Glossary

The same word sometimes means different things in the portal, so this page pins them down.

Organizations and people

Term	Meaning
Organization	Your isolated LumoAuth environment. It holds your users, applications and settings, and appears in every URL as /orgs/{orgId}/. The portal for it is the Organization portal.
Organization ID / slug	The URL-safe identifier you chose at sign up, such as acme-corp.
Customer organization	A company, team or workspace that your product serves, living inside your organization with its own members, roles and invitations. Managed under Identity → Customer organizations; its members use the Customer portal (/b2b/…). Different from the organization above.
User	A person who signs in.
Group	A set of users that can be given roles together. A tab of the Users page.
Invitation	An email that lets someone create an account in your organization (a tab of the Users page) or join a customer organization.
LumoAuth operator	Runs the LumoAuth service itself. Not the same as an organization admin; operators act on your organization only at your request, and every such action is audited in your log.

Applications and credentials

Term	Meaning
Application / OAuth client	An app that signs users in or calls APIs. The portal calls it an application; the OAuth specs call it a client.
Client ID / client secret	The public identifier and the private password of a confidential client. The secret is shown once.
Public client	A browser or mobile app that cannot keep a secret. Uses PKCE.
Issuer	The base URL that identifies your organization as an OIDC provider. Shown on Endpoints & metadata.
Discovery document	The JSON file at /.well-known/openid-configuration that lists your endpoints and signing keys.
PKCE	A one-time secret that protects the sign-in code, used by public clients.
JWKS	The list of public keys applications use to verify your tokens, published at /.well-known/jwks.json and managed under Security → Signing keys.
API key (lmk_…)	A key for scripts and CI that call the Admin API, limited to the scopes you tick.
Agent key (agk_…)	A key identifying one AI agent. Not interchangeable with an API key.
Scope	A named permission an application requests, such as openid or email.

Access control

Term	Meaning
Role	A named bundle of permissions assigned to users or groups.
Permission	One granular action on one kind of resource.
RBAC / ABAC / ReBAC	Role-based, attribute-based and relationship-based access control. In the portal: Roles & permissions, Attribute rules and Relationships. See Choosing a model.
Test access	The portal page that answers "may this user do this?" under any of the three models.

AI agents

Term	Meaning
Agent	A registered non-human identity with its own credentials, capabilities and budget.
AAuth	The agent authentication protocol: agents prove who they are with signed requests instead of shared secrets.
MCP server	A tool server that agents call using the Model Context Protocol. LumoAuth can protect it and publish its metadata.
JIT (just-in-time) approval	A short-lived permission an agent requests at run time that a human approves or denies. Requests wait under AI Agents → Approvals.
Agent rules	The portal page with Access rules (conditions an agent must meet to authenticate), Auto-approve rules (requests that need no human) and Cross-app access.
Cross-app access	Letting one application or identity provider obtain tokens for another application on a user's behalf, without a second sign-in.
Agent activity	The portal page with the fleet-wide activity dashboard and the Security signals streams.
Agent connection (token vault)	Stored access to a third-party service that an agent can use on a user's behalf.
CAEP / shared signals	Security events (for example "session revoked") shared between systems so access can be cut off quickly. Configured under Agent activity → Security signals.
Workload identity	Letting the platform an agent runs on (Kubernetes, AWS, GitHub Actions and so on) vouch for it, so the agent needs no stored secret.