Glossary
| Term | Definition |
|---|---|
| Organisation | The only customer account and governance boundary. Owns billing, members, groups, the toolkit catalogue, governance, audit, and usage. |
| Member | A person's membership in an organisation. The organisation roles are owner, admin, and member. |
| Owner | An organisation member with ownership control, including granting or revoking the Admin role and managing organisation billing. An organisation always has at least one owner. |
| Admin | An organisation member who manages members, groups, toolkits, Org Agents, integrations, and governance. An admin cannot grant or revoke ownership. |
| External member | A gateway and API-only principal (such as a partner's named end user) with the member role and no Cloud login. Isolated from every other member. |
| Member connection | OAuth tokens or credentials a member stores in CortexHub Cloud, scoped to that member and toolkit. Reused by that member's co-worker and external clients that authenticate as the member. |
| Co-worker | The single hosted AI co-worker provisioned automatically for each entitled member. Acts only as its owner. |
| Brain | A co-worker's living map of a member's work: the people, projects, conversations, documents, preferences, and lessons it learns, kept as one canonical record the member can explore and correct. Previously called Memory. Private to the member. |
| Agent | An AI identity acting in one organisation: a member's hosted co-worker, an organisation-owned Org Agent, or an external client identity. |
| External agent | An outside AI client or partner backend that reaches the organisation's tools through the governed gateway, acting as a member or a named end user. |
| Agent ref | The string identifying which gateway identity a programmatic request acts as. |
| Toolkit | A set of capabilities an agent can use (such as a chat, ticketing, or CRM integration, or an org custom OpenAPI connector). |
| Org toolkit | A toolkit an org admin has enabled in the organisation inventory, available for group publishing. |
| Group | An organisation-scoped set of members with toolkit and tool entitlements plus access rules. The only tool gate. |
| Entitlement | A group grant that lets its members or Org Agents connect and use a toolkit and specific tools. |
| Safety profile | A tool's classification: read, write, or destructive. Drives the default decision. |
| Decision (gate) | The base outcome for a call: permit, require approval, or deny. |
| Obligation | An extra condition layered on a permitted or approval-gated call: redact (withhold sensitive fields from the stored record) or re-authenticate (require a fresh step-up before the call runs). |
| Layered policy | The organisation floor, then groups, then members. Each lower layer can only tighten the one above. The strictest gate wins. |
| Organisation floor | The organisation-wide minimum every group and member inherits, authored in plain language with optional compliance packs. |
| Member policy | A member's own rules on their connected toolkits and personal files, tighten-only and scoped to that member. |
| Files | The member's private files (my files) and the organisation's shared documents (org files). A member's co-worker can search and read them. |
| Meta-tool | One of the five gateway tools agents call (cortexhub_search_tools, cortexhub_get_tool_schemas, cortexhub_invoke_tools, cortexhub_get_task, cortexhub_request_consent). Parked invokes complete via tasks polled with cortexhub_get_task. |
| Managed OAuth | Vendor sign-in through a CortexHub-operated OAuth application. |
| BYO OAuth | Vendor sign-in through your organisation's own OAuth application. |
| MCP gateway | The runtime at https://mcp.cortexhub.ai/v1/mcp where agents call meta-tools. |
| CortexHub Cloud | The web app at https://app.cortexhub.ai for owners, admins, and members. |
| Platform API | The REST API at https://api.cortexhub.ai for provisioning and governance configuration. |
| Interactive Member OAuth | Authorization Code + PKCE used by a person connecting Claude, ChatGPT, Cursor, or another MCP client in a browser. |
| Programmatic Member Credential | A member-scoped OAuth client used with client_credentials by a server-side process. It does not perform an interactive sign-in. |
| Org gateway key | An organisation-scoped key giving external programmatic agents gateway access, with per-call end-user attestation. |
| Control-plane OAuth client | An OAuth client for partner backends calling the Platform API. |
| Span | A telemetry record for one gateway invocation. |
| Receipt | A tamper-evident enforcement record linked to a span. |
| Guardrail | A pattern-based redaction rule at the organisation security baseline or group level. |
Meta-tools (reference)
After connect, agents call CortexHub meta-tools only (never vendor tool names directly). There are five: search, schema load, invoke, poll, and optional consent. Parked invokes complete via tasks polled with cortexhub_get_task.
| Meta-tool | Purpose |
|---|---|
cortexhub_search_tools | Find tools by intent |
cortexhub_get_tool_schemas | Load input schemas for chosen tools |
cortexhub_invoke_tools | Run governed calls (returns a task when parked) |
cortexhub_get_task | Poll a parked task until terminal is true |
cortexhub_request_consent | Optional explicit consent card when task input requests are not enough |
See Meta-tools for request shapes, outcomes, and the agent loop.