> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Object model

> How Kontext organizes endpoints, agents, sessions, tool calls, and policies in a workspace.

export const ObjectModel = () => <div className="k-fig-wrap">
    <svg className="k-fig" viewBox="0 0 640 464" width="100%" style={{
  maxWidth: 640
}} role="img" aria-label="The workspace holds endpoints and policies. Agents run on endpoints and report sessions. Sessions contain tool calls. Kontext evaluates those calls against the applicable policies.">
      <defs>
        <marker id="obj-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
          <path className="arrowhead" d="M 1 1 L 8 5 L 1 9" />
        </marker>
      </defs>
      <rect className="box-accent" x="230" y="8" width="180" height="52" rx="6" />
      <text className="t-on-accent" x="320.0" y="39.0" textAnchor="middle">Workspace</text>
      <rect className="box" x="70" y="104" width="200" height="52" rx="6" />
      <text className="t" x="170.0" y="135.0" textAnchor="middle">Endpoint</text>
      <rect className="box" x="370" y="104" width="200" height="60" rx="6" />
      <text className="t" x="470.0" y="129.5" textAnchor="middle">Policy</text>
      <text className="t-small t-muted" x="470.0" y="148.5" textAnchor="middle">Enforced or Observing</text>
      <rect className="box" x="70" y="200" width="200" height="60" rx="6" />
      <text className="t" x="170.0" y="225.5" textAnchor="middle">Agent</text>
      <text className="t-small t-muted" x="170.0" y="244.5" textAnchor="middle">Claude Code, Codex, Cowork</text>
      <rect className="box" x="70" y="304" width="200" height="52" rx="6" />
      <text className="t" x="170.0" y="335.0" textAnchor="middle">Session</text>
      <rect className="box" x="40" y="400" width="260" height="60" rx="6" />
      <text className="t" x="170.0" y="425.5" textAnchor="middle">Tool call</text>
      <text className="t-small t-muted" x="170.0" y="444.5" textAnchor="middle">decision, mode, input, output, risk</text>
      <path className="line" d="M 290 60 V 82 H 170 V 100" markerEnd="url(#obj-arrow)" />
      <path className="line" d="M 350 60 V 82 H 470 V 100" markerEnd="url(#obj-arrow)" />
      <text className="t-muted" x="180" y="76" textAnchor="start" style={{
  fontSize: 11
}}>holds</text>
      <text className="t-muted" x="460" y="76" textAnchor="end" style={{
  fontSize: 11
}}>holds</text>
      <path className="line" d="M 170 156 L 170 196" markerEnd="url(#obj-arrow)" />
      <text className="t-muted" x="180" y="180" textAnchor="start" style={{
  fontSize: 11
}}>runs agents</text>
      <path className="line" d="M 170 260 L 170 300" markerEnd="url(#obj-arrow)" />
      <text className="t-muted" x="180" y="284" textAnchor="start" style={{
  fontSize: 11
}}>produces sessions</text>
      <path className="line" d="M 170 356 L 170 396" markerEnd="url(#obj-arrow)" />
      <text className="t-muted" x="180" y="380" textAnchor="start" style={{
  fontSize: 11
}}>contains tool calls</text>
      <path className="line" d="M 470 164 V 430 H 304" markerEnd="url(#obj-arrow)" />
      <text className="t-muted" x="480" y="300" textAnchor="start" style={{
  fontSize: 11
}}>applies to</text>
      <text className="t-muted" x="480" y="316" textAnchor="start" style={{
  fontSize: 11
}}>tool calls</text>
    </svg>
  </div>;

Everything in Kontext belongs to a workspace. A workspace holds endpoints and policies. Agents run on endpoints and report sessions. Sessions contain tool calls. Kontext evaluates those calls against the applicable policies.

<Frame caption="The workspace holds endpoints and policies. Agents run on endpoints and report sessions. Sessions contain tool calls. Kontext evaluates those calls against the applicable policies.">
  <ObjectModel />
</Frame>

## Objects

### Endpoint

An endpoint is a computer with Kontext installed. Select one in **Home** to see its user, agents, and Kontext version. The dashboard also shows its last check-in and each agent's hook status.

Kontext evaluates policies for the endpoint. When you add a policy, you choose whether Kontext evaluates it for all endpoints or selected endpoints.

### Agent

An agent is an AI tool such as Claude Code, Codex, or Claude Cowork that makes tool calls. One endpoint can run several agents. **Home** shows each agent as **Managed**, **Unmanaged**, or **Unsupported**. A policy can target one agent or all agents. See [supported agents](/getting-started/supported-agents).

### Session

A session groups the tool calls that one agent reports on one endpoint. Kontext uses the agent's session ID to identify it. Open a session in **Explore** to review its tool calls.

### Tool call

A tool call is an agent's request to run a shell command, edit a file, fetch a web page, or use an MCP tool. Open one in **Explore** to see what Kontext recorded:

| Field            | What it tells you                                                                                                    |
| ---------------- | -------------------------------------------------------------------------------------------------------------------- |
| Decision         | **Allow** or **Deny**, based on the policy.                                                                          |
| Mode             | **Observe** or **Enforce**, showing whether the endpoint applied the decision. **Disabled** means you paused policy. |
| Input and output | The captured input from the agent and output from the tool.                                                          |
| Risk             | The endpoint predicts risk. **Risk** shows an assessment for flagged calls.                                          |
| Cost             | **Cost** prices the model requests linked to the call.                                                               |

An allowed tool call can still fail. In Observe, the endpoint runs a tool call even when Kontext records Deny.

### Policy

A policy is a rule Kontext uses to decide tool calls. You can add a preset such as **Block GitHub force pushes** or write a policy in Cedar. **Policies** lists each policy under **Enforced** or **Observing**. The workspace creates a policy version for every change you save. **History** lists who saved each version and when.

## Relationships

* The workspace holds endpoints and policies.
* Agents run on endpoints. An agent on an endpoint produces sessions.
* A session contains tool calls.
* Kontext evaluates each tool call against applicable policies. Each policy's scope says which endpoints and agents it covers.

Kontext can apply different policies to tool calls in the same session. **Explore** shows each decision's reason. For an enforced Deny, the reason names the rule, for example "Blocked by rule block-github-force-push".