# Glossary

_Last updated: July 8, 2026_

The vocabulary of Waydock in one place: the core model, the words agents and admins meet when connecting and governing access, the security terms, and Pulse. Where a term has its own page, this links to it.

> **For agents:** this page is available as Markdown at [/docs/glossary.md](/docs/glossary.md). For the full model see [How Waydock works](/docs/concepts); for permissions see the [Tool reference](/docs/tools).

## The core model

| Term | Meaning |
| --- | --- |
| **Card** | The common unit for any synced item (email, calendar event, meeting, task, Teams message). One queue that agents and the app both read; a card's `CardSource` names where it came from. |
| **Context layer** | Waydock's core idea: your accounts unified into one governed context you hand to an agent, instead of many separate grants across many tools. |
| **Org / tenant** | The unit of tenancy. Every account starts as a personal org (one member); a personal org can convert to a team, one way, gated to the owner. |
| **Follow-up** | A hanging commitment: a reply you are waiting on ("Theirs"), one you owe ("Mine"), or an action item from a meeting. |
| **Mira** | Waydock's in-app AI assistant (the right-hand chat rail). It runs the same tool registry and the same guardrails as the MCP server. |
| **Morning brief** | An AI-composed daily digest, delivered by email, webhook, or Telegram. |

## Connecting an agent

| Term | Meaning |
| --- | --- |
| **MCP** | Model Context Protocol: how external agents connect to Waydock, over Streamable HTTP at `/api/mcp/stream`. |
| **MCP key** | A per-user bearer key (`wdmcp_...`, or the legacy `ddmcp_...`) carrying an explicit scope set. Shown once, revocable, and audited on every call. See [Authentication](/docs/authentication). |
| **Scope** | A namespaced permission (`read:*` or `write:*`). Granting a write scope also grants the read access it builds on: `write:mail.send` implies `write:mail.drafts`, which implies `read:mail`. |
| **Preset** | A named scope bundle chosen when minting a key: "Read & email myself" (the free default) or "Full access" (Pro). |
| **Self-send** | `write:mail.send.self`, a free scope that can only email your own verified inboxes. Distinct from `write:mail.send`, which reaches third parties. |
| **Wildcard-proof scope** | A scope (`write:mail.send`, `write:teams.send`) that no preset or wildcard can satisfy; it must be granted as a literal string. |
| **Entitlement** | A plan-derived capability checked at call time (for example `mcp_write`, `mira`, `ai_summaries`), so a downgrade takes effect at once rather than at the next key rotation. |

## Security

| Term | Meaning |
| --- | --- |
| **Provenance gating** | Once an agent's turn reads untrusted external content, its write and destructive tools are removed for the rest of that turn. Waydock's core prompt-injection defense. See [Security architecture](/docs/security-architecture). |
| **Trusted vs untrusted content** | A per-tool flag (`trustedContentSafe`). Untrusted output, like an email body or a transcript, is wrapped in an `<external_content trusted="false">` envelope and taints the rest of the turn. |
| **RLS** | Postgres Row-Level Security. Waydock enforces org-level and per-member (org AND user) isolation at the database, fail-closed. Per-member isolation is logical, not cryptographic. |
| **DEK / KEK** | Data-encryption key and key-encryption key. Waydock envelope-encrypts sensitive columns: an AWS KMS master key (the KEK) wraps per-purpose DEKs. |
| **Step-up (sudo)** | A fresh re-authentication required before sensitive actions, valid for a short window. |
| **Direct Source Fetch** | Pro-only, governed backfill of mail beyond the live index window, through consent, then a grant, then jobs. |

## Pulse

| Term | Meaning |
| --- | --- |
| **Pulse** | Waydock's uptime and status-monitoring product. See [Pulse](/docs/pulse). |
| **Monitor** | A Pulse active HTTP probe against a target URL on a schedule. |
| **Node** | A Pulse device or job that reports in by heartbeat; going silent past its grace window trips a dead-man's-switch. |

## Canonical facts

- Domain: **waydock.ai**. Made in **Melbourne**.
- Every page under `/docs` is available as Markdown to agents: append `.md` to any page, or read [/llms.txt](/llms.txt).

## See also

- [How Waydock works](/docs/concepts) for the model in full
- [Tool reference](/docs/tools) for every tool and scope
- [Security architecture](/docs/security-architecture) for the security terms in depth