---
title: Core concepts
description: The words you will see in Surface, explained once, in plain English.
---

Surface uses a small set of words over and over. This page defines each one. Other pages link here instead of explaining the terms again.

## Endpoint

A computer with the scanner installed. Usually an employee laptop, running macOS, Windows, or Linux. The **Endpoints** page lists all of them.

An endpoint is **Active** when it reported recently and **Stale** when it has stopped reporting.

## Asset

One AI tool the scanner found. Claude Code on a developer's laptop is an asset. So is a ChatGPT browser add-on, a model file, or a connector that gives an agent access to GitHub.

Every asset has an **asset type**:

| Type | In plain words | Examples |
| --- | --- | --- |
| **Agent** | An AI program that acts on its own | Claude Code, Cursor, Codex CLI, ChatGPT desktop, Ollama |
| **MCP Server** | A connector that gives an agent access to something: files, GitHub, a database. MCP is the Model Context Protocol | Filesystem, GitHub, Slack connectors |
| **Skill** | Instructions that teach an agent a task, usually a folder of text files | Skill folders in agent settings |
| **Browser Extension** | An AI add-on inside Chrome or Firefox | AI writing assistants |
| **IDE Extension** | An AI add-on inside a code editor | GitHub Copilot, Codeium, Continue |
| **Model** | The AI model itself, stored as a file | Models from Hugging Face or Ollama |
| **Memory** | Where an agent stores what it remembers | Local vector databases |
| **Tool** | A function an agent is allowed to call | Tool definitions in agent settings |

## Instance

One copy of an asset on one laptop. If Cursor is on 40 laptops, the console shows one asset with 40 instances.

```mermaid
flowchart TB
  A["Asset: Cursor"] --> I1["Instance on Priya's Mac"]
  A --> I2["Instance on Rahul's PC"]
  A --> I3["Instance on Dev's laptop"]
```

The Inventory page calls this count **Instances**. The Remediation page calls it **Endpoints**. Both mean the number of laptops that have the tool.

## Inventory

The full list of assets found anywhere in your company. Each asset appears once, however many laptops have it.

## Connection

A link between two assets. Claude Code using three MCP servers has three connections. The **Asset Graph** draws them.

## Policy

One rule that describes a risky situation, such as "an MCP server has a password saved in plain text". Surface ships with about 200 policies. SuperAlign writes and updates them. You can read them on the **Policies** page but not change them.

## Finding

An asset breaking a policy. The console calls findings **Failed Policies**. They are the only thing that decides an asset's risk score.

## Risk score and risk level

Every asset gets a score from 0 to 10 and one of four levels:

| Level | Score | Meaning |
| --- | --- | --- |
| **Critical** | 8.1 to 10 | Act now |
| **High** | 6.1 to 8 | Review soon |
| **Medium** | 4.1 to 6 | Keep an eye on it |
| **Low** | 0 to 4 | Fine under normal rules |

An asset with no findings shows a dash instead of a score. See [How risk is calculated](/surface/risk/scoring).

## Governance status

**Ungoverned** means nobody has decided about the asset yet. **Governed** means someone chose Allow, Warn, or Block. New assets start Ungoverned and wait in the **Open** list on the Remediation page.

## Allow, Warn, Block

The three decisions you can make about an asset:

| Decision | On the laptop |
| --- | --- |
| **Allow** | Nothing changes. The tool is approved |
| **Warn** | The user sees a message that the tool is not approved. It stays installed |
| **Block** | The scanner removes the tool. If it cannot, it closes the tool whenever it opens |

See [Governance](/surface/governance/decisions).

## Session

One conversation between a person and an AI tool. Surface records sessions only if you turn that on. The message text is stored separately and opening it is logged.

## Extension

An optional feature you switch on. **Prompt collectors** run on laptops and record sessions from one AI tool. **Cloud extensions** send session data to storage you own, such as S3 or Splunk. See [Extensions](/surface/extensions/overview).

## Integration

A connection to another company service, such as Google Workspace or Okta, to keep your user list in sync.

## Enrollment token

A long secret code that lets a laptop join your organization without anyone signing in. You create it in the console and hand it to your MDM.

## Organization

Your company's private space in Surface. Nothing in it is visible to any other company.

## Role

What a person may do in the console: **Owner**, **Admin**, **Viewer**, or **Member**. See [Users and roles](/surface/admin/users-and-roles).

## Audit log

The record of who did what and when in the console. It cannot be edited.