A program that runs independently and automatically to carry out a task (think software robot). In CFEngine, the agent is called cf-agent and is responsible for making changes to computers.

(Originally, the word robot, meaning "servile worker," was coined for the influential Czech writer Karel ńĆapek's play R.U.R by his brother. The characters in that play are capable of fairly independent thought, so the original sense of the word is apt to describe CFEngine's agents as well.)



A promise body is the description of exactly what is promised (as opposed to what/who is making the promise). The term body is used in the CFEngine syntax to mean a small template that can be used to contribute as part of a larger promise body.


Bundles for knowledge


In CFEngine, a bundle refers to a collection of promises that has a name.

Call collect


Classes are used to classify a system (or the state of it) and to make decisions in CFEngine policy. Classes are sometimes referred to as contexts.

Class expressions

Multiple classes separated by operators (and, or) to make more complex decisions.

Class guards

Used to restrict when / where promises are evaluated. Appear in front of promises in CFEngine policy, consisting of a class expression followed by two colons. Class guards are sometimes called context class expressions.


A Configuration Management Database. A term coined as part of the IT Infrastructure Library (ITIL) as an outgrowth of an inventory database.


Common control


Standalone applications include cf-agent, cf-promises, cf-runagent, cf-know, cf-report, cf-hub

Daemons include cf-execd, cf-monitord, and cf-serverd


CFEngine's data types describe what a variable can contain. A variable can't be assigned a different type once it's been set. The commonly used data types are string, slist, int, real, and data.



Enterprise API

Enterprise reporting

File structure




Unix terminology for a computer that runs "guest programs." In practice, "host" is a synonym for "computer."


A software component in CFEngine Enterprise that acts as a single point of management in a local "star-network." The term "hub" is sometimes used to mean policy distribution server, but more commonly a running cf-hub process that does report collection from all CFEngine managed hosts. The term hub means the centre of a wheel, from which multiple spokes emerge.



Mission Portal




Normal ordering


Pattern matching

PCI compliance

Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment.

Policy levels

Policy server

The special server that others consult for the latest policies is called the policy server.

Typically the policy server is set by the bootstrapping process.

Policy writing


A policy is a set of intentions about the system, coded as a list of promises. A policy is not a standard, but the result of specific organizational management decisions.


Promise attributes

Promise types


The CFEngine software manages every intended system outcome as "promises" to be kept. A CFEngine Promise corresponds roughly to a rule in other software products, but importantly promises are always things that can be kept and repaired continuously, on a real time basis, not just once at install-time.

Promises are idempotent, meaning they can be executed many times with the same outcome.

They are also convergent, meaning they can only nudge the system closer to a steady state, never destabilize it. While there are ways a user could override this, it's almost never a good idea to do so.


Report collector



Role-Based Access Control (RBAC)



For historical reasons, certain computers are referred to as servers, especially when kept in data centers because such computers often run services.

In CFEngine, cf-serverd is a software component that serves files from one computer to another. All computers are recommended to run cf-serverd, making all computers CFEngine servers, whether they are laptops, phones, or data center computers.

The special server that others consult for the latest policies is called the Policy Server.

Special variables

Standard library

The standard library lives in a masterfiles/lib subdirectory. It's a collection of useful bundles and bodies you can use.



Version control