Eden Glossary

This reference defines the product, governance, identity, and API terms used throughout the Eden documentation. Product pages explain outcomes; this page provides the shared vocabulary.

A

Adam

The Eden product for governed AI work. Adam lets licensed users, agents, and gateway keys use models and endpoint tools through policy-controlled model routing, tool calling, evidence, and cost attribution. Adam uses Eve-managed endpoints and never replaces Eve endpoint authorization.

Agent

A non-human caller or AI runtime that acts through Eden. An agent integration can authenticate with a service identity, run as an Adam runtime agent, or use a gateway key. An agent is a caller identity or client integration, not a new backend endpoint kind.

Approved Operation

A fixed, governed operation represented by a template, published API, or workflow. Approved operations constrain the shape of work but do not grant endpoint access on their own.

API Key

A credential that identifies a calling application, service, or gateway client. In Adam, a gateway API key can carry model-routing and governance policy. API keys remain subject to organization and product entitlements.

B

Backend Profile

An endpoint lane that selects the routing, credential, pool, and policy posture used for a request. The standard profiles are production and development; development is used for supported masking-heavy or inspection-heavy endpoint traffic without changing the logical endpoint name.

Bearer Token

A JSON Web Token sent in the HTTP Authorization header, for example Authorization: Bearer .

C

Control Plane

The authorization plane for configuring Eden resources such as organizations, endpoints, templates, policies, and grants. Control-plane permissions use the uppercase bits R, C, P, G, D, and A.

Custom PII Term

A literal or regular-expression term supplied for a specific Adam gateway key. It augments, rather than replaces, built-in PII detection and organization PII dictionaries for that key's governed AI traffic.

D

Data Plane

The runtime authorization plane that governs which operations a caller can perform against an endpoint. Shared-mode permissions use lowercase r, w, and x; endpoint-level security can instead enforce the target system's identity and permissions.

E

Eden

The shared governance platform behind Eve, Adam, and Exodus. Eden provides organization-scoped identity, endpoint access, policy enforcement, credentials, and evidence across those product experiences.

Endpoint

A named, organization-owned connection to an external system. An endpoint holds the provider-specific configuration and keeps backend credentials out of client applications. Eve applies endpoint governance before work reaches the backend.

Endpoint Kind

The backend type configured for an endpoint, such as Postgres, Redis, Http, Llm, Aws, or Databricks. The kind determines the supported connection, request, policy, and operation shapes.

Endpoint-Level Security (ELS)

An endpoint authorization mode that delegates data-plane enforcement to the target system using an injected caller identity or credential. ELS complements Eden control-plane RBAC; it does not make a backend credential available to the client.

Eve

The Eden product for governed endpoint access. Eve manages endpoint onboarding, credentials, RBAC, templates, published APIs, workflows, native gateway listeners, traffic controls, and endpoint evidence.

Exodus

The Eden product for migration lifecycle management. Exodus owns planning, validation, data movement, write-log replay, cutover, rollback, and migration evidence. It uses Eve endpoints and listeners but does not turn listener configuration into migration configuration.

External Identity

An identity issued by another provider that Eden validates and maps into an organization-scoped authorization context. External identity providers use OIDC claims and group mappings; they are evidence for Eden authorization, not automatic broad access grants.

G

Gateway API Key

An Adam API key used with the OpenAI-compatible gateway. It can select model routes and attach gateway governance such as PII terms, template lookup, content policy, work metadata, and cost controls.

I

Interlay

An Eve-managed native protocol listener. An interlay gives a client a stable Eve address while Eve applies endpoint identity, RBAC, command policy, masking, mirroring, and telemetry before forwarding traffic to the primary endpoint.

M

Model Route

A stable Adam-facing name that resolves to an Eve-managed model-provider endpoint and its configured policy. A model route changes how a model request is served; it cannot grant access to denied endpoints or tools.

Masking

A pre-egress control that redacts or blocks configured request content. Eve traffic masking applies to supported interlay request surfaces; Adam PII redaction applies to governed LLM-gateway requests and responses. They are additive controls with different request surfaces.

Mirroring

An Eve interlay capability that asynchronously sends eligible traffic to a compatible secondary endpoint while the client continues to receive the primary endpoint's response. Mirroring provides validation and compatibility evidence; it does not change the primary response path.

O

OIDC (OpenID Connect)

The standard Eden uses to validate tokens from supported external identity providers, including Okta, Microsoft Entra ID, Google, Auth0, AWS Cognito, Keycloak, OneLogin, PingOne, and generic OIDC providers.

Organization

The top-level tenant and ownership boundary in Eden. Users, agents, endpoints, templates, policies, workflows, and evidence are organization-scoped.

P

PII Dictionary

An Adam organization-level collection of literal or regular-expression PII terms. Dictionary terms are combined with built-in PII detection, key-specific terms, and any lookup-derived terms before governed model-provider egress.

PII Redaction

Adam's LLM-gateway protection for personally identifiable information in governed AI requests and responses. Depending on policy, a detected value can be allowed, audited, redacted, or blocked. It is distinct from Eve endpoint traffic masking.

Published API

An application-facing, approved operation exposed from a template or workflow. Published APIs give application clients a stable Eden route while preserving the underlying identity and endpoint authorization checks.

R

RBAC (Role-Based Access Control)

Eden's permission model for organization and resource access. RBAC grants are evaluated in the control plane for configuration and in the data plane for endpoint use; a route, template, or model configuration does not bypass either check.

Runtime Agent

An Adam-managed AI actor with governed model access, tools, approvals, work metadata, and trace evidence. It represents an AI workload and its operating policy, rather than the credential that authenticates a connection.

S

Service Agent

A non-human Eden principal used by an application or automation to authenticate and act under a scoped identity. A service agent is distinct from an Adam runtime agent.

Subject

The user, service agent, runtime agent, or other principal evaluated by Eden authorization policy.

T

Template

A reusable, parameterized definition for a fixed endpoint operation. Templates can be Read, Write, or transaction-capable. They are commonly used to constrain application and AI work to approved request shapes.

Template-Backed PII Lookup

An Adam gateway policy that runs a saved Eve Read template with request-derived inputs, then converts configured output values into request-scoped redaction terms before the model request leaves Eden. Lookup terms are additive and are not persisted to a shared dictionary.

Tool Calling

An Adam execution mode where a model requests a governed operation and Eden authorizes, runs, and records the permitted endpoint, template, API, or workflow action before returning its result to the model.

Traffic Masking

The Eve feature that applies configured request dictionaries and structure-aware rules to supported interlay traffic before backend egress. See also Masking.

Traffic Mirroring

The Eve feature that asynchronously duplicates eligible interlay traffic to secondary endpoints for validation or compatibility analysis. See also Mirroring.

V

VPN

Eden's WireGuard-based private transport surface. VPN peers can reach selected Eve native gateway listeners while Eden remains in the request path for identity, RBAC, endpoint policy, masking, and audit.

W

Workflow

A durable, multi-step orchestration definition composed from approved actions. Workflows coordinate work around endpoints, templates, published APIs, approvals, and notifications; they do not replace Exodus migration state machines.

Work Metadata

Structured context attached to a governed Adam request, such as workflow, environment, customer segment, or business process. Policies can use it to select controls and generate safe evidence without recording prompt text.

Permission Bits

Control-Plane Permissions

Shared-Mode Data-Plane Permissions

Endpoint Families

Related Docs

• Products Overview
• Endpoint Governance
• Authentication
• Workflows, Templates, And APIs
• API Overview
• Error Responses