Glossary¶
The docs use one term for each concept.
| Term | Meaning |
|---|---|
| Admin API | Endpoints for the operator on a separate port. |
| Allow | A SqlAccessPolicy that lets a subject read a table. |
| Anchor | The SHA-256 of the genesis. sluice audit verify --anchor checks the first record against it. |
| API key | A secret that a client sends in the X-Api-Key header. |
| Approval | A hold on a query until a person accepts or rejects it. |
| Audit log | The files where Sluice records each query and its decision. |
| Audit record | One JSON line in the audit log. |
| Budget | A daily limit per subject on query time and rows. |
| Catalog | The name of a data source: the first part of catalog.schema.table. |
| CEL | Common Expression Language, used in conditions, reject rules and row filters. |
| Client | A program that sends queries to Sluice. |
| Column mask | A policy that replaces the values of a column. |
| Copula | The method that correlated uses to draw several columns with their rank correlation. |
| Data source | A database or file store that Sluice reads. |
| Default deny | Sluice denies a query unless a policy allows every table it reads. |
| Deny | Sluice refuses a query because of access control: ACL_DENIED. |
| Engine | The part of Sluice that decides on a query. |
| Fan-out | The number of child rows that point to one parent row. |
| Genesis | The secret that starts the hash chain. |
| Grant | The right to run an approved query once. |
| Hash chain | Each audit record holds the hash of the record before it. |
| JWKS | JSON Web Key Set: the public keys of a JWT issuer. |
| Mask type | How a column mask changes a value, for example null or partial. |
| MCP | Model Context Protocol. AI agents use it to call Sluice. |
| OpenFGA | A server that stores relations between subjects and tables. A RelationshipPolicy asks it. |
| Pepper | A server secret that Sluice mixes into every API key hash. |
| Policy | A YAML object that tells Sluice what to allow, filter, mask, reject, rewrite or hold. |
| Policy directory | The directory with the YAML files that Sluice loads. |
| Policy kind | The kind of a policy, for example RowFilterPolicy. |
| Privacy budget | The epsilon of one synthetic build. Sluice splits it over the noisy counts. |
| ReBAC | Access control by relations between subjects and tables. |
| Reject | Sluice refuses a statement because of its form: ACL_REJECTED. |
| Reload | Sluice loads the policy directory again without a restart. |
| Rewritten SQL | The statement that Sluice sends to DuckDB, with filters, masks and limits. |
| Row filter | A policy that adds a condition to every read of a table. |
| Secret reference | A value such as secret://env/NAME. Sluice reads the secret from there. |
| Selector | The subjects and tables a policy covers: match and exclude. |
| Server config | The YAML file that you pass to sluice serve --config. |
| Snapshot | The file of generated rows that a synthetic data source serves. |
| Subject | The identity of a client, from its JWT or API key. |
| Subject binding | A SubjectBinding object. It maps credentials to subjects. |
| Suite | A YAML file with cases for sluice policy test. |
| Synthetic data source | A data source of type synthetic. It serves generated rows that look like the rows of another data source. |
| Tag | A label on tables or columns, set by a DataClassification object. |