Core Concepts

These are the terms this documentation uses. Skim them once; every later section builds on this vocabulary. Each links to its deeper reference page.

Term	What it means
Agent / identity	Any AI actor Behavry governs — an autonomous agent, an IDE/CLI, a browser, a SaaS connector, or a desktop endpoint. Each is bound to an identity (client credentials) at enrollment. See Agent Identity.
Role (RBAC)	A permission token attached to an identity (for example database:read). Roles are what your policy rules match. An agent with no roles can do nothing.
Policy	The rules that decide each action. Behavry evaluates policy with OPA (Open Policy Agent); you author intent in the dashboard, not raw Rego. See Policy Engine.
Decision	The outcome of evaluating one action: allow, modify, block, or escalate.
MCP proxy	The agent-facing endpoint (.../mcp/v1) that authenticates and enforces every tool call an agent makes.
Decision Trace	The tamper-evident audit record of one action — what was requested, which policy fired, and the outcome. See Decision Trace.
Session / Workflow	Groupings of agent activity: a session is one run; a workflow is an orchestration of steps across agents. See Workflows.
Baseline / drift	A learned model of normal behavior for an agent, and how far current behavior departs from it. See Behavioral Monitor.
Escalation	An action a policy holds for human approval instead of deciding automatically. See Alerts & Escalations.
Coverage	How much of your AI surface is enrolled and governed, shown as a percentage across the product.

Least privilege is the default

A newly enrolled agent with no roles can do nothing — every action is denied until you grant a role. Start narrow and widen deliberately. This is the safe default, not an error.