A project glossary mixes authority document and citation as if they were the same object. What is the correct IRM distinction?

An authority document is the source mandate—such as a regulation, standard, or internal directive—while a citation is a discrete requirement drawn from that source. Project glossaries that mix the two break the Policy and Compliance content hierarchy: the bookshelf is not the same object as one shall-statement on a shelf. Citations then map toward control objectives and controls so civic obligations become testable on entities rather than remaining as unread PDFs. Getting the hierarchy right prevents teams from tagging an entire regulation as if it were a single atomic requirement. Reversing the terms—citation as the full regulation PDF and authority document as one bullet—scrambles mapping work and reporting. Claiming authority documents exist only in SIR and citations only in SAM parks mandate content in the wrong products. Calling citations entity types and authority documents risk scores invents category errors across the framework. Exam caveat: overview terminology items frequently test authority document versus citation sequencing before control mapping. Operational check for the glossary team: import or create one authority document for a state privacy law, add at least two citations as distinct requirements, and verify each citation can map to a control objective rather than treating the whole PDF as a single citation.