| Tenant | Customer organization; all data isolated via SQL RLS (tenant_id). |
| Site | Logical grouping within tenant (plant, location). Host Agent enrollment_secret is per site. |
| EdgeZu / Edge appliance | On-prem gateway device (Rust/RAUC image). |
| Claim code | XXX-XXX code from monozu edge register; staff assigns to tenant in Management. |
| Claim token | Bearer token from announce; used until claim-complete. Stored hashed server-side. |
| api_key / X-Device-Key | Long-lived Edge credential after claim-complete. |
| Host Agent | Endpoint inventory agent (hostzu/). Product name in docs; PL spec may say HostZu. |
| enrollment_secret | Per-site bootstrap secret for Host Agent silent install — not the same as claim code. |
| host_token | Long-lived Host Agent credential after Cloud UI approval. |
| Ingest kind | Payload type in POST /v1/ingest (e.g. telemetry, discovery, host_inventory). |
| Devices CA | Intermediate CA for Edge mTLS client certs — see PKI ceremony. |
| Updates CA | Intermediate CA for signing RAUC bundles. |
| RLS | Row-Level Security in Azure SQL — SESSION_CONTEXT('tenant_id'). |
| Management | Internal staff UI for tenants, licenses, Edge assign. |
| Cloud SPA | Customer-facing application at cloud.monozu.io. |
