Glossary

The account. Owns the subscription, the encryption key, the member list, and the audit log. Called an organization in the API and the database.

The access boundary. Every secret, target, profile, runbook, and grant belongs to exactly one, and permission is resolved per project.

A person with a role in a workspace. One account can be a member of many.

A named, typed, encrypted value in a project.

A named set of secrets injected together. What shortspan run <group> consumes.

The typed shape of a secret: its fields, which are sensitive, and where it is stored.

A registered piece of infrastructure with its credential - an SSH server, database, AWS profile, or Kubernetes context.

The name a target is reached by. Unique per project.

A named bundle of targets, usually one environment. Entered as a unit.

A versioned, reviewable operational procedure. Steps run on the executor's machine and are not sandboxed.

A time-boxed request for elevated access to a project, with a stated reason.

What an approved access request creates. Expires on its own.

One of viewer, developer, admin, owner. Strictly ordered; each includes the ones below.

A permission carried by a token, such as secrets:reveal. Abilities narrow what a token may do; they never widen it beyond the role.

A bearer credential with a set of abilities. Shown once at creation; only a hash is stored.

The record of a CLI that completed the browser authorization flow, with its command history.

Browser-based authorization for a client that cannot receive a redirect. Displays a short code the user confirms.

A single-use, short-lived stand-in issued instead of an SSH credential, redeemed in a second call. Keeps the credential out of the response that was authorized.

Any operation returning plaintext. Separately rate limited and separately audited.

Placing a value into a process's environment without displaying it. The preferred way to use a secret.

Encrypting a value with one key, then encrypting that key with another. Lets the outer key rotate without touching ciphertext.

A random 32-byte key encrypting one secret. Stored wrapped beside the ciphertext.

One per workspace, wrapping that workspace's data keys. Stored wrapped in the database.

SHORTSPAN_MASTER_KEY. Wraps every master key, lives in the environment, and is never in the database. Losing it is unrecoverable.

Re-encrypting a master key under a different root key. Rewrites one row per workspace; the ciphertext underneath is untouched.

libsodium's authenticated encryption - XSalsa20 with Poly1305. Tampered ciphertext fails to decrypt rather than decrypting to garbage.

The operator-facing administration interface at /admin. A separate identity system from customer roles, and by construction unable to read customer secrets.

Re-authenticating before a sensitive control-plane operation, even within a valid session.

An exceptional, heavily audited elevation for an emergency. Requested and approved separately from ordinary administration.

What a workspace's plan permits: its limits and its features. Enforced by middleware, defined in one configuration file.

A timestamp a scheduled task records after running, so a silently stopped scheduler is visible rather than looking healthy.