Glossary

Look up a plain definition of every CloudThinker term you meet in the app and these docs, with a link to the page that covers it

Each term gets one plain definition and a link to the page that explains it in full. Terms that also appear in the app are spelled the way the app spells them.

Jump to: A B C D F G I K L M O P R S T W Former names

The prompt every term hangs off

Most of these terms show up in one place first: the message box. A prompt has this shape, and both prefixes are optional.

@agent #connection request

Part	What it does	Example
@agent	Sends the request to one agent. Leave it out and the built-in @CloudThinker agent answers, so you only need it for a custom agent.	@finops-bot
#connection	Points the agent at one connection or knowledge base. Add it when the workspace has several accounts and the answer depends on which one the agent reads.	#aws-prod
request	What you want, in plain language. Ask for the output shape in words.	show last month's EC2 spend by team as a dashboard

Start a message with / instead to run a skill or saved command, such as /find-rules. Full syntax lives in Commands.

A

Term	Meaning
Admin Settings	The organization-level settings, such as workspaces, BYOK, identity, and audit logs. Open it from your avatar at the bottom of the sidebar. Only organization Owners and Admins see it in their menu. A workspace Admin who isn’t one can open a single page there from a direct link, Guardrails. See Organization.
agent	An AI program that plans, runs tools against your real systems, and reports back. Every workspace has the built-in CloudThinker agent plus any custom agents your team adds. See Agents.
agentic loop	The cycle an agent runs for one problem: an alert or request starts it, the agent finds the root cause, the fix goes through your Approvals, and what was learned goes into memory. How CloudThinker works explains each piece in full. The field guide’s architecture chapter calls the same loop Detect, Analyze, Resolve, Validate, where its Resolve stage isn’t the Resolve product.
AgenticOps	The method behind CloudThinker: run operations with agents that act under rules you set. Covered in the AgenticOps field guide.
AI judgment	In Auto mode, the AI check that reads your intent and decides a write no Rule covers: allow it, ask a person, or refuse. See Approval mode.
anomaly	In Optimize, a day where a service’s spend went above its expected range, measured against a rolling baseline. See Anomalies.
approval card	The card shown in chat when a write waits for a person. An approver answers it there. Google Chat shows the same card; Slack and Microsoft Teams link to the web app instead. See Approvals.
Approval mode	How a write no Rule covers gets decided. Manual: every write waits for a person. Auto: you make two choices. 1. What decides: Rules, or Rules + AI (AI judgment decides what no Rule covers). 2. What happens to a write still undecided: Ask me (it waits for a person) or Refuse. New workspaces default to Auto, Rules + AI, Ask me. See Approval mode.
Approvals	The area that decides which agent writes run, wait for a person, or are refused. Formerly called Auto Mode, which isn’t the same as the Auto option in Approval mode. See Approvals.
approver group	A named set of people allowed to answer an approval card. The built-in Default approvers group answers every ask unless a Rule names another group. See Approvers.
artifact	A dashboard, report, comparison, scorecard, diagram, or file an agent builds from your data. See Artifacts.
Automation	A saved prompt that runs in your workspace when a trigger fires. See Automations.

B

Term	Meaning
break-glass	Lets a workspace Admin run one call a workspace Deny Rule refused, once, with a written reason. Off by default and audited. A workspace Admin turns on Let owners and admins break glass under Approvals → Approvers. See Break-glass.
Beta	A product still before general release. CloudThinker shows a Beta pill beside it in the app, and its pages carry a Beta tag here. Today that is Cyber. It’s available on your plan and supported — names and screens can still change.
Early access	Something you arrange with CloudThinker rather than turn on yourself: today the dedicated, self-hosted, and air-gapped deployments, offered through a design-partner program. Not the same as Beta, which you already have.
BYOK	Bring your own key: the AI model calls behind CloudThinker run on your own AWS Bedrock, Anthropic, FPT Cloud, Claude Code, or Codex account. Your provider bills the tokens, and the turn still costs a reduced share of CloudThinker credits. The organization Owner sets the organization key under Admin Settings → BYOK, a workspace Admin one workspace’s key under More → Workspace settings → BYOK. A failed call falls back to CloudThinker’s models. See BYOK.

C

Term	Meaning
CLI	The cloudthinker command-line tool for chatting with agents and running them from your terminal or scripts. See CLI.
CloudThinker Cloud	CloudThinker’s managed service at app.cloudthinker.io. In a chat’s Run in menu the same name means the hosted sandbox where agent commands run by default, as opposed to a Worker you run yourself. See Self-hosted sandboxes.
Cluster	In Pulse, a group of related monitoring events treated as one candidate Signal. Not a Kubernetes cluster. See Signal Clusters.
Code Audit	A Cyber capability that reviews a branch you pick in a connected repository for security problems. It audits the commit the branch pointed to at the start, even if the branch changes while it runs. See Cyber.
command	A reusable prompt saved to your workspace. Type / in a chat to run one. See Commands.
connection	An authorized link from CloudThinker to one of your services, such as AWS, GitHub, or Datadog. Connect once and agents in the workspace can use it. See Connections.
Cost Health	The daily 0 to 100 score Optimize gives a cloud account, built from three pillars: Rate optimization, Resource efficiency, and Cost allocation. Stages: Crawl is a score under 50. Walk is 50 or more. Run is 80 or more, with at least 80% of the account’s spend measured (spend CloudThinker could check). See Optimize.
credential	A workspace secret, such as an API key or token, stored encrypted and passed to the command as an environment variable each time an agent runs one. Reference it by key, such as $STRIPE_API_KEY, so you never paste the value. Command output masks known secret formats, but a command that prints its environment can still show a value. See Credentials security.
credits	The unit agent work is billed in. Each run uses credits, and the model tier changes how many. See Usage.
custom agent	An agent your team creates with its own name, instructions, and connections. See Customize Agents.
Customize	The supporting area for shaping how agents work: custom agents, skills, knowledge, credentials, and notifications. Not a product, and separate from Approvals, which decides which writes run. See Customize Agents.
Cyber	The security testing module: Pentest against running apps and Code Audit against source. See Cyber.

D

Term	Meaning
Default approvers	The built-in approver group that answers every ask no Rule sends to another group. You can edit its members but can’t rename or delete it. Find it on Approvals → Approvers. See Approvers.
Detectors	Checks CloudThinker writes, backtests, and runs beside your own alerts to catch problems your alert rules miss. Under Resolve → Detectors. See Detectors.
Dreaming	The nightly run that tidies workspace memory: adds what’s new, merges duplicates, removes what’s outdated. Runs start at 00:30 UTC. It’s on by default, you can turn it off per workspace, and Run history shows what each run did. See Dreaming.

F

Term	Meaning
finding	Something an agent found that needs a human decision, tracked by status. Findings use New, Acknowledged, Active, Resolved, Dismissed, as in Cyber. Optimize Findings are the exception: Pending, In Progress, Implemented, Ignored. See Cyber findings and Optimize Findings.

G

Term	Meaning
Guardrails	Settings under Admin Settings → Guardrails that hide secrets and personal identifiers from agents. Each match in tool output is replaced with a placeholder before the model reads it. See Custom Guardrails.

I

Term	Meaning
Incident	An operational problem Resolve investigates, opened from Pulse or logged by hand. See Resolve.
Incident Memory	Lessons CloudThinker saves during an investigation and reads at the start of later ones. See Incident Memory.
Investigation	The Resolve page that lists incidents and their investigations, under Resolve → Investigation. The On duty switch sits in its header. See Resolve.

K

Term	Meaning
knowledge base	Your uploaded documents and crawled web pages that agents search when they answer. Select one with #. See Knowledge.

L

Term	Meaning
Learnings	Review rules CloudThinker distills from findings your team resolved, applied to later reviews. See Learnings.
LLM	Large language model, the AI engine behind each agent. The model tier sets which class of model a run uses. With BYOK, those calls run on your own provider account.

M

Term	Meaning
MCP	Model Context Protocol, an open standard for connecting AI agents to tools. Add any MCP server as a connection, or use CloudThinker as an MCP server.
mention	The @agent at the start of a prompt. In a merge or pull request, mention the bot as @cloudthinker-ai. See Mention commands.
model tier	The model class a run uses: Light, Pro, or Ultra. Higher tiers reason more and cost more credits. See Usage.
module	One of the four problem-focused parts of CloudThinker, also called its four products: Resolve, Review, Optimize, Cyber. Approvals, Customize, and Automation are supporting areas that work across all four. A capability, such as Pentest, is one feature inside a module. See Concepts.

O

Term	Meaning
On duty	The Resolve switch for automatic investigation, in the header of Resolve → Investigation. On: CloudThinker triages and investigates on its own, within each source’s settings, such as a webhook’s Auto-investigate switch and minimum severity. Paused: Pulse keeps detecting and grouping alerts, and an actionable cluster is still filed as an incident with status Open, but CloudThinker doesn’t triage or investigate on its own. Incidents a person logs or escalates still investigate right away. Not your human on-call rotation. See Resolve Settings.
Optimize	The cloud cost module: spend, Cost Health, savings findings, anomalies, and reports. See Optimize.
organization	The top-level account that holds your workspaces, members, and billing. Every user gets one at signup. See Organization.

P

Term	Meaning
Pentest	The Cyber capability that tests a running application you’re authorized to test and records proof of each problem. See Run a Pentest.
plan	Your subscription level: Free, Team, Scale, Scale Plus, or Enterprise. See Pricing.
Probe	An Automation trigger: a script the agent wrote, run on a cadence, that starts a run only when it finds something. See Automations.
Pulse	The part of Resolve that handles incoming alerts. It takes raw monitoring events, drops known noise, groups the rest into Clusters, and classifies each as a Signal. See Pulse.

R

Term	Meaning
read	Any agent call that only looks at your systems and changes nothing, such as listing instances or reading logs. Reads always run; only writes go through Approvals. See write.
release	A risk assessment of a commit range: a 0 to 100 score with evidence, plus your Approve or Hold call. See Releases.
Resolve	The incident module: turns monitoring noise into investigated incidents, approved fixes, and saved lessons. See Resolve.
Review	The module that reviews every merge or pull request using your infrastructure context and team conventions. See Review.
role	What a person may do. Organization roles: Owner, Admin, Developer, Viewer. Workspace roles: Admin, Developer, Viewer. The organization Owner is the highest role and pays for the organization. Organization Admins can set up everything in the organization except the Owner-only rows in Roles. Organization Owners and Admins are Admins in every workspace. See Roles.
Rule	One approval decision for a kind of write: allow, ask first, or deny. Rules apply before the Approval mode, but only once CloudThinker turns on Rule enforcement for your workspace; until then they record the verdict they would give and the Approval mode alone decides. Agents propose them and a workspace Admin accepts. See Approval Rules.
run	One execution of an agent’s work, started by a trigger, the Run now button, or a chat message. Each run keeps its full conversation. See Automations.
Run now	The button that starts one run of an Automation by hand, without waiting for its trigger. See Automations.
runbook	A written fix procedure Resolve can find and propose during an incident. See Runbooks.

S

Term	Meaning
sandbox	Where agent commands run: CloudThinker Cloud by default, or a machine you control. A self-hosted one is called a Worker and lives under Admin Settings → Sandboxes. See Self-hosted sandboxes.
Signal	In Pulse, a classified operational problem formed from a Cluster. An actionable Signal can become an Incident. See Signal Clusters.
skill	A package of instructions that teaches agents your procedures and standards. Run one with /, or let agents load it when relevant. See Skills.
subagent	A temporary helper an agent starts for one bounded task. It finishes and disappears; you never pick one. See Agents.

T

Term	Meaning
trigger	What starts an Automation: Schedule, Webhook, Repository (a push, merge request, comment, or pipeline), or Probe. See Automations.
two-person rule	The person who started a run can’t approve its writes. One other approver is enough. Off by default: a workspace Admin turns on The person who started a run cannot approve it under Approvals → Approvers, for destructive actions or all writes. It needs at least 2 approvers. See Require a second person.

W

Term	Meaning
webhook	In Resolve, the address a monitoring tool sends its alerts to. Each one is set up under Resolve → Integrations, where Auto-investigate decides whether its alerts can start an investigation on their own. See Webhook options.
Worker	A self-hosted sandbox: a machine you control where agent commands run instead of CloudThinker Cloud. Managed under Admin Settings → Sandboxes. See sandbox and Self-hosted sandboxes.
workspace	A space inside your organization with its own agents, connections, and knowledge, usually one per team or environment. See Workspaces.
workspace memory	What agents remember between conversations: environment notes, team preferences, recent events. See Workspace Memory.
workspace owner	The single person recorded as owning a workspace. Not a role: they can open that workspace whatever their role, and they get its notices. A workspace owned by the organization may have no owner. See Roles.
write	Any agent call that changes your systems, such as restarting a service or editing a cloud resource. That covers calls through a connection, cloud and cluster CLIs, remote programs such as ssh and psql, Git pushes, and commands that send a stored credential. Writes go through Approvals; reads always run. See Approvals.

Former names

Older blog posts and some browser URLs still use these. They mean the same thing.

You may see	Current name
Auto Mode	Approvals (not the Auto option in Approval mode)
Code Review	Review
Deep Response Engine, DRE, /dre	Resolve
CostOps, /costops	Optimize
Convention Rules	Learnings
Scheduled task	Automation
Keepers	Retired. Use Optimize Findings. The name still shows in two places for keepers that still run: the Keeper approval item on Activity and the Keepers row in Notifications.
Anna, Alex, Oliver (also spelled Olivier), Tony, Kai	Retired agent names. Use @CloudThinker or a custom agent.

Related

Quickstart

Connect a cloud account and get your first result

Concepts

See how agents, connections, and Approvals fit together

Your first investigation

Walk through one Kubernetes investigation from question to approved fix

Commands

Save and run reusable prompts with /