Caller supplied it, the dimension trusts callers, and it passed grammar validation.
The engine derived it (an approved expansion query); no caller input was used.
Nobody supplied it; the declaration's defaultValue filled in.
The caller supplied a value for a ServerDerived dimension and it was thrown away.
The caller narrowed within a server-derived bound and the meet survived.
Declared but unresolved — not supplied, not derivable, not required.
Produced by an ordered advisory rule (§5.12 supersession) rather than by a caller or a query.
Where a resolved dimension's value actually came from.
This is the audit answer to "who decided this?", and it is the difference between a bound that carries an access decision and one that merely looks like it does.
CallerSuppliedmeans an outside party — possibly an LLM writing a tool call — chose the value; that is fine for a search refinement and unacceptable for an access bound.ServerDerivedmeans the engine computed it and no caller could influence it.DiscardedCallerrecords an attempt that was thrown away, which is exactly the event a security review wants to find.