Glossary
Glossary
The terms these docs use, in alphabetical groups, each with a link to where it matters most.
A–C
Access Key
An older Console name for a client API token: the token an application sends to the gateway.
See Manage API Tokens.
agent
A saved identity for an application or workload, such as your support assistant. It ties the workload to its configuration and gateways.
See Agents.
API token
A credential the control-plane API issues for machine access. It holds organization-level roles and has a purpose: general, gateway_runtime, or integration.
See Manage API Tokens.
audit event
A stored record of an administrative action in the control plane, shown in Trail. Not the same as a governance event, which records a model request.
backup code
A one-time code that recovers your account when your MFA device isn't available. Each MFA setup gives you ten.
See MFA and Passkeys.
budget
A spending limit on a token, provider, or other scope. Each kind of budget reports and enforces in its own way.
central agent URL
The published HTTPS address applications use to reach an agent's gateway from anywhere. A local gateway URL, by contrast, reaches the gateway only on its own machine.
See Use Your Central Agent URL.
client API token
The API token an application sends to the gateway with each model request. Examples on this site keep it in VERDICTAN_CLIENT_TOKEN. It is not for the control-plane API.
See API Tokens for IDEs.
configuration
A saved, versioned policy config in the control plane, listed under Configurations in the Console. Saving a version doesn't mean a gateway has applied it.
See Configurations.
connected gateway
A gateway runtime registered with the control plane, which keeps its configuration, status, and events in sync.
See Gateway Fleet.
Console
The Verdictan web app for organizations, agents, gateways, identity, evidence, and billing.
See the Quickstart.
Context Fabric
A store for engineering context that software can search, and that can reuse earlier results when the configured checks pass.
control plane
The Verdictan API and management services. They store organization resources, audit data, and billing data, and they manage connected gateways. Model traffic and administration use different routes and credentials.
See API Overview.
D–G
data plane
The gateways that receive model traffic and enforce policy, as opposed to the control plane.
See Architecture.
escalation
A request sent for human review. A policy returns escalate, and a reviewer decides in the Inbox. The decision doesn't replay the request.
evidence
Any record of a policy decision or action: governance events, Trail audit events, History, and exports.
export job
A background control-plane job that prepares an evidence export for download.
gateway
The Verdictan service that receives application requests, runs the policy chain, and forwards each request to a provider.
See Gateway Fleet.
Gateway Key
An older name for a gateway runtime token: an API token with the gateway_runtime profile.
See Manage API Tokens.
gateway runtime
One running gateway process, either standalone or connected.
gateway runtime token
The API token a connected gateway uses to sync with the control plane. Applications never use it for model requests.
See verdictan gateway.
governance event
The gateway's record of one request: its result, the policy decision, and related metadata, delivered to the control plane. The request ID links it to the client's response.
See verdictan events.
group mapping
A rule in an SSO connection that turns an identity-provider group into a Verdictan role or team.
See SSO and SCIM.
H–P
History
The Console page for captured requests, responses, and session context. What appears depends on capture and retention settings, so an empty History doesn't mean the gateway received nothing.
See verdictan history.
IAM policy
A set of statements that allow or deny actions on organization resources. Roles contain IAM policies. Not to be confused with a policy control in a policy config.
identity provider
The service that signs users in for SSO, over OIDC or SAML, and can provision them with SCIM.
See SSO and SCIM.
Inbox
The Console queue for escalations and other human-review work. A reviewer claims an item and completes it.
managed public endpoint
A published organization gateway with a hostname like <publication-key>.ai.<region>.verdictan.com. The hostname decides locality and routing.
See Regions Overview.
member
A user account in a Verdictan organization. Members get roles directly or through teams.
See Members and Teams.
MFA
Multi-factor authentication. Verdictan accepts an authenticator app (TOTP) or a passkey as the second factor.
See MFA and Passkeys.
OAuth client
A registered public application that gets delegated access for a Verdictan user through the authorization code flow with PKCE.
See OAuth Clients.
passkey
A WebAuthn credential stored on a device or a hardware security key.
See MFA and Passkeys.
phase
Whether a policy check looks at the request (input) or the provider's response (output). Each request family supports its own set of stages.
See Policy Configuration Overview.
PKCE
Proof Key for Code Exchange. The OAuth client sends a code challenge with the authorization request, and the matching verifier with the token exchange.
See OAuth Clients.
policy chain
The ordered list of controls in policies.chain. Controls run in that order within each phase.
See Policy Configuration Overview.
policy config
The YAML file that configures a gateway: providers, routes, the policy chain, and runtime settings. Usually named policy-config.yaml.
See Declarative Config Reference.
policy control
A configured rule that inspects or changes traffic. It runs in a phase and returns a verdict and a reason code.
principal
Any authenticated identity that can hold permissions: a member, a team, an API token, or an OAuth access token.
See Identity and Access.
provider credential
The secret the gateway uses to call a model provider, such as your OpenAI API key. secret_key_ref says where to find it: an environment variable or a hosted secret.
See Providers and BYOK Routing.
provider target
One configured provider, model, endpoint, and credential reference in a policy config.
R–W
reason code
A stable identifier for why a control reached its verdict, such as prompt_injection.detected. Build logic on reason codes, not on messages.
See Policy Configuration Overview.
region
A named locality for Verdictan resources and traffic, such as eu-west. The requested region is the one the current CLI command, gateway workflow, or published endpoint targets.
See Regions Overview.
request family
A group of gateway routes that share a request format, such as Chat Completions, Responses, Messages, or Embeddings. Sometimes called a runtime request family.
role
A named set of IAM policies. Members, teams, and API tokens get permissions through role assignments.
SCIM
System for Cross-domain Identity Management. An identity provider uses SCIM 2.0 to push user and group changes to Verdictan.
See SSO and SCIM.
SSO
Single sign-on. Members sign in through an identity provider over OIDC or SAML.
See SSO and SCIM.
team
A group of members used for ownership, role grants, budgets, attribution, and policy workflows.
See Members and Teams.
Trail
The Console page that records administrative actions and changes: who changed what, and when.
usage authorization
The gateway's record that authorizes one request before it is sent. On connected request paths it carries the estimated cost used for budget checks.
VDT
Verdictan resource name. A VDT starts with vdt:verdictan: and identifies one resource in an IAM policy statement.
verdict
The outcome of a policy control: allow, redact, block, or escalate.
See Policy Configuration Overview.
work receipt
A scoped record of earlier work in Context Fabric. Software can search receipts and reuse verified results when the gateway policy allows it.
See Context Fabric Work Reuse.
Next steps
- Identity and Access: how members, roles, and IAM policies fit together.
- Declarative Config Reference: every policy config field.