# Glossary Every term in these docs, in a sentence or two. Source: https://seal.zone/docs/glossary ### Admin key A passkey or key file that signs [tenant changes](https://seal.zone/docs/changes). ### App A name such as checkout that blobs list and [grants](https://seal.zone/docs/apps) tie to identities. ### Artifact check Executable hashes an app must match to [start sessions](https://seal.zone/docs/apps). ### Attestation The chip's signed report of the enclave's code, which your SDK [checks first](https://seal.zone/docs/attestation). ### Blob A `seal1.` string holding an encrypted key and its rules, which only your enclaves [open](https://seal.zone/docs/concepts). ### CLI The `seal` command for [admin work](https://seal.zone/docs/cli), which checks the log itself. ### Console The web app at console.seal.zone, which [can't sign changes or read keys](https://seal.zone/docs/console). ### Control plane Seal's server for your signed documents and telemetry, which can [withhold but not forge](https://seal.zone/docs/architecture) them. ### Deployment A replica's cloud identity, which your tenant state must list for it to [get keys](https://seal.zone/docs/hosting). ### Destination The address sealed with `--to`, the [only place](https://seal.zone/docs/sealing) the key goes. ### Enclave The program in a TEE that opens blobs, adds keys to requests and [masks them](https://seal.zone/docs/attestation) in responses. ### Extend The SDK's automatic [five-minute session renewal](https://seal.zone/docs/sessions), which rechecks grants. ### Fingerprint A hash of a build's exact code, also called measurement, which must [match a release](https://seal.zone/docs/attestation). ### Freshness A signed statement that a tenant state is the latest, which replicas [require](https://seal.zone/docs/limits#freshness-and-failing-closed). ### Front door The `*.enclave.seal.zone` entry that wakes hosted replicas and passes [encrypted traffic](https://seal.zone/docs/architecture) through. ### Grant A rule letting an identity act as an app, [cut off](https://seal.zone/docs/apps) about 30 seconds after removal. ### Identity How an app [proves which app it is](https://seal.zone/docs/apps), such as a managed identity or app key. ### Integrity policy Your rules for [what happens](https://seal.zone/docs/telemetry) when a signal arrives. ### Key guardian Seal's enclave that gives keys only to [released builds](https://seal.zone/docs/architecture). ### Network rule CIDR ranges an app may [connect from](https://seal.zone/docs/apps). ### Pending window How long a widening change [waits in public](https://seal.zone/docs/changes), shown as "Risky changes" in the console. ### Platform Confidential hardware that opens your blobs, today [Azure on AMD SEV-SNP](https://seal.zone/docs/hosting). ### Proposal A change [awaiting admin signatures](https://seal.zone/docs/changes). ### Receipt A client's proof that an event was logged, which [exposes withheld telemetry](https://seal.zone/docs/telemetry). ### Registrar The service that signs a new tenant's [first admin keys](https://seal.zone/docs/architecture). ### Release An enclave or guardian build that gets keys once [signed and logged](https://seal.zone/docs/releases). ### Replica One running copy of your enclave; the SDK [fails over](https://seal.zone/docs/hosting) between them. ### Root id A digest of your first admin keys, in `@`, that defeats [look-alike tenants](https://seal.zone/docs/sealing). ### Seal To [encrypt a key with its rules](https://seal.zone/docs/sealing) for your enclave alone. ### Seal-hosted replica A replica Seal runs for you, which [stops when idle](https://seal.zone/docs/hosting). ### SDK The [library](https://seal.zone/docs/quickstart) your app uses to seal and open sessions. ### Secret The [credential you seal](https://seal.zone/docs/sealing), often just called key. ### Session Your app's use of a blob through a local URL and [stand-in key](https://seal.zone/docs/sessions). ### Signal A [report of possible compromise](https://seal.zone/docs/telemetry), low to critical. ### Simulator The [whole system on your machine](https://seal.zone/docs/faq). ### Stand-in key The session's key for your app, [useless](https://seal.zone/docs/sessions) outside its tunnel. ### State in force The tenant state [enclaves apply now](https://seal.zone/docs/changes). ### Suspension An integrity action that [blocks one identity](https://seal.zone/docs/telemetry) and ends its sessions. ### TEE A trusted execution environment, where memory is [sealed off even from root](https://seal.zone/docs/attestation). ### Telemetry The enclave's [signed record](https://seal.zone/docs/telemetry) of what it did, never keys or bodies. ### Telemetry reader A key telemetry is [encrypted to](https://seal.zone/docs/telemetry), leaving Seal only metadata. ### Tenant One set of sealed keys with [its own admins](https://seal.zone/docs/concepts) and a permanent id. ### Tenant key version The key new blobs use; retiring old versions [stops their blobs](https://seal.zone/docs/revoking). ### Tenant state The [signed document](https://seal.zone/docs/changes) your enclaves obey. ### Threshold How many admin keys must [sign a change](https://seal.zone/docs/changes). ### Transparency log The [public, append-only record](https://seal.zone/docs/releases) of releases and tenant settings. ### Tunnel The SDK's `127.0.0.1` forwarder to the enclave, which [never sees the key](https://seal.zone/docs/sessions). ### Upstream The [API or database](https://seal.zone/docs/upstreams) your key is for. ### Waiting period How long a release stays [public in the log](https://seal.zone/docs/releases) before getting keys. ### Widening and narrowing changes Narrowing applies at once; widening, or anything unclear, [waits out the window](https://seal.zone/docs/changes). ### Witnesses Cosigners of log checkpoints, so [everyone sees one log](https://seal.zone/docs/releases). ### Workspace A console group whose roles [never sign tenant changes](https://seal.zone/docs/console).