# Glossary > Every 3AM term in one place, A to Z, with where to read more. Admin token, autonomy, Keychain, member, pack, proven, restore move, site key, System 1, Warden and the rest. Source: https://docs.3am.si/reference/glossary · Markdown: https://docs.3am.si/reference/glossary.md · All docs: https://docs.3am.si/llms.txt 3AM is an on-prem AI on-call engineer for regulated enterprises (https://3am.si). | Term | Meaning | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Abandoned** | An incident 3AM stopped investigating because it restarted; nothing after its last event was done | | **ActionEvaluator** | The deterministic rules that classify every fix as safe, needing approval, or forbidden ([Resolution](https://docs.3am.si/how-3am-decides/resolution#the-actionevaluator)) | | **Admin token** | Created at first start. Creates the first owner, then serves automation and break-glass; never a sign-in ([Sign-in](https://docs.3am.si/access/sign-in#the-admin-token)) | | **Advise / draft** | The fix mode. `advise` gives advice when no pack fix exists; `draft` drafts a fix and may propose restore moves | | **At the alert** | A cause that can only be checked when its alert arrives (the alert names what to look at) | | **Audit log (ledger)** | Every event, hash-chained and signed, append-only ([Logs and audit](https://docs.3am.si/operations/logs-and-audit)) | | **Autonomy** | `off`, `shadow`, `L1`, `L2`, per service ([Autonomy](https://docs.3am.si/console/autonomy)) | | **Break-glass** | Signing in with the admin token when e-mail can't be sent; logged | | **Bundle** | `3am-.tar`: images, packs, installer, signed checksums ([Air-gapped](https://docs.3am.si/install/air-gapped)) | | **Causal discovery** | PCMCI+ in `3am-causal`, relating the series that shifted ([Investigation](https://docs.3am.si/how-3am-decides/investigation#causal-discovery---causal)) | | **Chronic** | A cause already true 30 minutes before the alert: not this incident's cause | | **Confidence** | `proven`, `linked`, `suspected`, `disputed`, `unproven`, `cleared` | | **Coverage** | How many of your services each kind of evidence reaches ([Guide](https://docs.3am.si/console/guide)) | | **Digest** | 3AM's call next to your team's, per service; readiness for L1 ([Digest](https://docs.3am.si/console/digest)) | | **Disputed** | Checks prove it, but System 1 reads the evidence as refuting it: goes to a person | | **Drafted fix** | A fix 3AM drafts for a proven cause with no pack fix; two approvers by default | | **Episode** | One investigation of one service's alerts, inside an incident | | **Estate** | The map of your services, owners, dependencies and where each came from ([Estate](https://docs.3am.si/console/estate)) | | **Fingerprint** | A hash identifying an install for the licence (machine id, cluster UID) | | **Hand-over** | The triage sent to people 90 s after the first alert when nothing is proven | | **Home** | The install a Keychain lives on ([Keychain](https://docs.3am.si/licensing/keychain)) | | **Incident** | One failure: every related episode, one ticket, one thread ([Incidents](https://docs.3am.si/how-3am-decides/incidents)) | | **Ingest token** | Bearer token for `POST /v1/events` and alert webhooks | | **Install log** | The hash-chained history of installs added to and removed from a licence | | **Investigator (System 2)** | The language model that reads through read-only actions and writes the note | | **Keychain** | One setup for every install (Enterprise, Strategic) | | **L1 / L2** | L1 asks before every fix; L2 also runs safe fixes unasked | | **Linked** | A symptom of another incident whose cause is proven | | **Lookback** | Your last 90 days of incidents read from ServiceNow or PagerDuty ([Impact](https://docs.3am.si/console/impact)) | | **MCTS** | The tree-search investigator (`--investigator mcts`) | | **Member** | An install that takes its setup from a Keychain's home | | **Mitigate first** | At L2, a safe fix before proof on a strong suspect with high impact | | **Pack** | Sealed knowledge of a technology: causes, checks, fixes ([Packs](https://docs.3am.si/how-3am-decides/packs)) | | **Pairing** | Joining a Keychain with six digits compared on two screens | | **Proven** | A deterministic check passed on live data, not already true before, and (outside packs) a second line agrees | | **Readiness for L1** | ≥ 5 judged proposals, ≥ 80% agreed, none policy would refuse | | **Restore move** | When nothing is proven: undo the one change just before, start what stopped, or the declared failover | | **Result** | How an incident ended: `resolved`, `restored`, `handed_over`, `linked`, `cleared`, `shadow` | | **The ring** | Every key (install) on a Keychain and how each is doing | | **Sealed file** | The Keychain in one file under a passphrase, for a site with no network to the home | | **Shadow** | Prove, rehearse, record; change nothing. The default | | **Site key** | A one-time key the home makes so a new site sets itself up (`3AMSITE1.…`) | | **Study** | A read-only rehearsal of every cause, before anything breaks ([Study](https://docs.3am.si/console/study)) | | **System 1 (tev1)** | The small model that verifies causes, fixes and sentences, and can veto a fix | | **Tier** | Starter, Enterprise, Strategic ([Licensing](https://docs.3am.si/licensing)) | | **Warden** | 3AM's licence authority (`warden.3am.si`) |