Glossary

The words, in plain language.

What the terms in the app and on this site mean.

Agent: An AI tool that can take actions on your device, not just answer questions: run commands, read and edit files, fetch web pages. Claude Code and Codex are agents.
Agent Access: The app's name for the gateway: one local endpoint every agent points at, in place of each one holding its own Google, Microsoft 365, Notion or Slack grant. You link each account once, then set per agent which accounts it can see and what it may do in each. See the policy engine.
Allow list: The entries in an agent's settings that pre-approve actions, so they run without a prompt. It tends to grow one approval at a time.
Assistant: An app with an AI assistant inside it that acts on your behalf — a mail client that drafts and sends replies, a notes app that reads your calendar. It is an agent by any useful definition, but nothing on your device configured it and Mockingbyrd's guard cannot see what it does, so the Agent Roster lists it separately from the agents you set up yourself.
Connector (MCP server): A plug-in that gives an agent new tools, such as access to email, a calendar or a database. Connectors configured in a web app live server-side, so the list on disk is a floor, not the whole picture.
Coverage: The app's name for the doctrine score: weighted points earned over points available. Each rule is worth its severity — critical 10, high 6, medium 3, low 1 — and a rule you switch off leaves both sides of the sum, which is why the paused count is shown beside the number.
Deny rule: A settings entry that forbids an action. A deny rule matches a text pattern, so a broader grant elsewhere can step around it. See subsuming grant.
Doctrine: The set of rules Mockingbyrd scores your device against. Each rule is a shell probe you can read, edit, weight, disable or replace.
Drift: A change to a configuration file you approved, such as a hook edited overnight. Mockingbyrd fingerprints the files that matter and reports drift as an event.
Egress: Data leaving your device, for example through curl, a web fetch or a connector. Broad read access plus pre-approved egress is the combination that turns a mistake into a leak.
Entitlement: A permission an app's code signature says it may ask macOS for. It is readable without any permission at all and is vendor-independent, but it is a request rather than a grant: what was actually allowed is in TCC. The two disagree in both directions, which is why the roster reads both.
Fail-open: A control that lets the call through when it cannot decide. The budget layer is deliberately fail-open — an unreadable policy or a half-written tally does not stop your work — while the checks above it, for originals and destructive verbs, stay fail-closed.
Fingerprint: A short checksum of a file's contents. If the file changes, the fingerprint changes, which is how drift is detected.
Full Disk Access: The macOS grant that lets an app read the privacy database recording what every other app was allowed. Mockingbyrd needs it to report who else holds what, and asks for nothing on its own: without it every row stays at declared, not confirmed.
Gateway: The local service behind Agent Access. Agents call it instead of a provider's API directly; it checks each call against the policy, prompts where the policy says to, and writes an audit line. It runs whether or not the app window is open.
Guard: Mockingbyrd's enforcement layer. It reads the text of the command and the paths in the call, below the permission list, and blocks it or asks you first. It does not follow an interpreter, expand a variable or decode anything — which is why a wildcarded interpreter belongs nowhere near an allow list.
Heartbeat: How the app knows someone is at the keyboard. When it has been quiet for a few minutes, nobody can answer a prompt, so unattended work is held to the tighter budget.
Hook: A script an agent runs at a set moment. A PreToolUse hook runs before every tool call and can refuse it. Mockingbyrd's guard is a hook.
Interpreter: A program that runs code handed to it, such as python3, node or osascript. An interpreter with a wildcard grant can do anything a shell can.
Nerd Mode and Intuitive: Two views of the same scan. Nerd Mode shows probes, weights and evidence; Intuitive uses plain language. The mode changes the vocabulary, not the score.
Probe: The small shell check behind a rule. It reports the evidence it found, not just pass or fail.
Projection: A narrowed, read-only copy of a capture store that an agent may open instead of the original. It is built by a generated script that drops full-text indexes first, clears URLs at every setting and refuses to build when it meets a text column it has no rule for. Audio is always dropped. See the data layer.
Roster: Mockingbyrd's map of every agent on the device and what each one can reach, built only from what is on disk.
Rule pack: A bundle of rules that make up a doctrine. Mockingbyrd ships with one; you can write your own and the score follows.
Subsuming grant: A grant broad enough to do everything a deny rule forbids. If sqlite3 is denied but python3 -c * is allowed, Python can open the same database. The deny rule is advice.
T0 store (origin tier): An original data store, such as the Messages or Mail database, that nothing should need to open directly. The rule "never open a T0 store" protects the originals.
TCC: macOS's record of what you actually allowed an app — Full Disk Access, the screen, the camera. An app's entitlements say what it may ask for; TCC says what was granted, and the two disagree in both directions, which is why the roster reads both.
Token Ledger: Token use and API-equivalent cost by model, project and week, rebuilt from session logs already on disk. It is a sense of proportion, not a bill.
Tool call: A single action an agent asks to take, such as running a shell command or reading a file. The guard inspects each one before it runs.
Usage score: What the app shows as Spending habits: how much of your spend the detectors judged avoidable. It sits beside the doctrine score rather than inside it — one measures safety, the other waste.
Wildcard grant: An allow-list entry ending in *, which approves every command that starts the same way. Bash(git diff:*) is narrow; Bash(python3 -c *) is not.