masks-server 0.7.0 → 0.8.0

data/config/locales/en/flashes.yml

@@ -39,7 +39,7 @@ en:
     taken: "That %{provider} account is already connected to somebody else here."
 
   delegations:
-    unknown: "There is no such application using that account."
+    unknown: "There is no such app using that account."
     stopped: "%{client} can no longer use your %{provider} account."
 
   passkeys:
@@ -113,7 +113,7 @@ en:
     expired: "That sign-in stopped waiting. Ask for a new code on the other screen."
     too_many_attempts: "Too many attempts. Wait a few minutes and try again."
     approved: "Sign-in approved."
-    denied: "Sign-in denied."
+    denied: "Sign-in refused."
 
   passwords:
     too_many_attempts: "Too many attempts. Wait a few minutes and try again."
@@ -138,7 +138,7 @@ en:
     sent: "A confirmation link is on its way to %{email}."
 
   avatars:
-    updated: "Your photo has been updated."
+    updated: "Your photo has been changed."
     removed: "Your photo has been removed."
 
   handshakes:

data/config/locales/en/handshakes.yml

@@ -1,12 +1,32 @@
 en:
   handshakes:
     show:
-      page_title: "Register a new client"
-      page_title_again: "Replace an existing client"
-      title: "Register a new client?"
-      title_again: "Replace an existing client?"
-      lede_html: "Approving registers <strong>%{name}</strong> for everyone on %{tenant} and allows only your account."
-      lede_again_html: "Approving replaces <strong>%{name}</strong> for everyone on %{tenant} and allows only your account."
+      page_title: "Connect %{name}"
+      page_title_again: "Reconnect %{name}"
+      title: "Connect %{name} to %{tenant}?"
+      title_again: "Reconnect %{name}?"
+      runs_at: "Runs at"
+      lede_html: "People will be able to sign in to <strong>%{name}</strong> with their %{tenant} account. For now only you are allowed in, and you choose who else gets in later."
+      lede_again_html: "<strong>%{name}</strong> is already connected to %{tenant}. Reconnecting sets it up again. For now only you are allowed in, and you choose who else gets in later."
+      stops_working: "The current %{name} connection stops working."
+      connected_by_you: "You connected %{name} on %{date}."
+      connected_by: "%{who} connected %{name} on %{date}."
+      signed_in_as: "You are approving as"
+      unconfirmed: "(email not confirmed yet)"
+      check: "Look at these first"
+      heed:
+        offline_access: "%{name} can keep people signed in without asking again, until they sign out."
+        delegates_title: "Ask people to connect their other accounts"
+        delegates: "Each person chooses for themselves. %{name} can then use those accounts while they are away."
+        delegate: "%{name} can use that account while you are away, until you stop it."
+        manage: "Anyone who signs in through %{name} can change every setting on this server."
+      sees: "%{name} can see"
+      area: "%{name}'s own permissions"
+      area_says_html: "%{name} gets its own set of permissions, named %{namespaces}. You decide who gets them."
+      area_yours: " You get all of them now."
+      also: "%{name} can also"
+      details: "Technical details"
+      scopes: "Scopes"
       client: "Credentials"
       credentials:
         public: "Public. It holds no secret."
@@ -16,24 +36,23 @@ en:
       replaced: "The %{name} client %{who} approved on %{date}. Its current credentials stop working."
       you: "you"
       someone: "somebody"
-      may_ask: "May ask for"
       manage_warning: "masks:manage lets anyone who signs in through %{name} change every setting on this server."
       beneath:
-        one: "What that covers today (1)"
-        other: "What that covers today (%{count})"
+        one: "What they cover today (1)"
+        other: "What they cover today (%{count})"
       signs_in_at: "Signs in at"
       claims: "Claims"
       claimed: "%{namespaces} becomes %{name}'s, and you are granted it now."
-      details: "Additional details"
       origin: "From"
       redirect_uris: "Redirect URIs"
       returns: "Returns to"
       auth_method: "Authenticates with"
       backchannel: "Backchannel logout"
-      register: "Register and allow"
-      register_in: "Register and allow in %{seconds}"
-      replace: "Replace and allow"
-      replace_in: "Replace and allow in %{seconds}"
+      after_sign_out: "After sign-out, returns to"
+      connect: "Connect %{name}"
+      connect_in: "Connect %{name} in %{seconds}"
+      reconnect: "Reconnect %{name}"
+      reconnect_in: "Reconnect %{name} in %{seconds}"
       cancel: "Cancel"
 
     refused:

data/config/locales/en/logins.yml

@@ -226,7 +226,7 @@ en:
       invalid-backup-code: "That backup code is not valid."
       invalid-passkey: "That passkey could not be used."
       factor-not-offered: "That way of signing in is not offered here."
-      approval-denied: "That sign-in was denied from a trusted device."
+      approval-denied: "That sign-in was refused from a trusted device."
       passkey-expired: "That passkey attempt expired. Try again."
       passkey-unverified: "That passkey did not ask who you are. Use one that checks a PIN or fingerprint."
       passkey-unusable: "That passkey could not be added."
@@ -269,4 +269,4 @@ en:
     notices:
       reset-sent: "If that account exists, a reset link is on its way."
       organization-sign-in: "That organization asks you to sign in another way."
-      sso-claiming: "An account here already holds that address. Sign in to it once and the two are linked."
+      sso-claiming: "An account here already holds that address. Sign in to it once and the two are connected."

data/config/locales/en/manage/actor.yml

@@ -18,7 +18,7 @@ en:
       left_group: "Out of %{group}."
       joined_group: "In %{group}."
       profile_saved: "Profile saved."
-      scopes_updated: "Scopes updated."
+      scopes_updated: "Scopes changed."
       codes_generated: "Backup codes generated. They are shown once and never again."
       emailed: "Emailed. The link is not shown here, so that using it proves the address."
       no_mailer: "No mailer is configured, so pass this link along yourself. It works once."
@@ -27,11 +27,11 @@ en:
       confirm_question: "Send a confirmation link for this address? Any earlier one stops working."
       remove_passkey_question: "Remove the passkey “%{label}”?"
       passkey_removed: "Passkey removed."
-      photo_updated: "Photo updated."
+      photo_updated: "Photo changed."
       remove_photo_question: "Remove this actor's photo?"
       photo_removed: "Photo removed."
       disable_question: "Remove this actor's authenticator app and every backup code?"
-      authenticator_removed: "Authenticator removed."
+      authenticator_removed: "Authenticator app removed."
       factors:
         email:
           name: "Email codes"
@@ -44,11 +44,11 @@ en:
       suspend_question: "Suspend %{identifier}? They are signed out everywhere, every token they hold stops working, and they cannot sign in until they are restored."
       suspended: "Suspended."
       restored: "Restored. They can sign in again."
-      delete_question: "Delete %{identifier}? Their sessions, tokens, passkeys, consents and avatar go with them. There is no undo, and nothing is kept."
+      delete_question: "Delete %{identifier}? Their sessions, tokens, passkeys, consents, and photo go with them. There is no undo, and nothing is kept."
       missing: "There is no such actor."
       back: "Actors"
-      signed_in_lede: "Signed in %{when}."
-      invited_lede: "Invited, and has not accepted yet."
+      signed_in_lede: "signed in %{when}"
+      invited_lede: "invited, has not signed in yet"
       never: "never"
       link_once: "This link works once."
       write_down: "Write these down. They are not recoverable."
@@ -69,11 +69,10 @@ en:
       remove_photo: "Remove photo"
       uploading: "Uploading..."
       scopes: "Scopes"
-      access: "Access"
       suspended_on: "Suspended %{day}. They cannot sign in."
       restore: "Restore"
       provisioned_as: "Provisioned as"
-      provider_may_change: "The identity provider may change or suspend this actor too."
+      provider_may_change: "The directory that provisioned them may change or suspend them too."
       directory_provisioned: "%{organization}'s directory provisioned them as"
       directory_may_change: "and may change them too."
       reset_password: "Reset password"
@@ -106,20 +105,39 @@ en:
       groups: "Groups"
       no_groups: "No groups yet."
       add_group: "Add one"
-      group_labels: "Apps that ask for groups see %{labels}."
+      group_labels: "Clients that ask for groups see %{labels}."
       second_factor: "Second factor"
-      authenticator_enabled:
-        one: "Authenticator enabled. %{count} backup code remaining."
-        other: "Authenticator enabled. %{count} backup codes remaining."
       generate: "Generate backup codes"
       remove_authenticator: "Remove authenticator app"
-      password_only: "Password only — nothing enrolled."
+      password_only: "Password only. Nothing else is set up."
       factor_on: "%{name} on."
       turn_off: "Turn off %{name}"
       activity: "Activity"
       all_activity: "All activity"
       no_activity: "Nothing yet."
       danger: "Suspend or delete"
-      yourself: "This is you — another manager has to do it."
+      yourself: "This is you. Another manager has to do it."
       suspend: "Suspend %{identifier}"
       delete: "Delete %{identifier}"
+      parts:
+        label: "Actor"
+        profile: "Profile"
+        access: "Access"
+        sign_in: "Sign-in"
+        activity: "Activity"
+      scopes_lede: "The most any token for this actor can hold. Losing masks:manage takes effect at once."
+      groups_lede: "A client that asks for the groups scope receives these in a groups claim."
+      provisioned: "Provisioned"
+      consents_lede: "Clients this actor has allowed in, with the scopes each one was given."
+      connections_lede: "Accounts elsewhere this actor signs in with, through a provider."
+      password: "Password"
+      password_lede: "A reset sends a link. Every session and refresh token ends when it is used."
+      password_invited: "They have not accepted their invitation yet."
+      authenticator: "Authenticator app"
+      backup_codes:
+        one: "%{count} backup code left"
+        other: "%{count} backup codes left"
+      tokens_lede: "Access and refresh tokens issued to clients for this actor."
+      photo_lede: "Identicons and initials are drawn. An uploaded photo takes their place."
+      change_photo: "Change photo"
+      danger_lede: "Suspending signs them out everywhere and keeps everything for a restore. Deleting removes them for good."

data/config/locales/en/manage/actors.yml

@@ -1,9 +1,20 @@
 en:
   manage:
     actors:
+      marks:
+        manager: "Holds a manage scope"
+        second_factor:
+          one: "Uses an authenticator app, %{count} backup code left"
+          other: "Uses an authenticator app, %{count} backup codes left"
+        invited: "Invited, has not signed in yet"
+        unconfirmed: "Email not confirmed"
+        waiting: "Waiting for a manager's approval"
+        help: "Asked for help signing in"
+        suspended: "Suspended"
+        blocked: "A device is blocked"
       invite_many: "Invite many"
       invites:
-        title: "Invite many people"
+        title: "Invite many actors"
         lede: "Paste addresses separated by lines, spaces, or commas. Each new address gets an invitation."
         addresses: "Email addresses"
         groups: "Put them in"
@@ -13,7 +24,7 @@ en:
           other: "%{count} invited"
         outcomes:
           invited: "invited"
-          exists: "already has an account"
+          exists: "is already an actor"
           invalid: "is not an address masks can invite"
       title: "Actors"
       lenses:
@@ -25,8 +36,6 @@ en:
         suspended: "Suspended"
       columns:
         actor: "Actor"
-        scopes: "Scopes"
-        second_factor: "Second factor"
         signed_in_on: "Signed in on"
         last_seen: "Last seen"
       sessions:
@@ -47,15 +56,15 @@ en:
         minimum: "At least %{count} characters, and you will know it."
         scopes: "Scopes"
         adding: "Adding..."
-        create: "Create the account"
+        create: "Add actor"
         invite: "Send the invitation"
         cancel: "Cancel"
       created:
-        account: "Account created"
+        account: "Actor added"
         invitation: "Invitation sent"
         can_sign_in: "%{identifier} can sign in now."
         confirm_link: "This link confirms their address:"
-        emailed: "Emailed — accepting it proves the address."
+        emailed: "Emailed. Accepting it proves the address."
         pass_along: "Pass this link along yourself. It works once."
       empty:
         search: "No actor matches \"%{search}\"."
@@ -66,13 +75,5 @@ en:
         suspended: "Nobody is suspended."
         everyone: "Nobody can sign in yet. Add the first actor."
       no_email: "no email"
-      unconfirmed: "unconfirmed"
-      invited: "invited"
       last_seen: "Last seen %{when}"
       never: "never"
-      authenticator: "authenticator"
-      blocked: "blocked"
-      backup_codes:
-        one: "%{count} backup code"
-        other: "%{count} backup codes"
-      password: "password"

data/config/locales/en/manage/app.yml

@@ -2,8 +2,8 @@ en:
   manage:
     app:
       waiting:
-        one: "%{count} person is waiting on you"
-        other: "%{count} people are waiting on you"
+        one: "%{count} actor is waiting on you"
+        other: "%{count} actors are waiting on you"
       missing: "There is no page at this address."
       account: "Account"
       starting: "Starting"
@@ -19,6 +19,6 @@ en:
         clients: "Clients"
       limited:
         read: "You can read everything here and change nothing."
-        support: "You can help people with their accounts. Settings, keys, and other managers need an owner."
-        security: "You can change keys, apps, providers, and policies. People's accounts need support or an owner."
-        both: "You can change settings and help people. Other managers and tenant settings need an owner."
+        support: "You can help actors. Settings, keys, and other managers need an owner."
+        security: "You can change keys, clients, providers, and policies. Actors need support or an owner."
+        both: "You can change settings and help actors. Other managers and tenant settings need an owner."

data/config/locales/en/manage/client.yml

@@ -51,7 +51,7 @@ en:
         restored: "Restored."
         archived: "Archived."
         rotated: "A new secret was issued."
-        groups: "Who may sign in is updated."
+        groups: "Who may sign in is changed."
         unattended_on: "It can ask for a token of its own now, with client_credentials."
         unattended_off: "It can no longer ask for a token of its own."
         subject: "Saved. Everybody has a new identifier at this client."
@@ -62,7 +62,7 @@ en:
         attributes_default: "It is sent the usual attributes."
         signs_assertions: "It signs its own assertions now. Its secret no longer works."
         uses_secret: "It uses a secret now. Rotate one to hand it."
-        grants: "Grants updated."
+        grants: "Grants changed."
         entity_id: "Entity ID saved."
         certificate_saved: "Certificate saved."
         certificate_removed: "Certificate removed."
@@ -70,7 +70,7 @@ en:
         signed_read: "Unsigned requests are read."
         idp_initiated_on: "Actors can be signed into it from masks, without it asking."
         idp_initiated_off: "It is signed into only when it asks."
-        policy: "Policy updated."
+        policy: "Policy changed."
         par_on: "PAR required. Plain /authorize links are refused."
         par_off: "PAR optional."
         dpop_on: "Its access tokens are bound to its key. A token without a proof is refused."
@@ -81,11 +81,11 @@ en:
         access_default: "Access tokens last an hour."
         refresh_days: "Refresh tokens last %{days} days unused."
         refresh_default: "Refresh tokens last 30 days unused."
-        consent_days: "Each consent lasts %{days} days, then the person is asked again."
+        consent_days: "Each consent lasts %{days} days, then the actor is asked again."
         consent_default: "Consent lasts until revoked."
         jar_on: "Signed requests required. An unsigned /authorize or pushed request is refused."
         jar_off: "Signed requests optional."
-        scopes: "Scopes updated."
+        scopes: "Scopes changed."
         redirects: "Redirect URIs saved."
         post_logout: "Post-logout URIs saved."
         resources: "Resources saved."
@@ -95,7 +95,7 @@ en:
         declared: "Those declarations are not JSON."
         attributes: "Write one attribute = claim on each line."
       confirm:
-        subject: "Everybody gets a different identifier at this client. It will not recognise anybody it already knows. Change it?"
+        subject: "Everybody gets a different identifier at this client. It will not recognize anybody it already knows. Change it?"
         restore: "Restore this client? It can sign actors in again immediately."
         rotate: "Issue a new secret? The one in use stops working immediately."
         archive: "Archive this client? Nothing will be able to sign in with it."
@@ -106,7 +106,7 @@ en:
       registration:
         title: "Registration"
         name: "Name"
-        saml: "A SAML application. It is signed into with an assertion, not a token."
+        saml: "A SAML client. It is signed into with an assertion, not a token."
         public: "A public client. It authenticates with nothing, and proves itself with PKCE."
         authenticates: "Authenticates with"
         needs_keys: "Give it keys under Keys, and it switches to signing its own assertions."
@@ -128,7 +128,7 @@ en:
         requests_signed: "Refuse requests it did not sign"
         idp_initiated: "Let actors start from masks"
         slo_url: "Single logout URL"
-        slo_url_hint: "When an actor who signed in to it signs out of masks, masks posts a signed LogoutRequest here. The app's own LogoutRequests are answered here too, and must be signed with its certificate."
+        slo_url_hint: "When an actor who signed in to it signs out of masks, masks posts a signed LogoutRequest here. The client's own LogoutRequests are answered here too, and must be signed with its certificate."
       shown:
         title: "Shown to actors"
         unapproved: "Nobody sees its logo until it is approved: a client that registered itself could borrow anybody's."
@@ -157,7 +157,7 @@ en:
         jar: "Require signed request objects (JAR)"
       groups:
         title: "Who may sign in"
-        lede: "Everyone, or only people in the groups ticked here. An organization role written as key:role counts as a group."
+        lede: "Everyone, or only actors in the groups ticked here. An organization role written as key:role counts as a group."
         none: "No groups yet."
         add: "Add one"
         limit: "to limit who may sign in."

data/config/locales/en/manage/clients.yml

@@ -1,6 +1,10 @@
 en:
   manage:
     clients:
+      marks:
+        archived: "Archived"
+        dynamic: "Registered itself, not approved"
+        dynamic_approved: "Registered itself, then approved"
       title: "Clients"
       archived: "Archived"
       search: "Search clients"
@@ -12,14 +16,14 @@ en:
       kinds:
         service: "Signs in as itself"
         app: "Signs actors in"
-        saml: "SAML app"
-        preset: "A known app"
-      app: "App"
+        saml: "Signs actors in over SAML"
+        preset: "A known product"
+      app: "Product"
       choose: "Choose one"
       address: "Its address"
       slug: "Name it uses for masks"
       hints:
-        preset: "masks fills in its redirect URIs and scopes, and shows what to enter in the app. Name is optional here."
+        preset: "masks fills in its redirect URIs and scopes, and shows what to enter in its settings. Name is optional here."
         service: "It asks the token endpoint for its own token with client_credentials. No actor is behind it, so it never holds openid, profile, email or masks:manage."
         saml: "It sends actors here with a SAML AuthnRequest, and masks posts a signed assertion back. Paste its metadata to fill the rest in."
         app: "It sends actors to sign in and is handed a token on their behalf."
@@ -46,15 +50,7 @@ en:
       columns:
         name: "Name"
         resources: "Resources"
-        source: "Source"
-        namespaces: "Namespaces"
-        scopes: "Scopes"
-        approved_by: "Approved by"
         registered: "Registered"
-      self_registered: "self-registered"
-      approved: "approved"
-      always: "always"
-      on_request: "on request"
       empty:
         matches: "No client matches “%{query}”."
         archived_matches: "No archived client matches “%{query}”."

data/config/locales/en/manage/connections.yml

@@ -3,7 +3,7 @@ en:
     connections:
       stop_confirm: "Stop %{client} using this %{provider} account? It has to ask again."
       stopped: "%{client} can no longer use it."
-      disconnect_confirm: "Disconnect %{held}? It stops signing anybody in until it is linked again, and every application using it stops."
+      disconnect_confirm: "Disconnect %{held}? It stops signing anybody in until it is connected again, and every client using it stops."
       disconnected: "Disconnected."
       empty: "Nothing connected."
       badges:

data/config/locales/en/manage/consents.yml

@@ -1,7 +1,7 @@
 en:
   manage:
     consents:
-      revoke_confirm: "Cut %{held} off? Every refresh token it holds is revoked, and it has to ask again the next time somebody signs in."
+      revoke_confirm: "Revoke access for %{held}? Every refresh token it holds is revoked, and it has to ask again the next time somebody signs in."
       revoked: "Access revoked. It will have to ask again."
       empty: "None."
       revoke: "Revoke access"

data/config/locales/en/manage/device.yml

@@ -9,7 +9,7 @@ en:
       block_question: "Block %{label}? It is refused before any password is checked."
       unblocked: "%{label} is unblocked."
       signed_out: "Signed %{label} out everywhere."
-      sign_out_question: "Sign every account out of %{label}?"
+      sign_out_question: "Sign every actor out of %{label}?"
       facts:
         kind: "Kind"
         ip_address: "IP address"

data/config/locales/en/manage/devices.yml

@@ -54,6 +54,6 @@ en:
       newest: "Only the newest %{count} are shown."
       choose: "Choose %{label}"
       blocked: "blocked"
-      unrecognised: "unrecognised"
+      unrecognised: "unrecognized"
       signed_in: "signed in"
       nobody_yet: "nobody yet"

data/config/locales/en/manage/directory.yml

@@ -2,4 +2,4 @@ en:
   manage:
     directory:
       title: "Directory"
-      lede: "Other systems that keep this tenant's people: an identity provider that provisions them over SCIM, and older apps that read them over LDAP."
+      lede: "Other systems that keep this tenant's actors: a directory that provisions them over SCIM, and older services that read them over LDAP."

data/config/locales/en/manage/domains.yml

@@ -2,22 +2,22 @@ en:
   manage:
     domains:
       title: "Domains"
-      help: "Claim a domain by publishing a TXT record. masks checks it every hour. Once it is proven, people who type an address there can go straight to a provider without a password, and sign-in can be served from a host inside it, such as login.example.com, once that host's DNS points here and it has a certificate. Each address is its own issuer, and a passkey works only on the address it was made on."
+      help: "Claim a domain by publishing a TXT record. masks checks it every hour. Once it is proven, actors who type an address there can go straight to a provider without a password, and sign-in can be served from a host inside it, such as login.example.com, once that host's DNS points here and it has a certificate. Each address is its own issuer, and a passkey works only on the address it was made on."
       claimed: "Publish the TXT record below, then check %{domain}."
       proven: "%{domain} is proven."
       unanswered: "No matching TXT record at %{name} yet. DNS can take a while to spread."
-      routed_away: "People at %{domain} go to their provider now."
-      routed_here: "People at %{domain} sign in here now."
+      routed_away: "Actors at %{domain} go to their provider now."
+      routed_here: "Actors at %{domain} sign in here now."
       served: "Sign-in is served from %{host} too."
       unserved: "Sign-in is no longer served from a custom domain."
-      stop_confirm: "Stop serving %{host}? Apps that use it as their issuer stop working."
-      release_confirm: "Release %{domain}? People with an address there sign in the usual way again."
+      stop_confirm: "Stop serving %{host}? Clients that use it as their issuer stop working."
+      release_confirm: "Release %{domain}? Actors with an address there sign in the usual way again."
       released: "%{domain} is released."
       here: "Sign in here"
       to: "Send to %{name}"
       missing: "Stopped answering %{since}"
       unproven: "Not proven"
-      send: "Where people at %{domain} sign in"
+      send: "Where actors at %{domain} sign in"
       check: "Check"
       release: "Release %{domain}"
       record: "Publish this TXT record:"

data/config/locales/en/manage/emails.yml

@@ -2,8 +2,8 @@ en:
   manage:
     emails:
       list: "Emails"
-      app: "The app being signed in to"
-      no_app: "No app"
+      app: "The client being signed in to"
+      no_app: "No client"
       not_approved: "%{name} (not approved)"
       headed: "Headed by %{heading}, from %{from} to %{to}"
       no_sender: "no sender configured"
@@ -14,7 +14,7 @@ en:
       groups:
         sign_in:
           title: "While signing in"
-          help: "Sent during a sign-in. When an app sent the person there, an approved app heads the email with its logo and name. A sign-in straight to the account page has no app, and the tenant heads it."
+          help: "Sent during a sign-in. When a client sent the actor there, an approved client heads the email with its logo and name. A sign-in straight to the account page has no client, and the tenant heads it."
           about: "About emails sent while signing in"
         manage:
           title: "From a manager"
@@ -22,7 +22,7 @@ en:
           about: "About emails sent from a manager"
         account:
           title: "From the account page"
-          help: "Sent when a person changes their own account. The tenant heads these."
+          help: "Sent when an actor changes something on their account page. The tenant heads these."
           about: "About emails sent from the account page"
         system:
           title: "On its own"

data/config/locales/en/manage/events.yml

@@ -6,3 +6,6 @@ en:
       more:
         one: "Show %{count} more"
         other: "Show %{count} more"
+      repeated:
+        one: "once"
+        other: "%{count} times"

data/config/locales/en/manage/groups.yml

@@ -2,14 +2,14 @@ en:
   manage:
     groups:
       title: "Groups"
-      lede: "Named sets of people, such as admins or family. Apps that ask for the groups scope see each group a person is in, and an app can be limited to some groups. A group's key is what apps see, and it cannot change later. People join a group from their own page."
-      added: "%{name} is ready. Add people from their own pages."
-      delete_confirm: "Delete %{name}? Apps limited to it turn its people away."
+      lede: "Named sets of actors, such as admins or family. Clients that ask for the groups scope see each group an actor is in, and a client can be limited to some groups. A group's key is what clients see, and it cannot change later. Actors join a group from their own page."
+      added: "%{name} is ready. Add actors from their own pages."
+      delete_confirm: "Delete %{name}? Clients limited to it refuse its actors."
       deleted: "%{name} is deleted."
       people:
-        one: "%{count} person"
-        other: "%{count} people"
+        one: "%{count} actor"
+        other: "%{count} actors"
       delete: "Delete %{name}"
       new: "New group name"
       add: "Add"
-      key: "Apps see it as %{key}."
+      key: "Clients see it as %{key}."

data/config/locales/en/manage/ldap.yml

@@ -2,17 +2,17 @@ en:
   manage:
     ldap:
       title: "LDAP"
-      lede: "Older apps such as NAS boxes, media servers, and hypervisors check passwords and read groups over LDAP. masks serves this tenant's people and groups to them read-only."
-      revoke_confirm: "Revoke %{label}? Apps binding with it are refused from now on."
+      lede: "Older services such as NAS boxes, media servers, and hypervisors check passwords and read groups over LDAP. masks serves this tenant's actors and groups to them read-only."
+      revoke_confirm: "Revoke %{label}? Anything binding with it is refused from now on."
       revoked: "%{label} is revoked."
       serve:
         title: "Directory"
-        help: "While this is off, no app can bind to or search this tenant's directory."
+        help: "While this is off, nothing can bind to or search this tenant's directory."
         "on": "Serve this tenant over LDAP"
-        updated: "The directory is updated."
+        updated: "Directory changed."
       connect:
-        title: "Connect an app"
-        help: "Give the app this base DN, a bind DN, and its secret. The app searches ou=people and ou=groups, then binds as a person to check their password."
+        title: "Connect a service"
+        help: "Give the service this base DN, a bind DN, and its secret. The service searches ou=people and ou=groups, then binds as an actor to check their password."
         base_dn: "Base DN"
         address: "Address"
         port: "Port %{port}"
@@ -30,6 +30,6 @@ en:
         revoke: "Revoke"
       binds:
         title: "Password binds"
-        help: "LDAP cannot ask for a second factor. An account that has one, or whose sign-in policy requires one, is refused unless a password alone is allowed here."
+        help: "LDAP cannot ask for a second factor. An actor who has one, or whose sign-in policy requires one, is refused unless a password alone is allowed here."
         password_only: "Allow a password alone over LDAP"
-        updated: "Password binds are updated."
+        updated: "Password binds changed."

data/config/locales/en/manage/messages.yml

@@ -8,4 +8,4 @@ en:
         lede: "The services that deliver this tenant's email and SMS. Each kind sends through its primary service."
       templates:
         title: "Templates"
-        lede: "What each email masks sends says, previewed as people receive it."
+        lede: "What each email masks sends says, previewed as it arrives."

data/config/locales/en/manage/namespaces.yml

@@ -2,7 +2,7 @@ en:
   manage:
     namespaces:
       title: "Namespaces"
-      release_confirm: "Release %{name}? The next application to ask for it gets it, and the scopes beneath it stop meaning what they mean now."
+      release_confirm: "Release %{name}? The next client to ask for it gets it, and the scopes beneath it stop meaning what they mean now."
       released: "%{name} is free to be claimed again."
       columns:
         name: "Name"