explained in: Identity and attestation.

Identity record

The on-chain record an attester signs for one account: level, risk from 0 to 100, sanctions flag, a three-letter jurisdiction code, an expiry height and a version that must increase. Personal data is not in it. Explained in: Identity and attestation.

InterOp

The built-in service on the corridor that holds a site's rail and asset connectors as rules. The router that would find an allowed multi-hop path through it is designed, not built. Explained in: Limits and currencies, Status ledger.

JIL ACL

The Attested Consensus Layer, the JIL consensus layer. It answers ordering and admissibility in one pass, so agreement on a block includes the attested verdict on each act in it. Explained in: ATCE hub, Verification.

jil-mainnet-2

The live JIL chain, with genesis on 2026-08-21 and ten validators, all operated by JIL Sovereign Technologies, Inc. on one hosting provider. ATCE enforcement is on for every transfer on it. Explained in: Status ledger.

Legal hold

A flag on a WORM record that stops its erasure. A held record cannot be erased, and expiry of the retention term does not delete the on-chain commitment. Explained in: The record.

Live

A status marker. The mechanism runs in production on jil-mainnet-2 as of 2026-11-02. It applies to ATCE enforcement of every transfer, inside a sovereign site and between sites, and to the attester, the reviewer bridge and the agentic review. Explained in: Status ledger.

Patent pending

The filing status of ATCE. The claims are filed as provisional applications and nothing is granted. Trademarks are filed, not registered. Explained in: Status ledger.

Path record

In the InterOp design, the parent record that lists the reference hash of every hop on a multi-hop path and has a hash of its own. Status, 2026-11-02: designed. Explained in: Limits and currencies.

Per-asset limit

An override of the default per-act limit for one named asset. It replaces the default in both directions, and a limit of 0 permits no transfer of that asset. A reason code 4 denial means the amount is over the limit that applied. Explained in: Limits and currencies.

Pinning

Writing a key, a policy word or a profile into chain state so the chain uses it. An unpinned rule set does not move value, and enforcement cannot turn on until the attester key, reviewer key and site profile are pinned. Explained in: Policy and activation.

Policy word

A 32-byte word pinned for a corridor or a currency. Byte 0 is the required identity level, byte 1 the risk deny threshold, byte 2 the flags and bytes 16 to 31 the default per-act limit. Today it packs scalar gates; the Corridor Journal paper designs it as a policy number looked up in a write-once table. Explained in: Policy and activation, The Corridor Journal.

Reason code

The append-only number that names why a ruling came out as it did. 0 allow, 1 identity below required, 2 origin blocked, 3 destination blocked, 4 amount over limit, 5 risk too high, 6 sanctions hit, 7 profile malformed, 8 missing attestation, 9 review missing, 10 review denied, 11 not configured, 12 account restricted, 13 zone mismatch. Explained in: The ruling, Refusals and failure modes.

Record writer

The off-chain WORM writer that files the full ATCE record under the ruling's commitment. It recomputes the commitment from the record and compares it with the chain, and a mismatch is an alarm. Status, 2026-11-02: built, merged, not running in production. Explained in: The record.

Reference hash

The unique SHA-256 hash of one ATCE transaction record. The chain stores it, and the WORM store addresses the full record by it, so the chain holds a hash and no personal data. Explained in: The ruling, The record.

Retention

The commitment to keep each ATCE record for 20 years or more. Storage for the record is allocated for each site when its license is signed. Status, 2026-11-02: the commitment stands; the production store is designed. Explained in: The record.

Reviewer bridge

The off-chain service that asks the agentic review about one specific act and signs the answer in the shape the chain records. Clear signs an allow, held signs a deny, and any other answer signs nothing, so the act has no review result and is denied (reason code 9). Status, 2026-11-02: live. Explained in: Agentic review.

Review hash

The SHA-256 hash of the review artifact. It is carried in the review transaction and the ruling event, and it is part of what the commitment binds. Explained in: Agentic review.

Rules are the deterministic base

The deterministic checks (profile, attestation, identity level, sanctions, risk, jurisdictions, amount) run first, in a fixed order, and decide every act on their own. The agentic review sits on top of them and can deny or hold an act the rules passed; it cannot turn a denial into an allow. Explained in: Agentic review, The ruling.

Rule set

One party's layer of rules that ATCE retrieves on a hop. The buyer brings the Tier 1, hub and annex sets, the seller brings the same three, and a stablecoin adds a Shared Resource set. A missing, refused or unpinned set does not move value. Explained in: Policy and activation, Two layers.

Ruling

ATCE's decision on one act: a verdict (allow or deny), a reason code and a commitment, recorded on the chain before the act executes. The rule is that no transfer moves value outside an ATCE ruling. Explained in: The ruling.

SHA-256 commitment

The single hash that binds the profile, the context, both parties' state, the review and the reason code. Anyone holding the inputs can recompute it and compare. Explained in: The ruling, Verification.

Shared Resource

The ATCE rules for one stablecoin, stood up once and used by many sovereigns. It has no hubs or annexes of its own, and it is not a live connection to any outside network. Explained in: Limits and currencies, The Corridor Journal.

Site profile

The on-chain policy of a sovereign site: required identity level, default per-act limit, risk threshold, sanctions flag, allowed jurisdictions and per-asset overrides. The site operator sets it; JIL does not author it. Explained in: Policy and activation.

Sovereign site

A sovereign cell with its own token and its own ATCE profile, built as a Tier 1 root with hubs and annexes beneath it. It is a gated garden. Explained in: Two layers.

Sovereign site go-live

A site goes live when its own policies are written and pinned. ATCE then enforces them from that site's first transfer. Explained in: Policy and activation, Two layers.

Subject

The unique identity of one act, a SHA-256 over the chain, the kind of act, sender, recipient, asset, amount and sequence. The chain refuses to rule on the same subject twice. Explained in: The ruling.

Tier 1 root

The sovereign at the top of a site's tree. It holds the corridor credential and the sovereign rules, and it can hold hubs and annexes. Explained in: Two layers.

Tier 2 annex

The ruling design's name for an annex, the leaf under a hub. See Annex. Explained in: Two layers.

Tier 2 currency site

In the Corridor Journal paper, a Shared Resource: one stablecoin with no hubs or annexes. The sources use Tier 2 for both this and the annex, so read the context. Explained in: The Corridor Journal, Limits and currencies.

Verdict

The result of the evaluation: allow or deny, with a reason code and a 32-byte record hash. There is no third outcome in the code. The verdict becomes part of the application state hash. Explained in: The ruling.

WORM

Write once, read many. A WORM record cannot be altered or deleted before its retention date. JIL commits to keep ATCE records for 20 years or more in a JIL-local object-lock store, not on the chain; storage is allocated for each site when its license is signed, and the production store is designed. Explained in: The record.

Zone

An account-level label. Value moves only if sender and recipient are in the same zone, and an unzoned account is in zone none. A mismatch denies with reason code 13. Explained in: The ruling, Limits and currencies.

Questions about the glossary