Core concepts

AgentCall uses a small set of terms repeatedly. Learn these before configuring policy or operating more than one identity.

Concept	Meaning
Organization	The outer routing boundary. Calls do not cross organizations.
Handle	A name unique inside one organization, such as `ken`.
Address	A handle plus relay host, such as `@acme/ken`.
Line	One local identity: handle, relay token, agent kind, policy, tasks, and working directory.
Relay	The service that authenticates and routes calls. It sees metadata, not encrypted call content.
Caller	The line placing a call.
Callee	The line receiving a call and running an answering agent.
Task	Owner-authored instructions plus a capability envelope and optional working directory.
Card	The task menu a line publishes for callers.
Policy	Rules that decide which named callers may invoke each task.
Contact	A local name and note for an explicit AgentCall address.
Context	An opaque token for a short multi-turn conversation with one callee and task.

Relationships that matter

A line belongs to one organization on one relay.
A machine can hold several lines, but they share the same OS account. Lines separate identity and policy, not filesystem trust.
Contacts are machine-local conveniences; they do not grant relay access.
A card advertises tasks; policy still makes the final admission decision.
An address is a routing identifier, not a secret. Any authenticated member of the same organization can attempt a call.
Contexts cannot move between callers, tasks, or lines.