> ## Documentation Index > Fetch the complete documentation index at: https://docs.corepillar.ai/llms.txt > Use this file to discover all available pages before exploring further. # Concepts > A glossary of the building blocks in AgentHub: organizations, projects, roles, keys, traces, and evaluators. This page defines the terms you will meet across AgentHub. Each entry says what the thing is, where it lives, and who can change it. ## How the pieces fit ```mermaid theme={null} flowchart TD ORG[Organization] --> MEM[Members with roles] ORG --> VAULT[API Key Vault] ORG --> SSO[SSO configuration] ORG --> EVALS[Evaluators and collections] ORG --> PROJ[Projects] PROJ --> MC[Model configs] PROJ --> TK[Tracing keys] PROJ --> TR[Traces] TR --> SP[Spans] MC -. bills to .-> VAULT TK -. authenticates .-> TR ``` ## Organization Your tenant. Members, roles, provider keys, SSO, and the audit history all belong to the organization. Everything else hangs off it. * **Created by:** anyone signing in for the first time (during onboarding), or an existing admin or super admin through **New organization** in the organization switcher. AI Builders and Users cannot create organizations. * **Creator's role:** the person who creates an organization becomes its **Owner**. * **Fields:** name, slug, data residency region (`us`, `eu`, or `apac`; defaults to `us`), and plan (`standard` or `enterprise`; defaults to `standard`). These are shown read-only under **Settings → General**. There is no screen to change them. ## Project A workspace inside an organization, one per agent or workflow you want to observe. Traces, model configs, tracing keys, Cost Calculator runs, and evaluation runs are scoped to a project. * **Created by:** Owners and Admins (and super admins), from **New project** in the project switcher or during onboarding. * **On creation:** AgentHub generates one live tracing key for the project automatically. * Almost every page URL is `///`. ## Workspace Onboarding uses "workspace" for the organization and project you create together ("Name your workspace"). It is not a separate object. ## Slug The URL-safe name derived from an organization or project name: lowercased, with every run of characters other than `a–z` and `0–9` replaced by a hyphen, leading and trailing hyphens removed, and cut to 48 characters. "Acme Support Team" becomes `acme-support-team`. * Organization slugs are unique across the whole platform. If yours is taken you will see "An organization with a similar name already exists. Try a different name." * Project slugs are unique within their organization ("A project with a similar name already exists."). * Slugs are set once and cannot be edited. ## Environment A label on traces and Cost Calculator runs that keeps test and production data apart. Each project gets five environments derived from a base name: `_Test`, `_Pre-Production`, `_Production`, `_Staging`, and `_Development`. The environment selector appears in the header only on Cost Calculator pages. ## Roles AgentHub uses two layers of roles. **Database roles** are created in every organization: **Owner**, **Admin**, **Editor**, and **Viewer**. Each carries a list of permission strings such as `manage_members` or `run_agents`. **Hub roles** decide which product you can use: | Hub role | Comes from | ModelHub | AgentHub | Settings | | - | - | - | - | - | | Super Admin | A per-site list configured by CorePillar, not stored in your organization | Yes | Yes | All tabs | | Admin | Owner or Admin | Yes | Yes | General, User Management | | AI Builder | Editor | Yes | Yes | None | | User | Viewer | Yes | No | None | The full permission matrix is in [Roles and permissions](/agenthub/settings/roles-and-permissions). ## Member and invite A **member** is a person with a membership in an organization, holding one database role. An **invite** is a pending membership for an email that has no account yet. Invites expire after 7 days and are accepted at a link of the form `/invite/`. If the email already has an account, it is added as a member immediately and no invite is created. See [Members and invites](/agenthub/settings/members). ## Platform access A platform-wide allowlist of who may sign in at all, separate from organization membership. An address can be approved individually, or a whole domain can be allowlisted as `@company.com`. Only super admins manage it. See [Platform access](/agenthub/settings/platform-access). ## API Key Vault (BYOK) The organization's store of model provider API keys. "Bring your own key" (BYOK) means AgentHub calls the provider with your key and the provider bills you. * Keys are encrypted with AES-256-GCM before they are stored. * After you save a key, AgentHub only ever shows a short hint, never the full key. * Keys are validated against the provider before they are saved. * The **Platform Demo Key** is a platform-funded key with a \$50.00 allowance per organization on Anthropic models. It appears in the vault the first time someone opens Model Manager. Its hint reads `platform-managed`. Managed in [Model Manager](/agenthub/model-manager). ## Model config A model a project is allowed to use: a provider, a model identifier, a display name, and the vault key it bills to. Model configs feed the LLM-judge evaluators, the Cost Calculator, and the models your employees can pick in ModelHub chat. ## Tracing key The credential your agent sends with each trace, scoped to one project. Keys look like `tk_live_` or `tk_test_` followed by 48 hexadecimal characters. AgentHub stores only a SHA-256 hash and a hint; the full key is shown once, when you create it. See [Tracing keys](/agenthub/settings/tracing-keys). ## Trace and span A **trace** is one run of your agent. A **span** is one step inside it: an LLM call, a tool call, an HTTP request, a database query, a function, or an evaluation. Each span carries its name, kind, model, status (`OK` or `ERROR`), tokens in and out, cost in USD, latency, input, output, attributes, and start and end times. A trace holds between 1 and 500 spans per request. Traces are rolled up from their spans: duration, LLM time, call counts, tokens, and cost. A trace's `source` is `live` for traces your agent sent and `simulation` for traces the Cost Calculator produced. See [Traces](/agenthub/traces) and the [trace format](/agenthub/developers/trace-format). ## Evaluator A check that scores a trace from 0 to 1, decides pass or fail, and explains why. There are two kinds: * **Offline** evaluators are deterministic heuristics. They make no model call and cost nothing. * **LLM-judge** evaluators fill a prompt template with the trace and ask a model to grade it. Templates use the placeholders `{{input}}`, `{{output}}`, and `{{trace}}`, and must contain at least one. AgentHub includes 45 built-in evaluators that belong to no organization. You can add your own. See [Evaluators](/agenthub/evaluation/evaluators). ## Collection An ordered set of evaluators you run together against a trace. A collection can belong to the whole organization or to one project. See [Collections](/agenthub/evaluation/collections). ## Evaluation run One application of a collection to a trace. It records a result per evaluator plus an average score and a pass rate. See [Evaluation runs](/agenthub/evaluation/runs). ## Super admin A person on CorePillar's per-site super admin list. Super admins can always sign in, act with the full Owner permission set in every organization they belong to, and are the only people who see the **SSO**, **Tracing keys**, and **Platform access** settings tabs. The list is kept outside your organization's data on purpose, so that a bad change or an unreachable database cannot lock everyone out. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.