The words these docs use, and how the parts fit together. Read this once before you set up access for your company.
Your gateway runs in your cloud, next to your data. People reach it from Claude or ChatGPT through two connectors.
Admins also manage it from a web console. Your company directory decides who signs in, and Portward decides what
each signed-in person may use.
| Part | What it is |
|---|
| Gateway | The Portward server you run in your own cloud account or on your own server. It holds the connections, the rules, the context and the records. Its address looks like https://acme.gw.portward.ai. |
| Data connector | The connector at /mcp. Everyone who asks questions adds it in Claude or ChatGPT. It lists the datasets a person may use and runs read-only queries. |
| Admin connector | The connector at /admin/mcp. Only admins can connect it. Admins use it to connect sources, set rules, add context and read records, by asking in plain words. |
| Admin console | Web pages at https://<your gateway>/console/ for admins. They show the same settings as the admin connector, plus who signed in and the full records. See Admin console. |
| Directory | Your company’s identity provider, such as Microsoft Entra ID, Okta or Google Workspace. People sign in there. Its groups decide who is an admin and who may use which data. See People and groups. |
| Term | Meaning |
|---|
| Source | One connection to a database, warehouse, file store or business app, such as sales for a Postgres database. You give each source a name when you connect it. |
| Dataset | One table (or file, or sheet) in a source. People and the AI refer to it as source.dataset, such as sales.invoices. |
| Exposed | A dataset the AI and people may use. A new source exposes nothing until an admin saves its access rules, and each table stays hidden until you switch it on. |
| Read-only login | The database login the gateway uses for a source. Setup refuses to expose a table that login can write to. |
| Allowed host | A database host name setup may connect to. A source on any other host can’t be connected. See Approvals and safety. |
| Term | Meaning |
|---|
| Admin | Someone in an admin group (or named in the config file as an admin). Admins use the admin connector and the console. An admin can also use the data connector. |
| Data user | Someone allowed to use the data connector. You choose data users by directory group or, in the config file, by email or email domain. |
| Group | A group from your directory, written exactly as the directory sends it. Microsoft Entra ID sends each group’s Object ID; Okta and most others send the group’s name. Portward has no groups of its own. |
| Dataset groups | The groups a dataset is limited to. A dataset with no groups is open to every data user. See Dataset access. |
| Column rule | Per column, what the AI sees and what people see in their results. See What people and the AI see. |
| Token | A stand-in such as EMAIL_1a2b3c4d5e6f7a8b that the AI sees instead of a real value. The same value always gets the same token, so the AI can still count, group and join on it. |
| Totals only | A column the AI may only total, average or count, over groups of at least 5 rows by default. |
| Fresh sign-in | A change that gives more access waits until the admin signs in again at the directory and confirms it. Also called step-up. See Approvals and safety. |
| Term | Meaning |
|---|
| Context | What a dataset means, written down: a summary, what each column means, what codes stand for, business rules and notes. The AI reads it next to the columns. See Context and definitions. |
| Definition | What one column means. It is either confirmed by an admin, or a draft. The AI treats a draft as unconfirmed and says so. |
| Assumption | How the AI read a question, such as “open = status ‘open’”. The AI states its assumptions with each query, and the answer record keeps them. |
| Link | Which column in one source matches which column in another, such as a customer email in the shop database and in the CRM. The AI can’t join two sources in one query, so it uses links to match rows. |
| Term | Meaning |
|---|
| Answer record | What the gateway writes for every query: who asked, when, from which AI app, the SQL, the datasets and columns, which columns were tokens, the definitions and rules in force, the AI’s assumptions, the row count and a hash of the result. Never the real values of token columns. |
| Evidence pack | One answer record with everything around it: later reveals and shares, the rules version, and whether every log verifies. You can download it as JSON. See Audit and evidence. |
| Reveal | When someone clicks to show a value their admin set to Click to show. Each one is recorded. |
| Setup log | Every change to sources, access, context, definitions and links: who made it and when. |
| Tamper check | Each log is hash-chained, so an edited, deleted or reordered entry shows up when the logs are verified. |
People and groups shows how to model your departments, teams and projects with the groups you
already have.
