Glossary
Core architecture
Control plane
The Industric dashboard, API, and database. Holds identity, rules, and audit. Never runs agents. See Architecture.
Industric Operator
The component installed in each workload cluster. It manages the agent lifecycle through Kubernetes custom resource definitions (CRDs) and connects outbound to the control plane. See Industric Operator overview.
Deployment
A logical partition of resources within a tenant. A tenant can contain multiple deployments. Agents in the same deployment are mutually reachable over the network. See Connecting.
Organization
An Industric workspace, also called a tenant. Its users, resources, and settings belong to that workspace. A person can belong to multiple organizations, with a separate account in each.
Agents & resources
Agent
An AI worker defined once and run many times: a runtime, a model, a goal, and the things it may reach. See Agents.
Runtime
A sandboxed agent execution environment, such as ClaudeCode, Codex, or OpenCode. See Runtimes.
Skill
A reusable instruction file, written once and attached to any number of agents. See Skills.
Memory
Persistent context across sessions for every agent. See Memory.
Policy bundle
A named group of resource policies with shared coverage, rollout, and assignments. Its members hold the rules. See Resource policies.
Guardrails
Instructions included in agent prompts to guide behavior. They are not hard access controls. See Guardrails.
Tool
A mechanism for connecting agents to databases, VMs, servers, Kubernetes clusters, and remote desktops (RDP) with native protocols. Credentials are supplied to the tool, which may expose them in its output. See Tools.
MCP server
A mechanism for connecting agents to databases, SaaS applications, internal services, VMs, servers, Kubernetes clusters, and remote desktops (RDP) through the Model Context Protocol.
MCP proxy
A custom MCP endpoint that enforces least-privilege access by exposing a curated selection of tools composed from one or more registered MCP servers. See MCP servers.
Integration
A workplace app connection (Slack, Teams). Industric holds the keys and exposes named actions.
Provider
A model account (Industric Provider, Anthropic, OpenAI, or compatible) that agents' model calls resolve through, configured with that provider's API key.
LLM gateway
Meters model usage and enforces budgets in front of your providers. See LLM gateways.
Policy
Rules for one resource kind: tool, MCP, command, or gateway. They allow, deny, require approval, or redact on supported enforcement paths. See Policies.
Identity & access
User
A person. One account per person per organization.
Admin user
A user holding the Admin role, which can manage members, roles, deployments, and policies. Admin is a role on a normal user account, not a separate kind of account. See Roles & permissions.
Service account
An account for machines and automations, provisioned through OAuth Apps. See Auth model overview.
SSO
Signing in to Industric through your own identity provider, so people use their existing company login. It creates the same kind of user account a password login does. Supported protocols: SAML 2.0 and OpenID Connect (OIDC). See SSO.
Directory sync
Your identity provider keeping Industric's users and groups up to date, over SCIM or a scheduled LDAP pull. See Directory sync and SCIM provisioning.
Role
A defined set of permissions that determines a user's access within an organization. Admin and Member are system roles and cannot be modified. Custom roles can be built from the permission catalog. See Roles & permissions.
Group · Team
A set of users. Put a team on an agent's or skill's access list and everyone in it can use that agent or skill. Being in a team never changes anyone's role. Teams are authored in the dashboard; groups sync from your directory. See Teams and groups.
Workflows & audit
Run · Session
A recorded agent execution that can be reviewed and replayed. See Running an agent and Sessions & replay.
Schedule
A time-based trigger that runs an agent automatically at a defined interval or cron schedule. See Schedules.
Webhook
An HTTP integration that triggers an agent from an external request or calls back an external system when a run completes. See Agent webhooks.
CLI (exo)
The platform from a terminal. Same account, same permissions, same audit. See CLI.
Event
A record of activity, including platform events, agent audit logs, and tool-call logs. See Events & audit search.
New to these terms? Core concepts shows how they fit together.