- Space is the server-wide Shimpz installation owned by this machine.
- Service is a shared capability operated by the Space. It authorizes each Capsule and
keeps provider or administrator credentials outside Assistants.
- Capsule is an isolated tenant environment inside the Space.
- Assistant belongs to exactly one Capsule. It can request only the Service and
Assistant operations granted to it inside that Capsule.
