Glossary

Look up the identity terms these docs use, each defined in a sentence or two with a link to the page that explains it.

The terms these docs use, in alphabetical order. Each entry says what the term means on these pages and links to the page that explains it.

A

Access token. A signed token that an application, a service or an agent sends as a Bearer credential when it calls an API. It lasts 15 minutes by default. See Tokens and claims.

ACS URL. The assertion consumer service URL: the URL at a SAML service provider that receives the SAML response after a person signs in. See Connect a SAML application.

Action. A rule of your own that runs while a person signs in. It can add claims to a token, deny the sign-in, or ask for MFA. See Run actions at sign-in.

Agent. An AI agent registered in a project as an identity of its own, with its own key, its own permissions and a named owner. On Zero-Code pages, the component on a cluster node is called the node agent. See How agent sign-in works.

Application. Anything that signs people in, or signs itself in, registered in a project. Its type is web, spa, native or m2m. See Application types and redirect URIs.

Approval. A person's decision on an action that a rule sends to a person. The action waits until it is approved or denied. See Ask before a sensitive action.

Approval group. The group of people that answers for an autonomous agent and decides its approval requests. See How agent sign-in works.

Assertion. A signed statement. In SAML, it is the statement about a person that the identity provider sends to an application. For the statement an agent signs, see client assertion. See Connect a SAML application.

Audience. The service a token was issued for, carried in the token's aud claim. A service accepts a token only when aud names that service. See Tokens and claims.

Audit record. The one record of every sign-in, grant, approval and denial in a project, for people and agents alike. See Use the audit record.

AuthFI Agent Profile. The set of published standards an AI agent uses on AuthFI: OAuth 2.0 and its extensions, OpenID CIBA and OpenID Shared Signals, with an AuthFI extension only where no standard exists. It is a profile, not a new protocol. See How agent sign-in works.

Authorization code. The one-time code a browser brings back to your redirect URI after a person signs in. Your application exchanges it for tokens. See Add sign-in to an app.

Autonomous agent. An agent that acts as itself. A group, its approval group, answers for it. See How agent sign-in works.

B

Binding message. The one short sentence a person reads before they approve an agent's CIBA request. See Ask a named person to approve.

Brake. A switch in the cluster, held by the cluster owner, that stops the nodes denying anything while they keep recording. See How enforcement works.

C

Capability. A permission named on one agent, such as transfer:accounts, that can carry limits on the details of that action. The agent holds the permission itself through a role, as a person does. The console calls a capability a permission and lists an agent's on its Permissions tab. See Limit what an agent may do.

CIBA. OpenID Connect Client-Initiated Backchannel Authentication. An agent asks one named person to approve, the person answers on their own device, and the agent receives a token that names that person. See Ask a named person to approve.

Classify. The second Zero-Code step. You say what a workload is, an App, an AI agent or System, and what it serves. See How Zero-Code works.

Claim. A named value inside a token, such as sub, aud or groups. See Tokens and claims.

Client assertion. A short statement an agent signs with its private key to prove who it is when it signs in. It is accepted once and expires within 5 minutes. See Give an AI agent an identity.

Client credentials. The OAuth grant a backend service uses to sign in as itself, with no person involved. See Get an access token for a backend service.

Client ID. The identifier of an application, generated when you register it. An agent's client ID is its agent ID, which starts with agt_. See Application types and redirect URIs.

Client secret. The secret a web or m2m application uses to authenticate at the token endpoint. It is shown once, when it is created. See Application types and redirect URIs.

Connection. A link to another identity provider that lets people sign in to your project with an account they already have there. See Add sign-in with another identity provider.

D

Delegated agent. An agent that acts for one named person, its owner. See How agent sign-in works.

Discovery document. A JSON document a project publishes under /.well-known/ that lists its endpoints, so a client reads them from the project. See Discovery documents.

E

Enforce mode. The mode in which Zero-Code rules are applied, so a request or a connection can be denied. Turn on protection… in the console puts a workload's rules in enforce mode. See How enforcement works.

Entity ID. The identifier of a SAML identity provider or service provider. See Connect a SAML application.

G

Grant. One subject's access to one particular thing, such as an application, a cloud role, a server or a tool. A grant can carry an end date. See Roles, groups and grants.

Group. A set of people, agents and other groups. Grant something to a group and every member has it. See Roles, groups and grants.

H

Handle. The console's name for a SAML application's short name. It is part of the application's URLs and cannot be changed. See Connect a SAML application.

I

ID token. A signed token that tells an application who signed in. An application receives it after a person signs in with the openid scope. See Tokens and claims.

Identity provider. The system that signs a person in and vouches for them to an application, often shortened to IdP. Your project is one. See Connect a SAML application.

Issuer. A project's URL, for example https://acme.authfi.io. It appears as iss in every token the project signs. See Projects and issuers.

J

JWKS. A JSON Web Key Set (RFC 7517): the project's public signing keys, published at /.well-known/jwks.json. A service uses it to verify a token's signature. See Keys and secrets.

JWT. A JSON Web Token, the signed format of ID tokens, access tokens, transaction tokens and client assertions. See Tokens and claims.

L

Limit. A condition on the details of an action, attached to a capability, such as a maximum amount. AuthFI checks it each time the agent acts. See Limit what an agent may do.

M

MCP gateway. The project's endpoint, at /mcp, that agents call tools through using the Model Context Protocol. It checks each call against what the agent was granted and holds the tools' credentials. See The MCP gateway.

MFA. Multi-factor authentication: signing in with more than one method, for example a password and a one-time code. See Manage sessions, sign-out and MFA.

Monitor mode. The mode in which Zero-Code denies nothing and records what it would have denied. A workload's saved rules stay in it until you turn protection on. See How enforcement works.

N

NameID. The identifier for the person in a SAML assertion. By default it is the person's email. See Connect a SAML application.

Node agent. The Zero-Code component on a cluster. One copy runs on every node and loads programs into the node's kernel. See Install Zero-Code on a cluster.

O

Observe. The first Zero-Code step. The node agent discovers a workload and watches it for 24 hours before it can be protected. See How Zero-Code works.

OpenID Connect. The standard an application uses to sign a person in and receive an ID token. See Add sign-in to an app.

Owner. The person who answers for an agent. A delegated agent acts for its owner. See How agent sign-in works.

P

Permission. An action on a kind of thing, such as read:audit. Roles are made of permissions. On an agent's page, the console also uses permission for what these docs call a capability. See Roles, groups and grants.

PKCE. Proof Key for Code Exchange (RFC 7636). It ties a sign-in to the application that started it: the application sends the hash of a random secret, then proves it holds the secret. See Add sign-in to an app.

Project. One complete identity provider at one URL, with its own people, keys and tokens. See Projects and issuers.

Protect. The third Zero-Code step. You decide who may reach a workload, then turn protection on, which puts its rules in enforce mode. A workload with protection on is protected. See How Zero-Code works.

R

Redirect URI. The URL in your application that AuthFI sends the person back to after they sign in. It must match a registered value exactly. See Application types and redirect URIs.

Refresh token. A token an application uses to get new tokens without another sign-in. It lasts 30 days by default and works once. See Manage sessions, sign-out and MFA.

Resource. The resource parameter of a token request. It names the one service the token will be used at, and becomes the token's audience. See How agent sign-in works.

Role. A named set of permissions, such as Administrator or Auditor, bound to a person or a group. See Roles, groups and grants.

Rule. A condition, set for the whole project, that denies an action or makes it wait for a person. See Limit what an agent may do.

S

SAML. SAML 2.0, a standard for single sign-on. Your project can be the identity provider for a SAML application, or the service provider for a SAML connection. See Connect a SAML application.

SCIM. SCIM 2.0 (RFC 7644), a standard that lets one system keep another's list of people current. See Provision people with SCIM.

Scope. A value an application sends in scope to say what it is asking for, such as openid, profile or email. See OAuth and OpenID Connect endpoints.

Service provider. In SAML, the application a person signs in to, often shortened to SP. It trusts an identity provider to sign the person in. See Connect a SAML application.

Session. What a project keeps for a person after they sign in. Tokens are issued from it, and each names it in sid. See Manage sessions, sign-out and MFA.

SSO. Single sign-on: people sign in to an application with their AuthFI account instead of a separate password. See Connect a SAML application.

Subject. Whoever holds a role or a grant, written as a kind and an ID: user:, group:, agent: or app:. See Roles, groups and grants.

T

Tape. The Tape tab of the MCP gateway in the console. It lists each tool call with its caller, tool and verdict. See The MCP gateway.

Target. The console's name for a server registered for server access. See Set up server access with SSH certificates.

Transaction token. A token that names one action and its details. An agent exchanges its access token for one before a sensitive action, and it lasts 60 seconds. See Ask before a sensitive action.

W

Webhook. A call from your project to your server when something happens, such as a person being created. See Receive webhooks.

Z

Zero-Code. The AuthFI product that puts sign-in and access rules in front of services on Kubernetes without changing them. See How Zero-Code works.