Glossary
Definitions of the core nouns used throughout Relay.
Organization — Relay's top-level tenant. Owns billing, members, roles, and workspaces. See Organizations.
Workspace — a scope within an organization for isolating environments or teams. Databases, connections, agents, and policies live here. See Workspaces.
Managed database — a Relay-operated database cluster (engine + nodes + provider/region) whose lifecycle Relay owns. See Managed databases.
Cluster — a managed database instance: one or more nodes running an engine.
Connection — a pointer to a database Relay governs access to (often one you already run). See Connections.
Connection group — a labeled bucket of connections. See Connection groups.
Agent — brokers governed connections and applies masking and policy. It runs as one or more replicas, by Relay for a managed agent or by you for a self-hosted one. See Agents.
Replica — one process of an agent. An agent's replicas share its tunnels. See Replicas.
Agent pool — the former name of an agent. The API and the Terraform provider
(relay_connection.agent_pool) still call an agent a pool. See
Agents.
Tunnel — a live, masked session opened through an agent (relay connect). See
Tunnels.
Credential source — where a connection's database password comes from: Store in Relay (encrypted at rest by the server) or an external secret store (Vault, AWS Secrets Manager) that the agent reads at connect time, which Relay does not store. See Credential sources.
Access grant — a grant of access to a connection or group for a user or team. See Access grants.
Masking — column-level redaction of query results. See Data masking.
Policy — a reusable set of query-firewall rules activated on a connection. See Query policies.
Role / binding — a role bundles permissions; a binding grants a role to a user or team at a scope. See RBAC.
Team — an organization-scoped group of users that can be a binding subject.
Machine tier — a compute preset (R5–R200) for a managed database.