Data model

    Mailbox identity, plan, and receipt boundary

    A human alias resolves to one immutable account and live provider identity; all reversible mutation evidence remains bound to that identity from preview through rollback.

    Multi Mailbox Ops

    Data model diagram

    Relationships

    A readable index of the 12 connections shown in the visual model above.

    1

    Operator names mailbox and job

    Connects to Immutable mailbox registry

    2

    Immutable mailbox registry

    Connects to Live provider-profile attestation

    3

    Live provider-profile attestation

    Connects to Discover and classify

    4

    Discover and classify

    Connects to Frozen exact-ID plan and preconditions

    5

    Frozen exact-ID plan and preconditions

    Connects to Bounded authority valid?

    6

    Bounded authority valid?

    No or drift: Fail closed with no mutation

    7

    Bounded authority valid?

    Yes: Re-attest identity and revalidate targets

    8

    Re-attest identity and revalidate targets

    Connects to Persist pre-mutation intent

    9

    Persist pre-mutation intent

    Connects to Execute allowed reversible action

    10

    Execute allowed reversible action

    Connects to Provider readback

    11

    Provider readback

    Connects to Redacted receipt

    12

    Redacted receipt

    Connects to Exact rollback state

    Model details

    Dates

    Added
    Aug 9, 2026
    Work date
    Date unknown
    Page edited
    Not recorded

    Entities

    operator requestmailbox registryprovider profilefrozen planauthorityoperation intentprovider readbackreceiptrollback

    Source

    DOCS/development/mailbox-safety-and-approval-model.md

    Open source