Glossary.
The terms this site uses: what each means in general, and how Pramaan does it. Where a line makes a claim about Pramaan, it has been checked against the product; where the feature is on the roadmap, a label beside it says so. Where Pramaan makes no claim, the line says so.
Terms
The term
Plain words
| Term | What it means | How Pramaan does it |
|---|---|---|
| Access rule | A rule an administrator writes that says who may reach an application, from what kind of device, and when. | In Pramaan, an access rule can name posture labels, such as unmanaged, and step up or deny a request from a device that carries such a label, or require a minimum score; a rule can also be limited to the days of the week it applies on and a time-of-day window, both in UTC. |
| Access token | A short-lived credential an application accepts as proof of who is calling and what they may do. | A Pramaan access token lasts 300 seconds by default. Deactivating a person ends their sessions, refresh-token families and every access token issued to them. |
| AI agent identity | An identity for software that acts on a person's behalf, kept separate from the person's own. | Pramaan registers an AI agent with a named human owner, a scope ceiling and a kill switch. Disabling an agent stops new tokens; tokens already issued stay valid until they expire. |
| Air gap | A network with no connection to the internet. | Partly: identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today. |
| Attestation | Evidence an authenticator or device gives about what it is, signed by its maker. | For passkeys and security keys, the broker does not check which make or model of authenticator created the key. |
| Audit log | A record of who did what and when, kept so that it can be reviewed later. | The broker keeps audit events in its PostgreSQL database; without DATABASE_URL, the broker keeps all its state in memory and loses it on restart. |
| Broker | The server that sits between people and the applications they use: it checks who is asking and decides whether to let them in. | The Pramaan broker runs as one process on a host you run. It signs people in, checks their devices, decides access and records the evidence. |
| Browser remote access | Reaching a remote desktop or terminal from a web browser, with no client installed. | Pramaan offers RDP, SSH and VNC through guacd: the browser talks to the broker, which relays to guacd; guacd holds the RDP, SSH or VNC connection to the machine, and the connection's secrets never reach the browser. |
| CAEP | The Continuous Access Evaluation Profile: a standard way to tell other systems that a session has ended or changed. | Pramaan can send CAEP session-revoked events; delivery is best-effort. |
| CASB | A cloud access security broker: a service that watches and controls how people use cloud applications. | No Pramaan claim. |
| CERT-In | The Indian Computer Emergency Response Team. Its Directions No. 20(3)/2022 require all service providers, intermediaries, data centres, body corporate and Government organisations to keep the logs of all their ICT systems for a rolling 180 days, within Indian jurisdiction (DPDP timeline). | No Pramaan claim. |
| Class-I local supplier | Under the Public Procurement (Preference to Make in India) Order, a supplier whose offer has local content equal to or more than 50%. | Frontier Labs Private Limited, which sells Pramaan, is a Class-I local supplier (asserted per tender) (how it is asserted). |
| Connector | A small program that runs beside a private application and links it to an access broker. | Pramaan's connector dials out to the broker and opens no inbound port, and it relays only to targets on its own allowlist. |
| Default deny | Refusing anything that no rule explicitly allows. | Each private application is denied unless an access rule allows it. If the broker cannot read the rules, or its identity store is unavailable, the request is denied as well. |
| Device posture | Facts about a device's state, such as disk encryption or how up to date it is, used in an access decision. | Pramaan's desktop agent collects eleven signals, sent as agent posture reports. They are self-reported: the report's signature proves which enrolled device sent it, not that its readings are true. |
| DLP | Data loss prevention: looking at content on its way out for patterns such as card numbers, then blocking or flagging it. | Pramaan's inline DLP labels card numbers, Aadhaar and PAN numbers, and keywords you list, and scans only traffic that an access rule marks for inspection. Inside HTTPS, DLP sees content only when TLS inspection has decrypted the connection. |
| DPDP | The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, India's personal-data law. The Rules' phased compliance period ends on 13 May 2027 (DPDP timeline). | No Pramaan claim. |
| DPoP | Demonstrating Proof of Possession (RFC 9449): binding a token to a key, so that each use of the token is signed with that key. | A token is bound only when the client proves its key as the token is issued, and a copy is refused where the broker checks its key, once binding is switched on. The key is a software P-256 key. |
| Forward auth | A reverse proxy asks an identity service whether to let each request through to an application that has no sign-in of its own. | Pramaan protects web applications that have no sign-in of their own: it answers with the person's identity in headers for the application, or refuses; it is on once an administrator sets a cookie domain for it and the identity store is on. |
| Identity provider | The service that signs people in and tells applications who they are. | Pramaan is one system you run on your own servers, covering an IdP, a ZTNA gateway and a secure web gateway. |
| Just-in-time access | Granting a credential or privilege only when it is needed, and only for a short time. | Pramaan's browser SSH terminal uses just-in-time SSH certificates, valid for 60 seconds: each certificate is issued just before use, so the session is already open when it expires. |
| LDAP | A directory protocol many older applications use to check passwords and look people up. | Pramaan runs the LDAP provider, and it is read-only: applications bind and search; writes are refused. |
| MCP | The Model Context Protocol, which AI agents use to call tools. | Pramaan answers at POST /mcp/authorize: your access rules decide each tool call, and a tool no rule allows is refused; the broker returns a decision; the tool call itself does not pass through it. |
| MFA | Multi-factor authentication: signing in with more than a password, such as a passkey or an approval on a phone. | Pramaan is its own MFA provider. |
| Microsegmentation | Dividing a network into small zones so that traffic between them can be controlled. | No Pramaan claim. |
| Offline code | A code typed in from an app when the phone has no network, as a fallback. | Pramaan's offline codes are deliberately weaker than the push approval: a shared secret, with no number match and nothing tying the code to the sign-in it approves, and each device opts in. |
| OIDC | OpenID Connect: a sign-in standard built on OAuth, used by many web and mobile applications. | Pramaan speaks OIDC, with PKCE required for public clients. |
| Passkey | A sign-in credential made of a key pair: the private key stays on the person's device or in their password manager, and the site keeps only the public key. | Pramaan enrols passkeys and security keys from the browser, without the mobile app, accepting ES256 only, none attestation; a key that supports only Ed25519 or RS256 will not enrol. |
| Post-quantum signature | A signature scheme designed to resist attack by a large quantum computer. | Approvals from hybrid-enrolled devices are P-256 + ML-DSA co-signed (FIPS 204). |
| RADIUS | An older protocol that network equipment uses to check sign-ins. | Pramaan has no RADIUS server. |
| Raw TCP | Network traffic carried as a plain stream of bytes, as SSH, remote desktop and database clients use. | Pramaan's raw-TCP listener carries TCP only. UDP (voice, video) comes from the always-on desktop client alone, unicast only, off by default. On it, device posture is unknown. |
| SAML | Security Assertion Markup Language (SAML 2.0): an XML sign-in standard common in enterprise applications. | Pramaan is a SAML identity provider: it answers once you give it a signing key and certificate. It can also be a SAML service provider. |
| SCIM | System for Cross-domain Identity Management (SCIM 2.0): a standard for creating and removing user accounts across systems. | A directory can push users into Pramaan through inbound SCIM, which has no DELETE route. |
| Secure web gateway | A proxy that applies policy to people's web traffic. | Pramaan includes a forward proxy and a DNS filter. Without TLS inspection the proxy cannot read inside an HTTPS connection. |
| Session cookie | What a browser keeps after a sign-in, so that the next page does not ask again. | Pramaan's browser session cookie is not device-bound. |
| Shadow mode | Running new access rules beside the current ones, enforcing nothing, to see where they would differ. | Pramaan's shadow mode evaluates your rules on live traffic, enforces nothing, and reports where it would have disagreed with your current gate, for forward-auth applications, so forward-auth must be on: it is on once an administrator sets a cookie domain for it and the identity store is on. |
| Step-up | Asking for a fresh sign-in before allowing a sensitive request. | Pramaan's adaptive step-up only raises a request that would otherwise be allowed, and adaptive step-up ends no session. |
| TLS inspection | Decrypting encrypted web traffic at a gateway so that its content can be checked, then encrypting it again. | Pramaan offers selective TLS inspection: only categories you list are decrypted, and an empty list decrypts nothing, and your managed devices must trust a separate inspection certificate authority. |
| Token replay | Using a copied token from another machine. | A copy is refused where the broker checks its key, once binding is switched on. The raw-TCP listener refuses a device-bound token outright, because the connection cannot carry a proof, so a token that works there is unbound, and a copy of it is not refused for coming from another machine; it works until it expires. |
| Transparency log | An append-only log whose entries are hashed into a tree, so that anyone can check that earlier entries were not changed. | Each audit event is a leaf of an RFC 6962 transparency log, and its signed tree head is public at /transparency/sth; it is not a record of every access decision. |
| VPN | A virtual private network: an encrypted tunnel that joins a device to a network. | No Pramaan claim. |
| Zero trust | An approach to access that grants nothing for being on a network, and decides each access from who is asking, from what device, for which application (what zero trust means). | Each private application is denied unless an access rule allows it, and being in the application's group is not enough on its own. |
| ZTNA | Zero-trust network access: reaching private applications one at a time through a broker, instead of joining their network. | For a web application, the broker checks the person's sign-in, their groups and your access rules, then relays the request over that app's connector. |
Questions
Why do some terms say "No Pramaan claim"?
Because Pramaan makes no claim there. A term can belong to the field, or to another kind of product, without being something Pramaan does; the line says so rather than stretch a feature to fit.
Where do the Pramaan lines come from?
From the product itself. Each line about Pramaan is checked against how the product works before this site is published.
Does a line here mean the feature is on when Pramaan is installed?
Not always. Some features stay off until an administrator turns them on, and a roadmap label marks what is not built yet.
Is a general meaning here how every product defines the term?
No. The general meanings describe how each term is commonly used. Vendors define some of them differently; ask each one what it means by them.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.