Glossary

The words Reliquary uses, each in one or two sentences, with a link to where it is explained.

Access log. A vault's append-only record of every set, rotate, delete, read, reveal and refused attempt on its environment variables. See Environment variables.

Access token. A secret an MCP client sends in a header (Authorization: Bearer ...) to act as you, for clients without sign-in. Scoped to vaults and access, always expiring. See Tokens, connections and sign-ins.

Activity. A vault's append-only log of every change: who, which agent, what and where. See Activity.

Agent. An AI tool or program acting for a person through a connection or token. It has its person's role, minus the ceiling. See Agents and the ceiling.

Canon. A file policy: the file changes only through a proposal approved by enough people. See Canon, open and rules.

Ceiling. The actions no agent can do, however its person connected it: approving, rules, members, grants, secret values, export, deletion and erasure. See Agents and the ceiling.

CLI sign-in. The reliquary CLI's OAuth grant on one computer. It reads variable values within your role, and may send .env files for approval. See Use the CLI.

Connection. An MCP client you allowed through OAuth sign-in, like Claude Code or ChatGPT. See Tokens, connections and sign-ins.

Data fencing. Wrapping text people and agents wrote in random markers when it goes to an agent, so it reads as data and can't pose as instructions. See MCP tools.

Default policy. What a vault's paths are, canon or open, where no rule says otherwise. Set on Settings.

Environment. A named set of values for a vault's variables, like development, preview or production. See Environment variables.

Env API. The web app's HTTP API that the CLI uses to read variables and send pushes. See Env API.

Erase. Blanking every version of a file's text, while the log keeps its entries. Owners only, in person. See Export, delete and erase.

Import. A whole .env brought in at once, by paste or push, waiting for a person to apply it. See Imports.

Invite. A single-use link for one email address and a role, the only way to join a vault. See Members and invites.

MCP. The Model Context Protocol, how AI tools call Reliquary's tools over one URL. See MCP tools.

Open. A file policy: owners, editors and their agents write the file directly, each write a new version. See Canon, open and rules.

Owners-only environment. An environment, like production, whose values only owners set or read.

Proposal. A suggested change to a file that waits for people to approve, request changes or reject it. See Proposals and review.

Push. An import sent from the CLI with reliquary env push, often by an agent, that a person applies in the web app. See Imports.

Quorum. How many different people must approve a canon change, 1 to 20, set by a rule. See Canon, open and rules.

Reveal. Showing one variable's value in the web app, to a person, once, logged. See Environment variables.

Role. A member's standing in a vault: owner, editor or viewer. See Permissions.

Rule. A policy (canon or open, with a quorum) on a folder or a file, set by an owner. See Set rules.

Snooze. Hiding a proposal from your own Review list for a day, a week, or until it changes. Private to you. See Proposals and review.

Vault. The container for one team, client or project: files, variables, members and activity. See Vaults, files and folders.