Glossary

Action: something an agent is trying to do, named by a verb: file.write, deploy.service, database.drop, mcp.*.

Action fingerprint: agent + action + target + environment. An approval is bound to one, which is why a grant never leaks onto a different action. See Ownership and approvals.

Advisor: a deterministic escalator that runs after policy. Can make a decision stricter; never looser. See Guards.

Agent: a registered AI actor with a token and, optionally, capabilities.

Approval: a paused action awaiting a named human. Single-use, claimed by fingerprint. See Approvals.

Audit event: exactly one record per governed action: who, what, the verdict, the risk, the matched policies, the signals, the session, the policyVersion.

Backfill: pulling history from a tool that existed before Memnox did. See Backfilling history.

Blast radius: what a change to a file can reach through the import graph. Escalation-only, silent when uncertain.

Break-glass: an admin override of a pending approval. Requires a reason, audited as critical, opens an incident. Refused for irreversible actions.

BYOK: bring your own key. Extraction uses your model credential, billed to your account. Without one, extraction answers 503.

Capabilities: wildcard action patterns an agent is registered with, checked before policy. The cheapest control in the product.

Catch-up: a digest of what changed since you last looked.

Code graph: the file-level import graph written by memnox graph build. A snapshot, not a live scan, so it goes stale until it is rebuilt.

Connection: an authorized link to a tool. Produces nothing until a trigger is subscribed.

Content shield: offline scanning for secrets, PII and vulnerable packages. Also holds the versioned security baseline.

Control plane: the hosted side of Memnox that holds your organization: members, the review queue, connected tools, billing. Separate from the runtime, which runs on your machines and decides actions. memnox login signs a machine in to a control plane, and the runtime works with no control plane at all.

Crypto-shredding: erasure by destroying the key rather than deleting the row. Used where deletion would break the audit chain. See Privacy and retention.

Decay check: surfacing decisions whose evidence is old or whose owner has left, for confirmation. Never deletes.

Decision: something the organization settled, recorded with its evidence and its approver. Distinct from a verdict.

Default effect: what happens when no policy matches. allow by default; block is strict mode.

Drift: the gap between what the organization says and what it does. Reported, never auto-resolved.

Effect: allow · block · require_approval · redact. Most restrictive wins.

Environment: a named deployment target within a workspace: production, staging.

Evidence: the source events behind a decision or an incident.

Enforcement mode: whether a verdict is applied, per environment. off skips evaluation, monitor decides and records without withholding, enforce applies it. Set with --enforcement.

Expertise: what Memnox has observed a person actually works on, derived from the source events they appear in rather than from a profile they filled in. See People.

Extraction: the one place a model runs. It proposes candidate decisions from events, and its output is a suggestion until a human approves it.

Fail closed: unknown identity, unreadable state or ambiguous input blocks rather than guessing.

Grant: an approval that was given. Single-use, spent when it authorizes an action.

Guard: see advisor.

Graphify: the optional deeper analyzer, parsing 36 languages for calls and inherits edges. Only its AST-extracted edges reach the decision path.

Hash chain: each audit event stores prevHash and a hash over its own content. Tamper evidence, not tamper proofing.

Incident: opened by one of four deterministic detectors. See Risk, drift and incidents.

Local gate: the in-process component that matches call arguments on your machine, so raw payloads never leave it.

MCP firewall: a transparent proxy for any MCP server. Denied tools are hidden rather than failing.

Monitor mode: mode: monitor on a single rule. The action proceeds, and the audit event records the verdict that was withheld.

Normalizer: the code that turns a provider's own webhook payload into a SourceEvent Memnox understands. One generic normalizer serves every toolkit, so adding a tool is configuration rather than code. See How integrations work.

Organization: the tenant. Members, billing, SSO, privacy scope.

Pack: a curated group of rules you install rather than write. 33 ship.

Permalink: the URL a source event points back to. Composed from a base URL for tools that do not send one.

Person: one human and every provider account known to be theirs. Email is the only evidence strong enough to merge on.

Policy: a rule in YAML, made of a match and a decision.

policyVersion: the content hash of the rule set that decided an event.

Project: the unit of governance. Declared in the policy file; may span several repositories.

Provenance: where an agent's context came from. See taint.

Quorum: minApprovals above 1. One person counts once; one denial ends it.

Redact: mask the secret and forward the call. Needs an enforcement point that can rewrite the payload.

Review queue: where candidate decisions wait for a human. See The review queue.

Risk level: low → critical, a property of the action, classified deterministically.

Risk score: 0 to 100, a property of this action by this agent now, measured against its own 14-day baseline.

Runtime: the open-source gate that runs on your machines and decides every action.

Security baseline: the fixed table of security requirements Memnox ships for a class of change, looked up deterministically by action and target. It is not a review of your code and never blocks anything. It is advice, carried with a version so a briefing can be reproduced. See Ask before you act.

Session: one agent run. Taint attaches here, and merges monotonically.

Sink: a destination every decision is delivered to: Splunk, Datadog, NDJSON, S3, Kafka.

Source event: anything ingested, in one normalized shape, always carrying a resolvable URL.

Subscription: an outbound signed webhook: incident.opened, suggestion.queued. The opposite direction from a trigger.

Suggestion: a candidate decision awaiting review.

Taint: a session that has read untrusted content. Raises the bar for privileged actions; two actions are non-overridable. See Trust, taint and provenance.

Toolkit: one connectable tool, identified by a slug. 500+ available.

Trigger: an inbound subscription, telling Memnox when something happens in a connected tool. The opposite direction from a subscription.

Trust: whether an event's author resolves to a known person. Always a lookup, never an assumption.

Verdict: the runtime's answer for one action. Distinct from a decision.

Verified execution: preconditions, execute, postconditions, rollback, and a reported outcome. See Verified execution.

Workspace: a connected surface that produces events. Owns connections, people, policies and its event log.