Glossary

A newcomer-facing reference for the vocabulary used throughout these docs. Each entry is one sentence of definition, one sentence on where it shows up in Autonomy, and a link to the page that covers it in depth. Alphabetical order.

Term	Meaning
Accessibility permission	The macOS TCC (Transparency, Consent, and Control) grant that lets Autonomy’s accessibility backend read the accessibility tree and act through it — clicking or typing by semantic identity instead of screen coordinates. Requested during first-run setup and checked live by every doctor run. See Grant permissions.
Accessibility state	The runtime read (`accessibility_state`) that reports which assistive technology and permissions are active before an agent decides how to act. It’s what selects an assistive mode (below) — the opposite of a generic agent that discovers a user’s setup through failure. See Accessibility model.
Accessibility tree (AX tree)	The operating system’s semantic representation of on-screen UI — roles, labels, values, focus, required/disabled state — that Autonomy reads and acts through instead of pixels. Tools like `screen_read_tree` and `screen_find_element` work against this tree first. See Accessibility model.
Action ledger	The durable, redacted local record of what an agent asked, decided, and did, written and read through `action_ledger_record` / `action_ledger_list`. It’s the substrate behind a screen-off user asking “what happened recently?” without a cloud trace. See Consent & safety.
ADR (Architecture Decision Record)	Autonomy’s format for documenting a significant, accepted architecture decision and the reasoning behind it — for example ADR-007 (safety classes) or ADR-011 (MCP-native agent conversation). The Concepts section cites these as the source of truth for why the runtime is shaped the way it is. See MCP-native architecture.
Agent conversation session	The claimed, event-sourced session a bring-your-own agent uses to narrate into Autonomy’s in-app Agent Conversation panel, driven by the `agent_conversation_session_claim` / `agent_conversation_append` / `agent_conversation_session_release` tool family. Claiming it does not grant exclusive control of the UI, VoiceOver output, or consent — Autonomy keeps ownership of all four. See Bring your own agent.
Agent host	The external process — Claude Code, Codex, or any other MCP client — that connects to Autonomy and drives a conversation. Autonomy never spawns or supervises this process; it already exists with its own model and its own loop. See Connecting an agent.
Assistive mode	An explicit runtime mode an agent selects based on accessibility state — `voiceover_aware`, `switch_safe`, `keyboard_first`, `speech_enabled`, `visual_verification`, or `high_consent` — that changes how the same tool call behaves. See Accessibility model.
Bring-your-own agent (BYO)	Any MCP-capable agent, other than Autonomy’s default launcher, that connects to the same daemon over stdio, sees the same tool catalog, and is held to the same consent rules — there is no separate, lower-capability tier for it. See Bring your own agent.
Consent	The explicit, user-facing decision an agent must obtain before taking an `elevated`- or `critical`-tier action, requested and resolved through the `consent_request` / `consent_resolve` tool pair. It is a durable, task-scoped record — never inferred from a tool call simply succeeding. See Consent & safety.
ConsentCategory	The 32-value, fine-grained category (`purchase`, `delete_or_destructive_change`, `capture_screen`, and so on) attached to one specific consent request — more specific than safety class (below), because “ask before this” reads differently for a purchase than for a permission prompt. See Consent & safety.
The doctor (`a7y-cli doctor`)	Autonomy’s phased readiness check — Prerequisites → macOS Permissions → Daemon & Relay → Browser Lane, each phase gating the next — that reports exactly what’s missing before an agent can do anything useful. See Run the doctor.
Delivery evidence	The tagged proof (`voiceover_direct_requested`, `tts_fallback_used`, `speech_queue_entered`, `user_heard_unverified`) that a spoken announcement was attempted through a real channel — deliberately distinct from proof that the user actually perceived it. See Spoken updates not heard.
Evidence classification	Autonomy’s discipline of tagging every runtime claim as observed, inferred, user-declared, unknown, or not measured, so nothing collapses into an undifferentiated “it worked.” Delivery evidence is the clearest example of this in practice. See Accessibility model.
MCP / MCP daemon	MCP (the Model Context Protocol) is the open protocol Autonomy speaks over stdio JSON-RPC; the MCP daemon (`a7y-mcp`, reached via `a7y-cli daemon proxy`) is the one local background process that implements it, exposing Autonomy’s tools to any connecting agent. See MCP-native architecture.
MCP client	Any agent host or process that connects to an MCP server and calls its tools. Autonomy’s daemon treats every agent — the default launcher and every bring-your-own agent alike — as an ordinary MCP client, with no special-cased path. See Connecting an agent.
MCP tool	One callable capability the daemon’s MCP server exposes over `tools/list` / `tools/call` — for example `screen_read_tree` or `consent_request`. Around 200 exist today, grouped by tool domain (below). See MCP tool catalog.
nightgram (retired)	The earlier in-app agent-hosting path that spawned a `codex exec` subprocess directly and had no connection to Autonomy’s own tools. It is retired from the app and build, not deprecated — mentioned here only so the term reads as historical if you encounter it in older material. See MCP-native architecture.
Playbook	A bounded, audited multi-step workflow with explicit state and a resumable audit trail, run through `playbook_start` / `playbook_status` rather than a chain of one-off tool calls. See MCP tool catalog.
Power / Guided / Training posture	The three trust postures that shape how much friction a low-risk action gets. Guided and Training always insert an accessible review step; Power allows a short, fixed allowlist of read-and-navigate actions to skip a prompt, and never touches the unconditional deny set. See Safety classes.
Relay hub	The session-scoped component (`a7y-relay`) inside the daemon that routes browser- and overlay-attached traffic with backpressure, alongside the accessibility backend. See The runtime.
Rules-as-plugins	Autonomy’s delivery model for behavior — consent-first defaults, the accessibility north star, pacing — as plugin skills and config an agent host loads (a Claude Code plugin, a Codex plugin), instead of hardcoded app-side agent code. See MCP-native architecture.
Safety class (`SafetyClass`)	The protocol-level, four-tier risk classification — `read_only`, `standard`, `elevated`, `critical` — attached to every action-performing tool, deciding whether it runs immediately, waits for approval, or is refused outright. See Safety classes.
Screen Recording permission	The macOS TCC grant that lets Autonomy’s browser and visual-verification workflows capture the screen as a fallback when accessibility state alone can’t confirm something. AX-only review keeps working without it. See Grant permissions.
Screen-off	Operating a Mac with the display off, or simply unwatched, relying entirely on spoken updates and voice input rather than looking at anything. It’s the runtime’s first and most-tested scenario. See Your first screen-off task.
Switch Control	macOS’s switch-based navigation assistive technology. When it’s running, Autonomy selects `switch_safe` mode, avoiding surprise pointer jumps and preferring keyboard focus and AX actions. See Accessibility model.
Tool domain	One of Autonomy’s groupings of its MCP tool catalog — screen, browser, speech, consent, and others — used to scope which tools a connecting agent or specialist subagent actually sees, instead of loading the full ~200-tool surface into one context. See MCP tool catalog.
Trust level	How long a user’s consent decision is cached before an agent must ask again for a similar action: `None` (ask every time), `Session` (cache for the session), or `Full` (persistent auto-approve). See Consent & safety.
VoiceOver	Apple’s built-in screen reader. Most of Autonomy’s screen-off scenarios, and its `voiceover_aware` assistive mode, are built directly around a user running it. See Accessibility model.
VoiceOver transport	The dedicated, serialized speech lane (`voiceover_transport_announce` and related tools) that queues, cues, and reports delivery evidence for every spoken update, so two agents can’t talk over each other or over the user. See MCP tool catalog.