§01 · Start
Concepts & vocabulary
Every term you'll meet in the rest of the docs, in one place.
The mental model
A request reaches an agent runtime in your cluster. Before and during the run, a governance layer decides what the agent knows and may do: its skills, per-tool policies, and memory. The agent acts on connected tools and data through credential-safe connections. Every input, decision, and action streams back to Exo, audited and replayable.
Control plane & operator
- Control plane. The Exo backend, dashboard, and Postgres. It serves the UI and API, holds identity and audit, and never runs your agents. You run it yourself (Deploy & operate).
- Exo Operator. A Kubernetes operator you install in each workload cluster. It reconciles the custom resources into running pods and connects to the control plane over one outbound connection, no inbound port.
Agents, tools & skills
- Agent. A coding or automation agent expressed as a Kubernetes object. It declares a runtime (ClaudeCode, Codex, OpenCode, …), a goal, a model, and the tools it may use. See Agents & runtimes.
- Run or connect. Fire a run of an agent in the background and read the session after, or connect to it live and work alongside it.
- Tool. A managed connection to a database, cluster, host, or API. At call time the right client and the credential are injected at the boundary. The agent never sees the secret. See Tools & connectors.
- Skill. A reusable Markdown capability bundle. Author it by hand or have Exo generate it, then sync it into agents and developer laptops. See Skills.
- Provider. An LLM gateway (Anthropic, OpenAI, OpenAI-compatible) that an agent's model binding resolves through. See Model providers.
Sessions vs events
Two distinct audit streams. Keep them straight:
- Session. What happened inside an agent run: tool calls, checkpoints, and terminal I/O. Shell sessions are recorded and replayable.
- Event. What happened on the platform: who logged in, who connected to which agent, who changed a resource. Searchable and exportable.
Credentials at a glance
Exo issues a few credential types, each scoped to a different actor:
- User A signed-in person, via password or SSO.
- Deployment token. One per connected cluster, used by the operator.
The Auth model overview covers when to reach for each.
Glossary
- autonomic.sh. The API group for Exo's custom resources.
- Runtime. The agent CLI that runs in the pod (e.g. ClaudeCode).