The terms this documentation uses, defined once, with the page that covers each in full.

Terms as this documentation uses them. Where a term has a page of its own, the definition ends with a link to it.

Deployment

Term	Definition
Appliance	CID222 delivered as one virtual machine, whose containers, schema and host configuration are all carried by a signed release and applied by a privileged updater on its host.
Direct install	CID222 running from the compose files on a host you administer, updated with `./update.sh` rather than from the dashboard. Ends up running the same signed images. See compose profiles and CLI.
Deployment mode	Which traffic path this installation serves — API gateway, inline proxy, or both. Chosen in the setup wizard and changed afterwards under Settings → System Updates.
Release channel	The signed manifest and image registry an appliance pulls an update from. It is never contacted unless an operator asks for an update.
Bundle	A single signed `.cidupd` file carrying a release's images, compose file and migrations, for an appliance with no internet. See update the appliance.
Manifest	The signed description of a release: its version, its images pinned by digest, its compose file and its migrations.
Trust anchor	A public key on the appliance that a release or a licence must verify against. An appliance accepts any of several, so the signing key can rotate without stranding boxes.
Host repair	Fixes a signed release applies to the appliance's host — the updater, systemd units, the deployment mode, environment keys — which a container update cannot reach on its own. Reported under Settings → System Updates.
Installation id	The identifier an appliance's licence is bound to. Changing it invalidates the licence. See licensing and activation.

Identity and access

Term	Definition
Tenant	An account in CID222. A tenant is both a user who signs in and the owner of the sessions, credentials and detections recorded against it. See tenants.
Tenant group	A set of tenants that can share a provider credential and be reported on together. See tenant groups.
Department scope	The rule that limits what a caller reads and writes to their own part of the estate. Enforced at the query layer, so a scoped user sees fewer rows rather than a refusal.
Role	One of five fixed roles: `superadmin`, `admin_user`, `normal_user`, `viewer` and `auditor`. See roles, capabilities and pages.
Viewer	A read-only demonstration account. It satisfies any role requirement on a read, and every mutating request it makes is refused globally by the property of the request rather than by which endpoints it may call.
Auditor	An external reviewer. Reads compliance and governance evidence across every tenant and the audit trail, changes nothing, never sees message content, and cannot hold a chat session in the estate it audits.
Capability	One of sixty named permissions in the access model. At 0.4 the model runs in shadow mode: every verdict is computed and compared, and access is still decided by the five roles and the page matrix.
Page matrix	The mapping of dashboard pages to the roles allowed to open them. An operator can change which roles see which pages. See access control.
Gateway API key	A `cid_key_…` credential that authenticates a program calling the CID222 API. Distinct from a provider credential. See access keys.
Provider credential	The API key CID222 uses to call OpenAI or Anthropic on a tenant's behalf, resolved tenant first and then tenant group. See credentials.

Licensing

Term	Definition
Package, or tier	Starter, Professional or Enterprise. One build; the licence file decides which capabilities are unlocked.
Feature key	The named capability a licence grants. Entitlements resolve as the union of the keys in the licence file and the keys of its tier, so a key added after a licence was signed still works. See licence tiers and feature keys.
Trial	The built-in 30-day Starter-level period a fresh appliance runs, stamped from first boot rather than from the image build date.
Grace	The period after expiry, named by the licence itself, during which the product keeps operating with a banner.
Seat cap	A limit on accounts carried by the licence. Reaching it refuses new accounts; existing users are never blocked from signing in.

Detection

Term	Definition
Guardrails	The detection pipeline as a whole: normalisation, then PII, toxicity and attack detection in parallel, then one decision. See the content safety pipeline.
Entity type	What a detector reports having found — a PII type, a secret category, a toxicity label or an attack label. See entity and label types.
Input filter	A rule that decides what happens when an entity type is found in what a user sends. See security filters.
Output filter	The same, for what the model sends back.
Action	What a filter does with a detection: `FLAG` records it, `MASK` replaces the value, `REJECT` refuses the request. The strictest action among a request's detections wins.
Override	A tenant-level or group-level change to a filter's action, applied on every path that can carry it.
PII	Personally identifiable information, detected by a regex layer and an ONNX named-entity model together. See PII detection.
Toxicity	Harmful content across thirteen labels, in over a hundred languages.
Jailbreak	An attempt to make the model disregard its instructions.
Prompt injection	Instructions hidden in content that the model is meant to treat as data.
Hallucination detection	A second-tier check on a model's answer against the context it was given, in English and Turkish.
Reversible masking	Masking that can be undone for the session that produced it, because the value map is stored encrypted. See sessions.
Pseudonymisation	Replacing a value with a stable substitute so records stay linkable without carrying the original.
DecisionBOM	The record of why a decision was made — the rules that applied, in what order — including a statement of what the record cannot prove.

Traffic paths

Term	Definition
API gateway mode	Applications call CID222's own API, and CID222 calls the model provider.
Inline proxy	CID222 as a forward proxy that decrypts client browser traffic and inspects it. See inline proxy.
ICAP	Internet Content Adaptation Protocol — how a third-party secure web gateway hands CID222 a request to inspect. See ICAP and third-party gateways.
SWG	Secure web gateway: the third-party product in the traffic path that calls CID222 over ICAP.
Browser extension	The managed browser add-on that inspects what a user pastes into a chat site. See browser extension.
Endpoint agent	The operating-system agent that enforces AI usage on a managed machine. Pilot-grade at 0.4 and hidden on licensed builds.
User-ID attribution	Resolving an inspected request's source address to an Active Directory user. See user-ID attribution.
Shadow AI	Use of an AI service that the organisation has not sanctioned, discovered from extension and proxy traffic. See AI usage.

Analysis and evidence

Term	Definition
LLM Risk Analyst	A local model that reviews a user whose jailbreak and prompt-injection detections have filled a sliding window, and records a verdict. Enterprise tier.
MCP server	The read-only interface over the CID222 database that the analyst reads through. It can never write.
Lock	A restriction placed on a user by a review, honoured on every enforcement surface until it is explicitly cleared.
Finding	The recorded answer to "and what did you do about it?" against a detection: a state, an owner and a resolution.
Evidence pack	An export an auditor can verify without trusting the appliance that produced it.
Mapping version	The version of the regulatory mapping under which a piece of evidence was captured. Evidence is pinned to it, so a later mapping change does not silently rewrite history.
Frozen period	A reporting period fixed in place so it stops following the data.
Governance inventory	The record of which AI assets are in use, who owns them, and their EU AI Act risk tier. See governance.
MITRE ATLAS	The public catalogue of adversarial techniques against AI systems, shipped as reference tables.
OWASP AI security documents	Six pinned OWASP publications, shipped the same way, with OWASP's own crosswalks to ATLAS.

Operations

Term	Definition
Event log	The audit trail. Every entry carries an event type and a category. See event types.
Retention policy	How long each class of record is kept before it is deleted, set explicitly and applied on a schedule.
Runbook	A machine-readable troubleshooting procedure — symptom, checks, causes, fixes — rendered as a checklist and executed by the in-product assistant. See guided runbooks.
Diagnostic snapshot	The support bundle an appliance produces about itself, and the data a runbook's automatic checks read. See the diagnostic snapshot.
Migration	A versioned, recorded schema change. Migrations own the schema on every deployment and apply on boot.
Profile	A compose label that opts a set of optional services in. See compose profiles and CLI.
Setup wizard	The first-boot procedure that creates the administrator and records the deployment mode. It cannot be re-run. See the setup wizard.

Roles, capabilities and pages — the access model in full.
Entity and label types — every type a detector can report.
Event types — every event the audit trail records.

Glossary