Glossary
Definitions for the terms Agent Authority uses: tenants, workspaces, agents, agent instances, resources, connections, policies, tags, and credential modes.
One-line definitions for the terms SecureAuth Agent Authority uses across these docs, each linking to the page with the full explanation.
Tenant
Your organization's own instance of SecureAuth Agent Authority — its users, resources, policies, and audit data, isolated from every other organization's. Tenants are provisioned by SecureAuth; see Getting a tenant.
Workspace
The area of the SecureAuth admin console where you administer Agent Authority — managing users, adding resources, and writing policies. In the console it's labeled Agentic AI. See Identity and sign-in.
Agent
An AI coding tool or assistant — Claude Code, Cursor, GitHub Copilot, Codex, and others — that connects to the gateway via MCP to call tools, typically on behalf of a user. See Agent integrations for every supported agent.
Agent instance
One specific connected client of an agent — for example, one developer's Claude Code session. Each instance has its own identity and is registered to the user who authorized it. A policy scoped to the agent applies to every instance, current and future; one scoped to an instance applies to that connection alone. See Agent Registry.
Resource
An MCP server that exposes tools to your agents through the gateway — Slack, GitHub, Jira, or any other service you add from the catalog or as a custom server. See How resources work.
MCP
The Model Context Protocol (MCP), the open standard agents use to call external tools. Each resource runs an MCP server; the gateway is an MCP server to your agents and an MCP client to every resource it aggregates. See How it works.
Connection
The link between one user's personal account and a third-party service, created the first time an agent needs it. Each user authenticates separately, so every upstream call that uses a connection carries that user's own credentials. See Connections.
Policy
The set of rules that decides which tools an agent can call, for which users, under what conditions. Without any rules, all requests are denied by default. See Policies.
Rule
One entry in a policy: an effect (allow or deny), a scope (agent, user, group, MCP, tools), and an optional condition. Rules are evaluated top-to-bottom, and the first match wins. See Creating a rule.
Data protection
The DLP layer that rewrites the text of a tool's response — masking things like SSNs or API keys — after a policy has already allowed the call. Its response filters are a separate entity from policy rules: they never decide whether a call runs, and every matching filter applies rather than only the first. See Data Protection.
Tag
A named, colored label attached to an agent, resource, or tool, used to write policy rules that match a class of entities instead of naming each one. See Tags.
Credential mode
How your organization tells the gateway which OAuth app to use when a catalog resource starts a user's sign-in flow — SecureAuth's app, per-org dynamic registration, or your own. Chosen once, at install time. See Credential modes.
Identity provider
Whatever tells the gateway who a user is. By default that's your workspace's own identity pool in SecureAuth Connect; organizations that already run a standards-based OIDC or SAML directory can federate it instead. See Identity and sign-in.
Telemetry
OpenTelemetry data that coding agents like Claude Code and Codex emit about their model usage — tokens, cost, sessions, and requests. Point it at the gateway with an ingest key and it powers the LLM Usage analytics tab. See Telemetry.
Gateway endpoint
The single URL your agents point at to reach every connected resource's tools — /gateway/mcp by default, or /gateway/mcp/{slug} to scope a connection to one MCP. See Connect an agent.