# Glossary

Use these definitions for platform documentation. Product-specific terms have more detail in their linked guides.

## Accounts and access

| Term | Meaning |
| --- | --- |
| Account | One person's Lepsto identity. |
| Admin | A management role; organization and product roles have different permissions. |
| Custom role | An organization-defined template of allow and deny patterns, copied when assigned. |
| Default deny | An operation needs an allow match and no deny match. |
| End user | A person using your product, distinct from your organization's members. |
| Grant | Access to one product, with one role and an optional expiry. |
| Invitation | An email-addressed offer of membership. Registered people may be added directly; new people receive a pending invitation. |
| Member | A person in an organization or a participant with a grant on a product. The Member role grants everyday product operations. |
| Organization | The team and billing entity that owns products. |
| Owner | A role with full control within its organization or product context. |
| Permission | A guarded operation key, such as `organization_product_create`. |
| Permission catalog | The list of operation keys and their levels and scopes. |
| Permission pattern | An allow or deny entry using an exact key or `*` over segments. |
| Product | One application or other unit of work, with its own resources and grants. |
| Region | Where a product is created; currently fixed to `eu`. |
| Role | The allowed and denied operations assigned to a member. One role applies per product. |
| Share | An explicit product grant for an organization member. |
| Slug | A product's globally unique URL label, derived from its name and recomputed on rename. |
| Viewer | A read-only product role. |

See [Product access](/access/product-access) and [Roles and permissions](/access/roles-and-permissions).

## Credentials and automation

| Term | Meaning |
| --- | --- |
| Agent | An AI participant or client performing operations with an authenticated identity and permissions. |
| API key | A long-lived `lsk_dev_` credential for programmatic platform access. |
| MCP session | A client connection used to discover and call tools; product operations need product context. |
| Public key | A product's credential for keyed public routes; new keys start with `lpk_`. |
| Second factor | An authenticator or recovery code required after the initial sign-in method when applicable. |
| Session | One device's sign-in, subject to inactivity, absolute-age, and session-count limits. |
| Skill | Instructions that guide an agent through a task, potentially using several tools. |
| Tool | One operation an agent can call. |
| Trusted device | A browser allowed to skip the second-factor challenge for 30 days, subject to organization policy. |
| Two-factor policy | An organization's requirement for a second factor and its rule for trusted devices. |

See [Sessions](/account/sessions), [MCP](/interfaces/mcp), and [Public access](/products/public-access).

## Integrations and data

| Term | Meaning |
| --- | --- |
| Access request | A product's request to use an organization integration. |
| Attachment | The link granting a product access to an integration. |
| Connector | The identifier and API term for an integration. |
| Domain | A DNS name registered on a product; registration alone does not prove ownership. |
| Integration | A connection to a supported external account, owned by the organization. |
| Analytics question | A plain-English request about data exposed to analytics for one product. |
| Dashboard | A saved arrangement of insight and text tiles. |
| Dimension | An entity attribute used to group or filter analytics. |
| Entity | A kind of record available in the analytics catalog. |
| Insight | A saved query definition; running it computes fresh results. |
| Measure or metric | A declared count, sum, average, or ratio. |
| Retention analysis | A measure of whether cohort members return after a specified interval. |
| Data retention | How long data is kept; distinct from retention analysis. |

For data classes, consent records, erasure, and other privacy terms, read [Data and privacy](/privacy/data-and-privacy). For visitors, identities, events, and attribution, read [Tracking](/acquire/tracking).