Core Concepts
Short definitions used across Console, portals, Runtime, and docs.
Product
A licensable software offering in the vendor catalog.
Entitlement
A named capability or limit granted by a license (feature flag, seat count, module, and similar). Entitlement codes are technical identifiers — do not translate them in UI or docs examples. Packaging narrative: Entitlements.
Custom data (vendor slots)
Fixed vendor fields on the signed license/lease snapshot (v1: 2×string≤100, 2×bool, 3×number) — not part of the human license key. See Entitlements and platform ADR-0026.
Policy / plan
Rules and commercial packaging that shape what a license allows (limits, modes, trial windows). Mode map: Licensing Models. Exact schema is defined in product specs as those modules ship.
License key
A human-facing secret that identifies a license for Runtime validation. Shapes:
XXXX-XXXX-XXXX-XXXX (v1 — retained)
XXXX-XXXX-XXXX-XXXX-XXXX (v2 — default for new issue/rotate)
Lifecycle (issue, revoke, rotate, once-reveal) is a Management concern; normalize → hash → validate is a Runtime concern. Full format, normalize rules, and storage: License Keys.
Not the same as:
| Thing | Why different |
|---|---|
| Signed lease / license artifact | Compact JWS (MH-LEASE-V1, MH-LICENSE-V1, …) — not the human key |
| License business code | Public id such as lic-acme-pos — not a secret |
| Machine / enrollment credentials | Separate prefix_hex families (for example enr_…, ric_…) |
Activation / device
Binding a license to a runtime identity (device, install, or lease subject). Full rules: Device Identity — fresh installation key per install; do not bake the private key into a golden image (ADR-0028).
Runtime lease
A signed, time-bounded validation result that a product can enforce offline for a limited window. Overview: Offline. Crypto profile and formats are versioned; see future Security / Runtime docs.
Local Relay
An on-premises component that syncs outbound to the cloud so constrained sites can still validate licenses. Overview: Local Relay. Relay engine internals stay proprietary to the platform. Not the same as customer webhooks.
Verify trust (JWKS)
How the product verifies signed leases locally (ES256 + JWKS / offline trust bundle — not RSA-in-binary). Verify trust (JWKS).
Next
- Mode map: Licensing Models.
- Human key format and safe handling: License Keys.
- Features / packaging: Entitlements.
- Device / golden image: Device Identity.
- Local verify: Verify trust (JWKS).
- Constrained / shared seats: Offline · Air-gapped · Floating · Local Relay.
- Integrator events: Webhooks (≠ Relay).
- New to the product? Return to Getting Started.
- Choosing a role path? See Choose your path.