---
title: "Concepts"
description: "Understand how a job runs, which machine executes it and where the security checks apply."
canonical_url: "https://docs.oz0.ai/concepts"
---
# Concepts

> Understand how a job runs, which machine executes it and where the security checks apply.

For: cluster operators and plugin authors.

Understand how a job runs, which machine executes it and where the security checks apply.

## Follow a job

Read [the architecture](https://docs.oz0.ai/concepts/architecture), then [jobs and durability](https://docs.oz0.ai/concepts/jobs) and [routing](https://docs.oz0.ai/concepts/routing). The architecture diagram shows the three planes and their connections.

## Review trust and authority

Start with [the security model](https://docs.oz0.ai/concepts/security) and [the threat model](https://docs.oz0.ai/concepts/threat-model), including its known gaps. Use [the tool-call decision reference](https://docs.oz0.ai/concepts/how-a-tool-call-is-decided) to trace a particular check.

## Plan a deployment

Compare [Temporal backends](https://docs.oz0.ai/concepts/temporal), review [limits and measured capacity](https://docs.oz0.ai/concepts/limits-and-scaling), and check [outbound connections](https://docs.oz0.ai/concepts/outbound-connections).

## Verify delegated work

Read [run receipts](https://docs.oz0.ai/concepts/run-receipts) for authority envelopes, call bindings and offline verification. [Delegation and identity](https://docs.oz0.ai/concepts/delegation-and-identity) maps the current implementation and its limits.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.