> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Core concepts

> Signals, streams, organizations, resources, permissions, storage, and runtime roles.

These concepts apply across intake, query, alerting, automation, and administration.

## Signals

MoleSignal handles four telemetry signals:

* **Logs** are discrete structured events.
* **Metrics** are numeric samples grouped into labeled time series.
* **Traces** are spans connected by `trace_id` and parent relationships.
* **Profiles** describe CPU, allocation, heap, or contention samples as call stacks.

RUM records are stored as organization streams and link browser sessions to backend traces.

[APM](/en-US/apm) is not a fifth telemetry stream. APM is a bounded projection derived from
deduplicated trace spans before tail sampling, so sampled-out traces can still contribute service,
transaction, dependency, and error aggregates.

## Streams

A **stream** is the typed contract shared by intake and query, with a name, a `stream_type`, an
evolving schema, retention, runtime state, and a `queryable` flag.

Supported types are `logs`, `metrics`, `traces`, `profiles`, and `extend`. The same name can
exist under more than one type, so APIs identify a stream with both fields:

```json theme={null}
{ "name": "app", "stream_type": "logs" }
```

Turn off `queryable` for a catch-all source that should feed a routing pipeline without appearing
in query selectors. See [Streams](/en-US/streams).

## Organizations and workspaces

An **organization** is the tenant and policy boundary. The product UI calls the selected
organization a **workspace**. Telemetry and product resources belong to exactly one
organization unless an explicit cross-organization grant or resource share allows access.

The permanent `_sys` organization is a protected platform scope for system telemetry, license
history, platform administrators, and global organization operations. The `_sys` organization is
not a normal tenant.

## Product resources

Dashboards, saved views, alert rules, schedules, reports, functions, pipelines, and Agent
workflows are organization resources. Handlers load the target resource, verify ownership, and
authorize the requested action before returning or changing the resource.

## Permissions and roles

Permissions are stable capability keys such as `streams.query`, `alerts.manage`, and
`sys.licenses.read`. Roles are named bundles of permissions. The built-in Owner, Admin, Editor,
Viewer, and Platform Administrator roles provide defaults; custom roles can express narrower
responsibilities.

Navigation uses an effective capability snapshot, but hiding a page never replaces backend
authorization. See [Identity & access](/en-US/identity).

## Time and correlation

Exploration pages share a time range. Correlation pivots preserve that range and add identifiers
such as `trace_id`, service, host, or session. This enables paths such as
`RUM → trace → log → metric → profile` without treating navigation state as authorization.

## Storage and query

Logs, metrics, and traces are stored in partitioned Parquet files. Profile metadata is queryable
while compressed pprof blobs remain in object storage. PostgreSQL stores file metadata, schemas,
IAM, product resources, and operational state.

DataFusion and Arrow execute SQL, PromQL-compatible metric queries, local searches, and
Flight-distributed scans. The planner injects the authorized organization boundary before
execution.

## Runtime roles

One binary composes these roles through `[node].roles`:

| Role            | Main responsibility                                              |
| --------------- | ---------------------------------------------------------------- |
| `standalone`    | All APIs and workers in one process.                             |
| `router`        | Entry routing, rate limiting, and forwarding.                    |
| `intake`        | Validation, pipeline execution, WAL, buffers, and Parquet flush. |
| `querier`       | DataFusion, PromQL, search jobs, and distributed query.          |
| `compactor`     | Compaction, retention, and cold metadata maintenance.            |
| `alert_manager` | Rule evaluation, schedules, escalations, and delivery.           |

See [Architecture](/en-US/architecture) for module and data-flow boundaries.