Core concepts
Sencai uses a small set of recurring concepts across every part of the product. Understanding these first makes the rest of the app - and the rest of this documentation - much easier to follow.
Organization
Section titled “Organization”An organization is your team’s shared workspace. Cloud instances, fleet agents, billing, and settings all belong to an organization, not to an individual user. Every Sencai user belongs to at least one organization, and can belong to several. See Organizations & teams.
Member and role
Section titled “Member and role”A member is a user who has accepted an invitation into an organization (or created it). Each member has a role - Owner, Admin, Member, Auditor, or Viewer - that determines what they can do inside that organization. Roles are per-organization: the same person can be an Admin in one organization and a Viewer in another. See Roles & permissions.
Cloud account (provider credential)
Section titled “Cloud account (provider credential)”A cloud account - sometimes called a provider credential - is how you connect your own cloud provider (AWS, Hetzner, Azure, and others) to Sencai. It’s what lets Sencai provision and manage infrastructure on your behalf, billed by that provider directly. An organization can connect more than one. See Connect a cloud provider.
Cloud instance
Section titled “Cloud instance”A cloud instance is a virtual machine that Sencai provisions and tracks, running on a connected cloud account. Instances have a lifecycle - provisioning, running, stopped, terminated, and so on - and every state change is recorded. See Provision & manage instances.
Managed resource and inventory item
Section titled “Managed resource and inventory item”When Sencai scans a connected cloud account, it can find infrastructure that already exists there - servers, networks, and other resources you created outside Sencai. Each of these shows up as an inventory item. Importing one turns it into a managed resource: Sencai now tracks its lifecycle and can act on it the same way it would for something it provisioned directly, going forward. An inventory item you haven’t imported is visible, but Sencai isn’t managing it yet.
Fleet agent
Section titled “Fleet agent”The fleet agent is a small piece of software you install directly on a server - cloud, on-prem, or bare metal, with or without a connected cloud account. Once enrolled, it reports inventory, patch status, and security scan results, and can run pre-approved runbooks. See Fleet agent.
Runbook
Section titled “Runbook”A runbook is a pre-approved, reusable operational task - a service restart, a log collection, a certificate rotation - that you can trigger against an enrolled fleet agent, either manually or automatically in response to an alert. See Runbooks.
Policy
Section titled “Policy”A policy is a rule Sencai evaluates against your resources or actions.
How far a policy goes depends on which kind it is: a compliance policy set
to block refuses a provisioning request outright, while some others
record the rule you intend to apply and leave enforcement elsewhere. Each
policy page in this documentation says which applies. See
Cloud policies.
Blueprint
Section titled “Blueprint”A blueprint is a reusable infrastructure template - a saved configuration you can deploy repeatedly instead of setting up the same kind of instance by hand each time. See Blueprints.
Incident
Section titled “Incident”An incident is a tracked, correlated problem - typically raised from one or more alerts - that your team works until it’s resolved. Incidents carry their own timeline, notes, and audit trail. See Incidents.
Audit event
Section titled “Audit event”Every meaningful action in Sencai - who provisioned what, who changed a role, who accepted an invitation - is recorded as an audit event in an append-only trail scoped to your organization. It’s the record you’d hand to an auditor or use to answer “who did this and when”. See Audit log.
Two billing axes
Section titled “Two billing axes”Sencai bills along two independent axes. Your organization’s plan covers shared infrastructure, seats, and organization-wide limits. Your own personal plan covers things scoped to you individually - how many organizations you can own, and personal AI-assisted features. They’re set and paid for separately; one doesn’t imply the other. See Billing & Plans.
The async model - actions are queued and tracked, not instant
Section titled “The async model - actions are queued and tracked, not instant”Provisioning a cloud instance, running a discovery scan, or triggering a runbook doesn’t happen the instant you click. The underlying work takes time and can fail partway through, so Sencai queues the action, dispatches it, and tracks its progress through a visible state - you’ll see an instance move through Provisioning before it reaches Running, for example, rather than a spinner that either finishes or times out with no explanation.
Organization scoping and isolation
Section titled “Organization scoping and isolation”Everything you see in Sencai - instances, agents, audit events, billing - is scoped to the organization you’re currently viewing. Data does not leak between organizations you don’t belong to, and a role in one organization grants nothing in another. If you manage infrastructure for more than one customer (for example as an MSP), Sencai has a separate, explicit mechanism for that rather than blurring organization boundaries - see Agency & MSP.