| Term | Meaning |
|---|---|
| Agent | An AI coding tool running on a machine, such as Claude Code, Cursor or Codex. The endpoint recognises it and attributes its activity to it. |
| Session | One run of an agent on one machine, from start to stop. Everything the agent does belongs to a session. |
| Action | One thing an agent did: a tool call, a file read or write, a shell command, a network connection. Each action carries a risk score and, when a rule matched it, a decision. |
| Declared intent | What an agent said it was about to do, recorded from the agent’s own tool call before it ran. |
| Observed behaviour | What the machine then saw happen: the process, the files, the destinations. |
| Divergence | A gap between declared intent and observed behaviour. Divergence is how Quint finds risk; it is the mechanism’s name, not the headline. |
| Finding | One divergence the platform recorded, shown under the risk it represents (for example “Credential read, then egress”). Findings are what you investigate. |
| Risk score | A number from 0 to 100 on an action or a session. It is a supporting signal for triage, not the thing that enforces. |
| Watch profile | Retired. Sensitive-path settings an organisation already declared still reach its machines; an administrator inspects or changes them through the API. |
| Recap | A scheduled summary of policy activity, as counts and rule names only, sent to one Slack, Teams or alert-webhook destination. Covers whole UTC days. Shown on Policies › Alerts as a scheduled summary. See Alerts. |
| Match threshold | Part of a recap: alert after N refuse matches during each fixed UTC hour, 6-hour block, day or ISO week. A refuse match is a match a rule would have refused in shadow mode, or did refuse when armed. A crossed threshold is a notification, not an incident. |
| Ruleset (policy pack) | A versioned, signed set of rules with a review-and-publish step. Each published version has a serial. |
| Rule | One disposition (ask, refuse, or record) over conditions across up to six matcher kinds. Conditions of different kinds are all required; within one kind, any one is enough. |
| Match | A rule noticed an action. A match is evidence, not a verdict: it does not mean the action was wrong. |
| Shadow mode | The mode every ruleset starts in. Rules only record. The dashboard shows what each rule would have done: “would have asked”, “would have refused”. |
| Enforcement | A ruleset that is armed asks or refuses at the moment of the action. Arming needs a workspace-level switch and a per-pack mode, and an owner or admin. |
| Approval | A tool call a workload’s policy held for a person to decide. Approvals wait in the Approvals inbox and, when a channel is connected, in Slack or Teams. An approval nobody decides expires and is denied. |
| Incident | A grouped set of related findings or alerts that a person tracks to resolution. |
| Workload | A named group of agents that run in containers. It uses your organisation’s rules and has its own runs, keys, approvers and network settings. See Workloads. |
| Run | One start of a container under a workload, from start to stop. Each run is listed on the workload’s Runs tab, and its tool calls, connections and approvals are on the run’s own page. |
| Workload key | The secret a container presents to register its runs under a workload. Created on the workload’s Keys tab and shown once. Revoking or rotating a key stops the runs it started at their next heartbeat. |
| Heartbeat | The regular check-in a machine or a running container sends to Quint. A container run sends one about every 30 seconds. A stop, a revoked key or a changed network setting reaches a run at its next heartbeat. |
| Machine | One enrolled device. Listed under Data Sources. |
| Install package | The files an owner or admin makes in Add machines for a group of computers, holding a join code and the license. Downloadable once. Listed in Settings › Machines & licensing, where stopping it ends new joins and leaves joined computers running. |
| Install code | A one-time code an owner or admin makes in Add machines to add one computer. Shown once; stops working after 24 hours. |
| Owner, Admin, Policy Writer, Read | The four roles, highest first. Each role can do everything the one below it can. Read members see all workspace data; Policy Writers also triage findings and change the risk score limit; Admins also invite members, mint tokens, connect integrations and arm enforcement; the Owner also transfers or deletes the workspace. See Roles and permissions. |
| Retention | How long each class of data is kept. Findings are kept 14 days, events 14 to 45 days, sessions 365 days. The full table is under Settings › Data & retention and in Workspace and data. |
| Sentinel | The AI analyst in the dashboard. It answers questions from your workspace’s own rows, with citations, and can draft rules that open in the normal editor for you to save. |
| Unknown | A value the platform did not measure. The dashboard shows it as unknown, never as zero. An empty list is not an all-clear. |
Reference
Glossary
The words the dashboard uses, and what each one means.
The dashboard uses these words precisely. The docs use them the same way.