Security glossary
Terms used across the security architecture and permissions pages.
Terms
| Term | Meaning |
|---|---|
| Application tier (“App” in diagrams) | The Context API servers. They make every authorization decision for requests from sandboxes. |
| Agent sandbox | A Kubernetes Pod in which one agent runs for one task run. Treated as untrusted. |
| Pooled sandbox | A sandbox started in advance, with no task or identity, waiting to be claimed. |
| Harness | The program that runs the agent loop inside the sandbox. See Harness. |
| Enforcement point | A component that checks a request and allows or refuses it based on a decision from the application tier (NIST SP 800-207: policy enforcement point). |
| Egress setting | The installer setting that governs sandbox outbound traffic: open, domain allowlist or workspace only. |
| Egress proxy | The Envoy deployment through which sandbox outbound traffic passes when it is deployed: only with Sandbox Workload Identity or Sandbox Egress Proxy (domain allowlist) on, both off by default. With identity on it adds model credentials; under the domain-allowlist setting it limits destinations. |
| Drive gateway | The Caddy deployment that carries file transfers between sandboxes and Amazon S3 after the application tier authorizes each request. |
| Connectors gateway | The part of the application tier that authorizes each connector tool call and issues a token for that call to the connectors service. |
| Connectors service | The deployment that runs MCP connector calls to your systems and third parties. |
| Workload identity | The identity a sandbox proves to the application tier through its sidecar; afterwards recognized by source Pod IP. |
| Identity epoch | One live registration of a sandbox’s identity, created at the claim and revoked before deletion. |
| IRSA | IAM roles for service accounts: AWS credentials granted to a Kubernetes ServiceAccount. |
| Approval request | A request for a person to allow or deny an agent action; the decision is signed by the application tier. |
| Indirect prompt injection | Instructions hidden in content an agent reads, intended to change its behavior (OWASP LLM01). |
Harness
The harness is the program that runs the agent loop inside the sandbox. The installer setting Use OhMyPi for new tasks chooses the engine for new tasks only:
| Value | Harness for new tasks |
|---|---|
| On (default) | The native Context engine |
| Off | OpenCode |
Existing tasks keep the engine they started with when they are continued, restored or reopened. Both harnesses run inside the same sandbox, under the same network policy and the same application tier checks.