Core Concepts
Start with the conceptual pillars, then jump into Operate or Build apps for how-to steps.
Assistants & tenancy
| Concept | Summary | Read more |
|---|---|---|
| AI Workspace | Isolation unit for knowledge, tools, conversations | What is an AI Workspace? |
| Customer AI vs Employee AI | External channels vs Internal Portal | Customer vs Employee |
| Knowledge / Hybrid RAG | Grounded answers with citations | Hybrid RAG |
| RBAC | Owner / Admin / Member + teams | RBAC |
Marketplace Apps vs SDK Connections
Do not confuse these:
| Concept | What it is | Read more |
|---|---|---|
| Marketplace App | Metadata package (hosting: runtime) executed by Qefro Runtime | Runtime vs SDK · Build your first app |
| SDK Connection (Business Tools) | Signed webhook to your ERP/POS/CRM backend | Backend SDK |
| SDK-hosted package (legacy) | Managed /qefro process published as a solution | Managed apps |
Canonical entry for shipping apps: Build your first app
(qefro app init …; reference
restaurant-pro-runtime).
Platform capabilities used by apps
| Concept | Summary | Read more |
|---|---|---|
| Customer Hub / People | Shared people identity; portal nav People; ctx.customer | People · Customer Hub |
| Marketing | Apps register audiences/variables; platform owns send | Marketing |
| Organization workflows | Opaque capabilities + Internal Inbox tasks | Organization workflows |
| Managed storage | ctx.storage → storage-service / Mongo | Managed storage |
| Marketplace | Publish signed packages; tenants install/upgrade | Marketplace |
Actions & runtime
| Concept | Summary | Read more |
|---|---|---|
| Business Tool / Action | Secure call into your systems | Business Actions |
| Business Flow | Declarative multi-step orchestration | Define flows |
| Runtime / FlowRunner | Single execution engine | Runtime |
| Orchestration event | Namespaced bus envelope | Events |
| Session | Channel + conversation context | Sessions |
| vs n8n / LangGraph | Product boundaries | n8n · LangGraph |
Security
| Concept | Summary | Read more |
|---|---|---|
| Tenant / workspace isolation | Customers cannot read each other’s data; workspaces split audiences | Tenant isolation |
HMAC /qefro | Signed platform → app invokes | Application security |
| Secrets & encryption | AES-256-GCM credentials; bcrypt org passwords | Encryption |
| Agent threat model | Tools + RAG blast radius | AI Agent Security |
Full term list: Glossary.