Glossary
Definitions of Cushy terms: organization, capability, cutover, FOCUS, workload identity federation, sync pass, soft delete, token bucket, and more.
Short definitions of the terms used throughout the docs.
| Term | Definition |
|---|---|
| Organization | A tenant — a company or team and everything it owns in Cushy. Strictly isolated from other organizations. |
| Owner | The single member with billing and ownership-transfer powers; layered on top of Org Admin. |
| Platform admin | Cushy staff who operate the platform and can assist any organization. |
| Capability | One thing a caller may do (read, mutate_infra, …). Roles are bundles of capabilities. |
| Cloud account / connection | A read-only link from your org to one cloud account/project/subscription. |
| Cutover | The one-time, sticky switch from the empty state to your real synced data when your first connection turns healthy. |
| Inventory | The synced record of resources discovered in your connected accounts. |
| Sync pass | One run of the sync engine over claimed work units. |
| Token bucket | The per-provider rate-limit budget the sync engine respects, with jittered backoff. |
| Freshness / SLA | How recently a section was synced, and the window within which it is considered fresh. |
| Soft delete | Marking a vanished or disconnected resource row rather than erasing it (removed_upstream / account_disconnected). |
| FOCUS | The FinOps Open Cost & Usage Specification — the standard Cushy normalizes billing into. |
| Untagged bucket | The explicit cost bucket for spend with no team tag, so nothing hides in an aggregate. |
| Workload identity federation | GCP's keyless trust mechanism Cushy uses to read a project. |
| ExternalId | A per-connection secret in an AWS role's trust policy that defends against the confused-deputy problem. |
| OIDC | OpenID Connect — the SSO protocol Cushy supports for bring-your-own identity providers. |
| JIT provisioning | Creating a user automatically on first SSO login, with the org's default role. |
| cc_pat_ | The prefix of a Cushy API token secret. |