# Glossary

The words Tanomis uses, each defined once, with a link to the page that explains it.

| Term | Meaning |
|---|---|
| **Agent** | A stable name that owns a lineage of versions. [Agents and versions](/concepts/agents-and-versions) |
| **Automation client** | An organization-owned machine identity for CI or a backend, with a permission profile; also called an M2M client. [Automation credentials](/guides/deploy/automation-credentials) |
| **Assessment** | A scorer's verdict on one execution trace. [Evaluation overview](/guides/evaluate/overview) |
| **Audit ledger** | The tenant-isolated, append-only, hash-chained, signed record of decisions and attribution. It holds references and hashes, never content. [Audit and evidence](/guides/audit/audit-and-evidence) |
| **Canary** | A version a tenant serves at a percentage share alongside its baseline. [Roll out and roll back](/guides/deploy/rollout-and-rollback) |
| **Ceiling** | A declared or administered upper bound that only ever narrows: models, external hosts, connector tools, agent authority. [Policy, approvals, and evidence](/concepts/governance) |
| **Connection** | A configured workspace service connection; personal integrations additionally require each user's own account. [MCP connectors](/guides/connect-tools/mcp-connectors) |
| **Connector** | A governed MCP endpoint an administrator defines, with a discovered tool inventory. [MCP connectors](/guides/connect-tools/mcp-connectors) |
| **Context** | Local CLI configuration for one Tanomis environment and its login. [CLI configuration](/reference/cli-configuration) |
| **Delegation** | One agent handing a skill invocation to another with narrowed authority. [Delegate work to another agent](/guides/run/delegate-to-another-agent) |
| **Enablement** | The tenant-scoped assignment that lets a version receive traffic. [Agents and versions](/concepts/agents-and-versions) |
| **Execution trace** | One OpenTelemetry trace per run: model calls, tool calls, timing, and captured content. [Capture execution traces](/guides/evaluate/capture-traces) |
| **Experiment** | A candidate version replayed over a dataset version, with aggregate metrics. [Evaluation overview](/guides/evaluate/overview) |
| **Global agent** | An agent registered once at platform level and enabled per tenant, each tenant on the version you choose. [Platform model](/concepts/platform-model) |
| **Golden snapshot** | A warm-process checkpoint of an agent image over an empty workspace, restored to start sessions in under a second. [Agents and versions](/concepts/agents-and-versions) |
| **Harness** | The framework an agent is written against: Claude Agent SDK or Deep Agents. [Choose a harness](/guides/build/choose-a-harness) |
| **Idempotency key** | A caller-chosen key that makes a retry return the original session or run. [Sessions and runs](/concepts/sessions-and-runs) |
| **Interaction** | A durable question or permission request a run pauses on until a person answers. [Approval-required actions](/guides/run/approval-required-actions) |
| **Invoking principal** | The person or service that started a request, resolved from the access token. [Identity and access](/concepts/identity-and-access) |
| **LLM gateway** | The per-tenant gateway every model call passes through: authorization, metering, tracing. [Choose models](/guides/build/choose-models) |
| **Manifest** | `agent.yaml`, the version's declared contract. [Agent manifest](/reference/agent-manifest) |
| **Organization** | The customer account: members, roles, invitations, tenant attachments. [Organizations and tenants](/concepts/organizations-and-tenants) |
| **Platform operator** | Whoever runs the Tanomis deployment: Tanomis staff in the hosted service, your own team when self-hosted. [Platform model](/concepts/platform-model) |
| **Run** | One admitted unit of work inside a session; its resource is the authoritative status. [Sessions and runs](/concepts/sessions-and-runs) |
| **Scope ceiling** | The most authority an agent's own tokens can ever carry. [Set the authorization ceiling](/guides/govern/set-the-authorization-ceiling) |
| **Sandbox tenant** | A tenant that serves no customer, where developers and CI test before a rollout reaches customers. [Environments and contexts](/guides/deploy/environments-and-contexts) |
| **Session** | The continuity boundary for one enabled agent version: workspace, runs, files, interactions. [Sessions and runs](/concepts/sessions-and-runs) |
| **Skill** | A unit of work an agent accepts from another agent. [Delegate work to another agent](/guides/run/delegate-to-another-agent) |
| **Tenant** | One of your customers: an isolated runtime with its own policy, connectors, and data. [Organizations and tenants](/concepts/organizations-and-tenants) |
| **Version** | One immutable build of an agent with its contract captured at registration. [Versions and statuses](/guides/deploy/versions-and-statuses) |
| **Warm start** | Starting a session from a golden snapshot instead of booting the harness cold. [Agents and versions](/concepts/agents-and-versions) |
| **Workspace** | Your view of one organization and one tenant, with your role and capabilities. [Organizations and tenants](/concepts/organizations-and-tenants) |
| **Integration** | An agent manifest declaration naming a configured connector and the tools that version may use. The connector supplies the endpoint and account mode. [MCP connectors](/guides/connect-tools/mcp-connectors) |