| Capability | A scoped permission expressed as a TinyCloud ability string such as tinycloud.kv/get. | Capabilities |
| Capability registry | The generated reference for exact action names, aliases, and statuses from the canonical node registry. | Capability Registry |
| Delegation | A signed attenuation of a capability that can be passed to another principal. | Delegations |
| Encryption network | The network-scoped resource used by TinyCloud’s encryption flows. | App manifests and Data Vault |
| Manifest | The app-level request that describes identity, data, and requested capabilities. | App manifests |
| Owner DID | The persistent DID returned by tc.did after sign-in. | DID Formats |
| Session DID | The ephemeral did:key returned by tc.sessionDid. | DID Formats |
| Space | A user-owned data container with a deterministic ID. | Spaces |
| OpenKey | The external signer that can back TinyCloud sign-in without a browser wallet extension. | TinyCloud Integration |
