--- title: "Glossary" description: "Comprehensive glossary of Alpacon terms and concepts. Learn definitions for IAM, zero trust, authentication, access control, and security terminology." --- > Full documentation index: https://docs.alpacax.com/llms.txt # Glossary Key terms and concepts used throughout Alpacon documentation. ## A ### Access control list (ACL) A list of permissions attached to an object that specifies which users or groups can access the object and what operations they can perform. ### Agent See [Alpamon](#alpamon). ### Alpamon The Alpacon agent software installed on target servers that manages connections, enforces access controls, and collects audit logs. Runs as a system service and requires root/administrator privileges. ### Anomaly detection A security capability that automatically identifies unusual or suspicious activity. ### API token A unique authentication credential used for programmatic access to Alpacon services. Commonly used in CI/CD pipelines and automation scripts. Tokens can have specific permissions and expiration times. ### Approval The review step—and the queue where it happens—in which a Superuser approves, adjusts, or rejects a sensitive request such as a work session or service token before it takes effect. ### Audit log A chronological record of all actions performed through Alpacon, including who did what, when, and where. Used for security monitoring, compliance, and troubleshooting. ## B ### Bastion host A traditional security approach using a hardened server as a single entry point to access other servers. Alpacon replaces bastion hosts with a more secure, cloud-native approach. ### Break-glass access A service token scope (`service_token:break_glass`) that temporarily lifts a token's IP and time restrictions during an incident. Rate limits and access-control rules still apply. A superuser activates it for a set window with a recorded justification, and both the activation and the deactivation are logged. See [Service tokens](/use/iam/applications/service-tokens/). ## C ### Centralized access control An approach that manages all server access from a single place. Alpacon provides centralized access control through a web dashboard. ### Command ACL A Command Access Control List restricts which commands a user can execute on a server. For example, it can limit a developer to only specific deployment commands. Rules are matched against the submitted command line, including a `sudo` prefix—see [Command patterns and sudo](/use/iam/applications/service-tokens/command-patterns/). ### Connection token A short-lived JWT token that authorizes a specific user to access a specific server for a limited time. Automatically expires and cannot be reused. ## G ### Group A collection of users or servers that share common access permissions. Groups simplify permission management by allowing bulk assignment of access rights. ## I ### Identity and access management (IAM) The framework for managing digital identities and their access to resources. In Alpacon, IAM includes users, groups, roles, and permissions. ### Identity provider (IdP) An external system that authenticates users, such as Okta, Azure AD, or Google Workspace. Alpacon can integrate with IdPs for single sign-on (SSO). ## J ### JWT (JSON Web Token) A standard for securely transmitting information between parties as a JSON object. Alpacon uses JWTs for session tokens and API authentication. ### Jump server See [Bastion host](#bastion-host). ## L ### Least-privilege access A security principle of granting users only the minimum access they need to do their work. ## M ### Multi-factor authentication (MFA) A security method requiring two or more verification factors to gain access. Alpacon supports TOTP-based MFA (Google Authenticator, Authy) and SMS. ## N ### Network-level access Access to an entire network, as provided by a VPN. Alpacon provides more granular, application-level access instead. ## O ### Outbound connection A network connection initiated from inside a network to an external destination. Alpacon agents only make outbound connections, eliminating the need for inbound firewall rules. ## P ### Permission A specific action that a user is allowed to perform, such as "connect to server," "execute commands," or "transfer files." ### Privileged access management (PAM) A cybersecurity strategy for controlling and monitoring privileged access to critical resources. Alpacon is a modern PAM solution. ## R ### Reverse connection Alpacon's architecture where servers connect out to the platform rather than accepting incoming connections. This eliminates exposed attack surfaces. ### Role A collection of permissions that can be assigned to users. Alpacon has three default roles: - **User**: Basic access with limited permissions - **Staff**: Elevated access with sudo capabilities - **Superuser**: Full administrative access ### Role-based access control (RBAC) An access control method that assigns permissions to roles, and then assigns roles to users. Simplifies permission management in large organizations. ## S ### SAML (Security Assertion Markup Language) An XML-based standard for exchanging authentication and authorization data with enterprise identity providers. Enterprise workspaces can connect a SAML IdP, configured with the AlpacaX team during onboarding. ### Secure shell (SSH) A traditional protocol for secure remote access to servers. Alpacon provides a modern alternative to SSH with better security and management capabilities. ### Server A computer system registered with Alpacon that users can access. Also referred to as a "host" or "target server." ### Session An active connection between a user and a server through Alpacon. Sessions are monitored, can be shared, and close automatically once a set time limit has passed since they were opened. ### Session recording The capability to record all terminal input and output during a session for audit and training purposes. Available in Enterprise plans. ### Session sharing Alpacon's feature allowing multiple users to view or collaborate on the same terminal session in real-time. ### Single sign-on (SSO) An authentication method that allows users to log in once and access multiple applications. Alpacon supports SSO through Google Workspace and, for Enterprise workspaces, Okta (Okta Integration Network) or a SAML IdP arranged during onboarding. ### Staff role An Alpacon IAM role with elevated privileges, typically including sudo access. Suitable for DevOps engineers and system administrators. ### Superuser role The highest privilege level in Alpacon IAM, with unrestricted access to all features and servers. Should be limited to security administrators. ## T ### Target server A server that users connect to through Alpacon. The server must have the Alpamon agent installed and be registered to a workspace. ### Time-bound access Access that automatically expires after a specified duration. All Alpacon access tokens are time-bound to reduce security risks. ### Token See [API token](#api-token) or [Connection token](#connection-token). ### Two-factor authentication (2FA) See [Multi-factor authentication (MFA)](#multi-factor-authentication-mfa). ## U ### User role The basic IAM role in Alpacon with limited permissions. Suitable for developers and operators who need controlled access to specific servers and commands. ## W ### WebFTP Alpacon's browser-based file transfer interface. Allows secure file uploads and downloads without requiring FTP clients or protocols. ### Websh Alpacon's web-based shell interface. Provides terminal access directly in the browser without requiring SSH clients or keys. ### Websh protocol The custom protocol used by Alpacon for secure, real-time terminal communication between browsers and servers. ### Work session A time-bound, approved grant of access to one or more servers. Instead of connecting directly, you request a session specifying the servers, features, and duration you need; once approved, the requested tools stay usable until the session expires. ### Workspace The top-level organizational unit in Alpacon. A workspace contains servers, users, groups, and configuration settings. Organizations can have multiple workspaces for different environments or teams. ### Workspace URL The unique URL for accessing a specific workspace, formatted as `https://..alpacon.io`. ## Z ### Zero trust A security model that assumes no implicit trust and continuously verifies every transaction. Alpacon implements zero-trust principles by: - Verifying every access request - Using time-bound tokens instead of permanent credentials - Enforcing least-privilege access - Maintaining comprehensive audit logs - Eliminating exposed attack surfaces ### Zero trust network access (ZTNA) A technology category that provides secure remote access based on zero-trust principles. Alpacon is a ZTNA solution specifically designed for server access. Source: https://docs.alpacax.com/reference/glossary/