---
title: Glossary
description: Every term Veefore uses with a specific meaning, defined once.
---

Several of these words have loose everyday meanings and precise meanings here.
Where they differ, the precise one is what the system implements.

## A

**A2A** — Agent-to-agent. A verified connection to an agent outside your
organization, invoked through the gateway so the same pipeline applies.
[→](/build/a2a)

**Action** — One protected operation requested by an agent, and the record of
how it was decided. Carries full lineage. [→](/how-it-works)

**Agent** — A software actor with its own cryptographic identity, capabilities
and lifecycle state. [→](/concepts/identity)

**Agent Passport** — A signed, versioned, exportable snapshot of an agent's
identity, capabilities and trust state. Identity, never authorization.
[→](/concepts/passport)

**Approval** — A human decision bound to one specific request. Not a standing
permission. [→](/concepts/approvals)

**Assertion** — A signed JSON payload proving possession of an agent's private
key. Carries a nonce and timestamp, so it cannot be replayed.
[→](/build/sign-your-own-assertion)

**Audience** — The value bound into an assertion identifying which gateway it is
for. Compared as a string, which is why `127.0.0.1` and `localhost` are not
interchangeable.

**Authority** — The resolved, effective set of things an agent may currently do,
after intersecting every hop of its delegation chain.
[→](/concepts/delegation)

## B

**Blast radius** — Everything a destructive operation would affect. Previewed
before every emergency control, side-effect free.
[→](/operate/emergency-controls)

**Break-glass** — Emergency elevated access. Heavily audited, `CRITICAL`
severity, separate permission.

## C

**Capability** — A named abstract permission an agent holds, like
`refund.create`. Coarser than policy; necessary but not sufficient to call a
tool. [→](/concepts/capabilities)

**CLIENT tool** — A tool Veefore decides and records but your own code performs,
inside `guard()`. What `veefore` registers. Re-register it as `HTTP` with a
brokered credential to take the key out of your code. [→](/build/register-a-tool#http-or-client)

**Control plane** — The management API. Organizations, agents, policies,
delegations, credentials, audit. People talk to it; agents do not.

**Credential broker** — The component that seals credential material on the way
in and leases short-lived, scoped credentials on the way out — to the tool
runtime, never to the agent. [→](/concepts/credentials)

## D

**Delegation** — A bounded, time-limited, revocable grant of authority from one
principal to another. Can never exceed its parent.
[→](/concepts/delegation)

**Destination allowlist** — The set of hosts a tool is permitted to contact.
Enforced at egress; anything else is `DESTINATION_BLOCKED`.

**Divergence** — In `OBSERVE`, a decision where the effective outcome and
`shadow.decision` disagree. The list of things that will break on promotion.
[→](/journey/observe)

## E

**Enforcement mode** — `OBSERVE`, `SIMULATE` or `ENFORCE`. Lives on the
environment. [→](/concepts/enforcement-modes)

**Environment** — A deployment tier within a workspace. Holds the enforcement
mode. `DEVELOPMENT`, `STAGING` or `PRODUCTION`. [→](/concepts/tenancy)

**Evidence** — A typed, expiring trust record: identity verification, security
attestation, compliance evidence and others. [→](/concepts/trust)

## F

**Fail closed** — When a dependency enforcement relies on is unavailable,
protected actions are refused rather than permitted. [→](/secure/fail-closed)

## G

**Gateway** — The enforcement plane. Authenticates agents, runs the pipeline,
decides every action. The authorization boundary.
[→](/architecture/request-path)

**Generation** — A counter on an agent identity, bumped on key rotation. An
assertion signed with a superseded key is refused with
`IDENTITY_GENERATION_STALE`.

**guard()** — The SDK wrapper around a tool function. Asks the gateway first and
runs the function only if the call is permitted. [→](/build/protect-an-agent)

## H

**Hash chain** — The linked hashes over audit events that make tampering
detectable and localisable. [→](/concepts/audit)

**High impact** — A permission that can never be granted implicitly through a
wildcard. Must appear on the role explicitly. [→](/secure/rbac)

**Hosted Veefore** — The Veefore service we run. The CLI connects to it with no
address and there is nothing to deploy. [→](/quickstart)

## I

**Idempotency key** — A caller-supplied key on a mutating request, so a retry
does not duplicate the effect. Reuse with a different body is
`IDEMPOTENCY_KEY_REUSED`. [→](/build/idempotency)

**Identity** — An agent's Ed25519 key pair. Not its name, not a bearer token,
not the SDK. [→](/concepts/identity)

## L

**Lease** — A short-lived credential issued by the broker for one action.
Statuses `ISSUED`, `USED`, `EXPIRED`, `REVOKED`.

**LIMIT** — A policy decision that permits the action in capped form. Sets
`limits.appliedAmount` and velocity caps.

## M

**MASK** — A policy decision that permits the action with named parameter paths
redacted, in the forwarded request **and** in audit.

**MCP** — Model Context Protocol. MCP servers are registered, their tools are
discovered, and each tool stays unauthorized until a human authorizes it.
[→](/build/mcp)

## N

**Nonce** — A single-use value in an assertion. Reuse is `NONCE_REPLAYED`, which
is what makes a captured assertion worthless.

## P

**Pause** — A reversible operational stop. No new protected actions. Distinct
from suspend, which is the security-driven equivalent.

**Pipeline** — The twelve ordered stages every protected action passes through.
[→](/how-it-works)

**Policy** — A versioned set of rules over a closed field set, evaluated
deterministically on every action. [→](/concepts/policy)

**Preflight** — The checks `veefore deploy` runs before changing enforcement
mode, including replaying recent traffic. [→](/journey/enforce)

**Principal** — Whoever initiated a request: `USER`, `AGENT`, `SYSTEM` or
`API_KEY`.

## R

**Registry** — The private, organization-scoped directory of agents, for
internal discovery. Not a marketplace, and publishing grants no authority.

**Revoke** — Terminal invalidation. There is no un-revoke.

**Risk signal** — One of thirteen named observations contributing a weighted
amount to a risk score, each with a human-readable explanation.
[→](/concepts/risk)

**Rule set** — The JSON artefact that *is* a policy. Authoritative, stored, and
what the visual builder reads and writes.

## S

**Scope** — Where a policy is bound or a role grant applies: organization,
workspace, environment, agent or tool.

**Self-hosted** — Veefore running on your own infrastructure. Engineers name its
address to the CLI once. [→](/install)

**Shadow decision** — What enforcement *would* have decided, recorded in
`OBSERVE` and `SIMULATE` alongside the effective decision.

**Step-up** — A fresh re-authentication required at the moment of a high-impact
operation, regardless of session age. [→](/secure/step-up)

**Strictness** — The precedence order that resolves multiple matching rules.
`BLOCK` > `REQUIRE_APPROVAL` > `STEP_UP_AUTH` > `LIMIT` > `MASK` > `ALLOW`.

**Suspend** — A reversible security stop. Same effect as pause, different intent
and audit severity.

## T

**Tool** — A registered, callable thing with an endpoint, a required capability,
a destination allowlist and a risk rating. [→](/build/register-a-tool)

**Total** — A property of the policy evaluator: every operator is defined for
every input, and an unresolvable comparison is `false` rather than an exception.

**Trace id** — A correlation id on every response, action record, audit event
and log line. Paired with `request_id`.

## W

**Workspace** — A team or product area within an organization. Divides
resources; does not divide members or roles. [→](/concepts/tenancy)