Glossary

Every term the site uses, defined.

The vocabulary of the product pages in one place, each term linked to where it is used.

A

Agent identity: The principal an agent acts as, with its own scopes, credentials and budget, separate from the person who runs it.; Used inWorkflows & Agents Read the explainer
Archive tier: A colder, cheaper place for backups you must keep but rarely read, with a stated retrieval time.; Used inBackups

B

Baseline drift: The difference between the settings a baseline asks for and what the device last reported. A setting the device does not report counts as drift.; Used inWorkplace
Blast radius: The most destructive actions an agent may take in one run. One more is refused.; Used inWorkflows & Agents

C

Certified metric: A metric whose definition has been reviewed and marked certified, so it can be relied on wherever it appears.; Used inAsk
Chain of custody: The append-only record of who viewed, exported, attached or redacted each piece of evidence, when and why.; Used inInvestigations
Compensation: The explicit undo for a step that completed before a later one failed. It is run on purpose and recorded, never presented as a successful run.; Used inLifecycle
Cost preview: What a statement would do before it does it: the SQL after policy, and an upper bound on the bytes it would scan.; Used inSQL & Analytics
Cross-provider copy: An explicit choice to keep a copy with a second provider, so one outage cannot take the original and its backup together. Off by default, because it doubles the cost.; Used inBackups

D

Data contract: What a table’s producer commits to — its columns, types and rules — validated on every write and versioned when it changes.; Used inLakehouse
Deletion certificate: The proof, kept after the footage is gone, that it was deleted on schedule under a named rule.; Used inInvestigations
Desired and observed state: What you ordered and what is actually running are recorded separately. The reconciler compares them continuously, and a difference shows on the server rather than staying hidden.; Used inServers
Dry run: A run that plans and authorizes every action as a real one would, and takes none of them.; Used inWorkflows & Agents

E

Exclusion: A part of the answer policy kept from you, named in the answer with the reason and the policy.; Used inAsk

F

Federation: Querying an external source alongside your own tables in one statement, without copying it in first.; Used inSQL & Analytics
Flow version: The ordered checks an applicant goes through and the SKU it bills. A new version is a new flow; an attempt keeps the version it started on.; Used inVerify

G

Golden image: A tested image your team promotes and launches from. It stays generic, because per-server settings arrive at first boot from a template rather than being baked in.; Used inServers
Grow, never shrink: A resize can only make a volume larger. A request to shrink is refused, because the platform cannot know what the filesystem keeps at the end of the disk.; Used inBlock storage

H

Health-checked DNS: A record can fail over to a standby when a health check fails, or answer by the visitor’s location, so the name keeps working when a site does not.; Used inNetworking

I

Identity-minted kubeconfig: A kubeconfig issued on demand from your identity and bound to you, with a short life. Nothing static is stored on the cluster, so a leaked file expires on its own.; Used inKubernetes

J

Joiner, mover, leaver: The three changes a person’s access goes through. Each is a request with an owner, an effective date and a history that cannot be edited.; Used inLifecycle

L

Leg: One pillar being asked one thing as part of a question. Each leg has its own plan and its own authorization.; Used inAsk Read the explainer
Legal hold: An instruction that nothing in a case is deleted, whatever retention says, until the hold is deliberately lifted.; Used inInvestigations
Lineage to a snapshot: The chain version → run → table at a snapshot, so the training data is the exact rows the run read, not today’s table.; Used inML & GenAI
Local administrator password rotation: Each device’s local admin password is rotated through the device-management system. The record keeps a digest, and revealing the password is a named, one-time act.; Used inWorkplace

M

Machine class: A size in the platform’s own vocabulary, such as px.c2.small. You order the class and the region; which capacity serves it is the platform’s decision, so your scripts never name a provider.; Used inServers Read the explainer
Managed and self-managed: Managed hands the control plane to the upstream that serves the region. Self-managed runs it on our own metal. The cluster is the same resource either way, with the same verbs.; Used inKubernetes
Match explanation: What each result is shown with: the attributes that matched, the score, and the detections that contributed.; Used inVideo Search & Alerts Read the explainer
Model card: What a version is for, what it was trained on, where it falls down and who it could affect. Required before production.; Used inML & GenAI

N

Namespace: A tenant-scoped folder for tables, such as logistics or finance, that grants and placement attach to.; Used inLakehouse
Network block volume: A disk that lives apart from any one server. Attach it, detach it and attach it somewhere else, and the data goes with it.; Used inBlock storage
Node pool: A group of identical nodes with its own size, autoscaling bounds and taints. You resize, taint and drain a pool rather than individual machines.; Used inKubernetes

O

Occurrence: One thing that happened, such as a van arriving, rather than every frame it appears in. Results are occurrences, so one van is one result.; Used inVideo Search & Alerts
One rule model: Firewall rules and security groups are written in one vocabulary and translated for whichever capacity runs the network, so a rule means the same thing everywhere.; Used inNetworking

P

Payload boundary: Documents and images stay in the applicant’s region. The platform keeps a reference, and nothing goes to a provider without consent for that purpose in that region.; Used inVerify
Permission-aware retrieval: Retrieval that filters candidate documents by the requesting user’s permissions at query time, before anything reaches a model.; Used inML & GenAI
Point-in-time recovery: Restore to any moment inside the retention window, as a new database — the original keeps running while you check the restore.; Used inManaged databases
Presigned URL: A link for one upload or download that expires when you say. It carries the grant of the key that signed it and no more — a read-only key cannot presign a write.; Used inObject storage
Private network: An address range you choose, with subnets and routes, that your servers talk across without touching the internet.; Used inNetworking
Purpose: The reason recorded with an archive search. Beyond a configurable window, policy can refuse a search that does not give one.; Used inVideo Search & Alerts

R

Read endpoint: A second address that spreads queries across the read replicas, so heavy reporting does not slow down writes.; Used inManaged databases
Retention tier: How long each generation of backup is kept — daily, weekly, monthly — applied by the platform as policy rather than by a script someone maintains.; Used inBackups
Reusable identity: An approved verification that a later attempt can rely on without calling the provider again, until it expires or is revoked. It bills at its own reuse rate.; Used inVerify
Role profile: A named bundle of licences, groups, teams, applications and device policy for one kind of employee. A request points at a profile instead of listing access by hand.; Used inLifecycle
Rollout ring: An ordered group of devices a change reaches in turn. A device joins a broader ring only after the pilot.; Used inWorkplace

S

S3-compatible endpoint: The address your SDKs, CLIs and backup tools already know how to talk to. It names your region, not the provider underneath.; Used inObject storage
Scoped access key: A key issued to one of your own principals, so it can do exactly what that principal may do. Revoke the principal’s access and the key loses it too.; Used inObject storage
Semantic layer: The map from business words (a site, an employee, a vehicle) to the tables, detections and events that hold them.; Used inAsk
Snapshot: A point-in-time copy recorded against the volume, so a restore always names exactly what it is going back to.; Used inBlock storage
Snapshot: The table at one instant. Every write makes one, so a past state can be read, tagged, branched from or rolled back to.; Used inLakehouse Read the explainer
SQL warehouse: A named pool of SQL compute with a size and an auto-stop. Its type and size are the SKU it is billed by, per second, while it runs.; Used inSQL & Analytics Read the explainer
Standing alert: A saved search or a zone, count, dwell or absence rule that keeps watching and notifies its channels when it matches.; Used inVideo Search & Alerts
Substrate: Where a server physically runs: our data centres, contracted partner capacity, or hardware you own and register yourself. Residency rules decide which substrates an order may use.; Used inServers Read the explainer

T

The engines: PostgreSQL, MySQL, MariaDB, Redis, Valkey, MongoDB, ClickHouse and Kafka, each provisioned the same way.; Used inManaged databases
Topology: Standalone, high availability with a standby, or a native multi-node cluster — chosen when you create the database and changed later as it grows.; Used inManaged databases
Trigger: What starts a workflow: a schedule, a data condition, a video alert, an identity risk, a cloud anomaly, a webhook or a person.; Used inWorkflows & Agents

V

Verification manifest: The list of hashes shipped with an export, so whoever receives the package can check that nothing in it was changed.; Used inInvestigations
Versioning and lifecycle rules: Keep every version of an object, and let rules expire old versions or move them to a colder tier on a schedule rather than by hand.; Used inObject storage