Glossary

Terms are defined as this platform uses them, which is sometimes narrower than the industry default.

Product terms

Agent action — one externally visible thing an agent does: a tool call, a code evaluation, a command, a browser interaction, a desktop interaction. The unit of sale.

Tier — a fixed bundle of capability, isolation boundary, start-latency class and price, numbered 0 to 4. Declared at session creation, immutable thereafter.

Capability set — what a tier is permitted to do. Tier capability is enforced at the runtime boundary, not by convention.

Escalation — moving work to a higher tier. Always explicit: a new session, a new bill line, a new boundary. The platform never escalates implicitly.

Session — a live runtime at one tier with an identity and a lifetime.

Run — one bounded execution inside a session.

One-shot run — a run created without a session, where the platform manages the session's whole lifecycle invisibly.

Template — an immutable versioned base image for a tier.

Warm pool — pre-started runtimes of a given tier and template, held ready so a session can be claimed rather than booted.

Claim — taking a pre-started runtime out of the warm pool and binding it to a session. The fast path.

Cold start — a session that could not be claimed from a warm pool and had to boot. Measured and SLO'd separately.

End user — the customer's own customer, identified by end_user_id, used for usage attribution and per-seat limits.

Payer — always the organization. End users are attribution subjects, never payers.

Infrastructure terms

Control plane — the stateful services that decide: auth, admission, placement, policy, lifecycle, metering, billing. Never on the data path of a running agent action.

Data plane — the fleet that executes: node agents, hypervisors, sandbox runtimes, the session gateway, the egress proxy.

Node agent (wbnode) — the per-host daemon that starts, supervises, meters and tears down every runtime on that host, and reports capacity to the scheduler.

Placer — the scheduler service that chooses region, zone, host and pool for a new session.

Session gateway — the regional multiplexer that terminates client connections for exec streams, PTYs, CDP and desktop framebuffers, and routes them to the right runtime.

Egress proxy — the per-region forward proxy every outbound session connection passes through, where the egress policy is enforced and bandwidth is metered.

gVisor — a user-space kernel that intercepts syscalls, giving container-like start times with a much smaller host kernel attack surface. Tier 1's boundary.

MicroVM — a minimal hardware-virtualised guest with a cut-down device model, booting in tens of milliseconds from a snapshot. Tiers 2 and 3's boundary.

Snapshot restore — resuming a microVM or VM from a saved memory and disk image rather than booting it. The mechanism behind sub-second tier 2 starts and seconds-class tier 4 starts.

Full VM — a conventional hardware-virtualised guest with a full device model, needed for a desktop session's graphics, input and audio. Tier 4's boundary.

Pool depth — how many pre-started runtimes a warm pool currently holds for one (tier, template, size, zone) combination.

Burn rate — claims per second against a pool, used to drive pool refill.

Oversubscription ratio — allocated guest vCPU divided by physical cores on a host. Tier dependent; tier 4 runs at 1:1.

Noisy neighbour — a workload degrading a co-tenant through shared CPU, memory bandwidth, disk or network. Addressed by per-tier placement classes and cgroup limits.

Eviction — forcibly stopping a session to reclaim capacity. Only applies to preemptible-class sessions, always with a webhook and a prorated bill.

Billing terms

Meter — a named, unit-typed quantity that can be charged: tier2.session_s, cpu_ms, egress_gb, tool_call, storage_gib_month.

Usage event — one meter, one quantity, one window, one session. The atomic billing record.

Rating — turning usage events into money by applying the organization's price list.

Rollup — a periodic aggregation of rated usage: minute, hour, day.

Price list — the organization's effective rates, which may differ from list price through committed-use discounts or negotiated terms.

Spend cap — a hard ceiling. On breach, new sessions are refused and, optionally, running sessions are terminated.

Quota — a concurrency or rate ceiling, enforced at admission. Distinct from a spend cap, which is monetary.

Credit — prepaid balance consumed before any invoiceable usage accrues.

Committed use — a contractual minimum spend over a term, exchanged for a discounted price list.

Security terms

Blast radius — what an attacker reaches if one session is fully compromised.

Default-deny egress — no outbound network reachability until a policy explicitly allows a destination.

Allowlist — the enumerated set of permitted things: destinations, binaries, MCP tools.

Secret injection — delivering a credential to a session at start, scoped and short-lived, never baked into a template or dumped into the full environment.

Attestation — a signed statement from the platform about what ran, on which image, under which policy. Used for audit and compliance evidence.

Residency — the contractual guarantee that a session and its data stay inside a named region.