Glossary
Core architecture
Control plane
The Exo dashboard, API, and database. Holds identity, rules, and audit. Never runs agents. See Architecture.
Exo Operator
The component installed in each workload cluster. It manages the agent lifecycle through Kubernetes custom resource definitions (CRDs) and connects outbound to the control plane. See Exo Operator overview.
Deployment
A logical partition of resources within a tenant. A tenant can contain multiple deployments. Agents in the same deployment are mutually reachable over the network. See Connecting.
Organization
Your company's Exo account, and the line data never crosses. Users, agents, tools, and every setting belong to one organization. An organization can contain multiple tenants. A person can belong to multiple organizations, with a separate account in each.
Agents & resources
Agent
An AI worker defined once and run many times: a runtime, a model, a goal, and the things it may reach. See Agents.
Runtime
A sandboxed agent execution environment, such as ClaudeCode, Codex, or OpenCode. See Runtimes.
Skill
A reusable instruction file, written once and attached to any number of agents. See Skills.
Memory
Persistent context across sessions for every agent. See Memory.
Policies · Guardrails
Rules governing agent permissions, safety constraints, security and privacy controls, compliance requirements, decision authority, human-oversight triggers, and request-approval workflows. They enforce least-privilege access across tool calls, file-system operations, and other sensitive actions, and can be defined in YAML, JSON, or Rego. See Runtime policies.
Tool
A mechanism for connecting agents to databases, VMs, servers, Kubernetes clusters, and remote desktops (RDP) with native protocols. The agent never sees the secret when connecting to the resources. See Tools.
MCP server
A mechanism for connecting agents to databases, SaaS applications, internal services, VMs, servers, Kubernetes clusters, and remote desktops (RDP) through the Model Context Protocol.
MCP proxy
A custom MCP endpoint that enforces least-privilege access by exposing a curated selection of tools composed from one or more registered MCP servers. See MCP servers.
Integration
A workplace app connection (Slack, Teams). Exo holds the keys and exposes named actions.
Provider
A model account (Exo Provider, Anthropic, OpenAI, or compatible) that agents' model calls resolve through, configured with that provider's API key.
LLM gateway
Meters model usage and enforces budgets in front of your providers. See LLM gateways.
Policy
Rules defined that gates an agent before it acts. Tool calls, commands, and file access are allowed, denied, or held for a human to approve. See Policies.
Identity & access
User
A person. One account per person per organization.
Admin user
A user holding the Admin role, which can manage members, roles, deployments, and policies. Admin is a role on a normal user account, not a separate kind of account. See Roles & permissions.
Service account
An account for machines and automations, provisioned through OAuth Apps. See Auth model overview.
SSO
Signing in to Exo through your own identity provider, so people use their existing company login. It creates the same kind of user account a password login does. Supported protocols: SAML 2.0 and OpenID Connect (OIDC). See SSO.
Directory sync
Your identity provider keeping Exo's users and groups up to date, over SCIM or a scheduled LDAP pull. See Directory sync and SCIM provisioning.
Role
A defined set of permissions that determines a user's access within an organization. Admin and Member are system roles and cannot be modified. Custom roles can be built from the permission catalog. See Roles & permissions.
Group · Team
A set of users. Put a team on an agent's or skill's access list and everyone in it can use that agent or skill. Being in a team never changes anyone's role. Teams are authored in the dashboard; groups sync from your directory. See Teams and groups.
Workflows & audit
Run · Session
A recorded agent execution that can be reviewed and replayed. See Running an agent and Sessions & replay.
Schedule
A time-based trigger that runs an agent automatically at a defined interval or cron schedule. See Schedules.
Webhook
An HTTP integration that triggers an agent from an external request or calls back an external system when a run completes. See Agent webhooks.
CLI (exo)
The platform from a terminal. Same account, same permissions, same audit. See The exo CLI.
Event
A record of activity, including platform events, agent audit logs, and tool-call logs. See Events & audit search.
New to these terms? Core concepts shows how they fit together.