Glossary
Every term Veefore uses with a specific meaning, defined once.
Several of these words have loose everyday meanings and precise meanings here. Where they differ, the precise one is what the system implements.
#A
A2A — Agent-to-agent. A verified connection to an agent outside your organization, invoked through the gateway so the same pipeline applies. →
Action — One protected operation requested by an agent, and the record of how it was decided. Carries full lineage. →
Agent — A software actor with its own cryptographic identity, capabilities and lifecycle state. →
Agent Passport — A signed, versioned, exportable snapshot of an agent's identity, capabilities and trust state. Identity, never authorization. →
Approval — A human decision bound to one specific request. Not a standing permission. →
Assertion — A signed JSON payload proving possession of an agent's private key. Carries a nonce and timestamp, so it cannot be replayed. →
Audience — The value bound into an assertion identifying which gateway it is
for. Compared as a string, which is why 127.0.0.1 and localhost are not
interchangeable.
Authority — The resolved, effective set of things an agent may currently do, after intersecting every hop of its delegation chain. →
#B
Blast radius — Everything a destructive operation would affect. Previewed before every emergency control, side-effect free. →
Break-glass — Emergency elevated access. Heavily audited, CRITICAL
severity, separate permission.
#C
Capability — A named abstract permission an agent holds, like
refund.create. Coarser than policy; necessary but not sufficient to call a
tool. →
CLIENT tool — A tool Veefore decides and records but your own code performs,
inside guard(). What veefore registers. Re-register it as HTTP with a
brokered credential to take the key out of your code. →
Control plane — The management API. Organizations, agents, policies, delegations, credentials, audit. People talk to it; agents do not.
Credential broker — The component that seals credential material on the way in and leases short-lived, scoped credentials on the way out — to the tool runtime, never to the agent. →
#D
Delegation — A bounded, time-limited, revocable grant of authority from one principal to another. Can never exceed its parent. →
Destination allowlist — The set of hosts a tool is permitted to contact.
Enforced at egress; anything else is DESTINATION_BLOCKED.
Divergence — In OBSERVE, a decision where the effective outcome and
shadow.decision disagree. The list of things that will break on promotion.
→
#E
Enforcement mode — OBSERVE, SIMULATE or ENFORCE. Lives on the
environment. →
Environment — A deployment tier within a workspace. Holds the enforcement
mode. DEVELOPMENT, STAGING or PRODUCTION. →
Evidence — A typed, expiring trust record: identity verification, security attestation, compliance evidence and others. →
#F
Fail closed — When a dependency enforcement relies on is unavailable, protected actions are refused rather than permitted. →
#G
Gateway — The enforcement plane. Authenticates agents, runs the pipeline, decides every action. The authorization boundary. →
Generation — A counter on an agent identity, bumped on key rotation. An
assertion signed with a superseded key is refused with
IDENTITY_GENERATION_STALE.
guard() — The SDK wrapper around a tool function. Asks the gateway first and runs the function only if the call is permitted. →
#H
Hash chain — The linked hashes over audit events that make tampering detectable and localisable. →
High impact — A permission that can never be granted implicitly through a wildcard. Must appear on the role explicitly. →
Hosted Veefore — The Veefore service we run. The CLI connects to it with no address and there is nothing to deploy. →
#I
Idempotency key — A caller-supplied key on a mutating request, so a retry
does not duplicate the effect. Reuse with a different body is
IDEMPOTENCY_KEY_REUSED. →
Identity — An agent's Ed25519 key pair. Not its name, not a bearer token, not the SDK. →
#L
Lease — A short-lived credential issued by the broker for one action.
Statuses ISSUED, USED, EXPIRED, REVOKED.
LIMIT — A policy decision that permits the action in capped form. Sets
limits.appliedAmount and velocity caps.
#M
MASK — A policy decision that permits the action with named parameter paths redacted, in the forwarded request and in audit.
MCP — Model Context Protocol. MCP servers are registered, their tools are discovered, and each tool stays unauthorized until a human authorizes it. →
#N
Nonce — A single-use value in an assertion. Reuse is NONCE_REPLAYED, which
is what makes a captured assertion worthless.
#P
Pause — A reversible operational stop. No new protected actions. Distinct from suspend, which is the security-driven equivalent.
Pipeline — The twelve ordered stages every protected action passes through. →
Policy — A versioned set of rules over a closed field set, evaluated deterministically on every action. →
Preflight — The checks veefore deploy runs before changing enforcement
mode, including replaying recent traffic. →
Principal — Whoever initiated a request: USER, AGENT, SYSTEM or
API_KEY.
#R
Registry — The private, organization-scoped directory of agents, for internal discovery. Not a marketplace, and publishing grants no authority.
Revoke — Terminal invalidation. There is no un-revoke.
Risk signal — One of thirteen named observations contributing a weighted amount to a risk score, each with a human-readable explanation. →
Rule set — The JSON artefact that is a policy. Authoritative, stored, and what the visual builder reads and writes.
#S
Scope — Where a policy is bound or a role grant applies: organization, workspace, environment, agent or tool.
Self-hosted — Veefore running on your own infrastructure. Engineers name its address to the CLI once. →
Shadow decision — What enforcement would have decided, recorded in
OBSERVE and SIMULATE alongside the effective decision.
Step-up — A fresh re-authentication required at the moment of a high-impact operation, regardless of session age. →
Strictness — The precedence order that resolves multiple matching rules.
BLOCK > REQUIRE_APPROVAL > STEP_UP_AUTH > LIMIT > MASK > ALLOW.
Suspend — A reversible security stop. Same effect as pause, different intent and audit severity.
#T
Tool — A registered, callable thing with an endpoint, a required capability, a destination allowlist and a risk rating. →
Total — A property of the policy evaluator: every operator is defined for
every input, and an unresolvable comparison is false rather than an exception.
Trace id — A correlation id on every response, action record, audit event
and log line. Paired with request_id.
#W
Workspace — A team or product area within an organization. Divides resources; does not divide members or roles. →