# Technology reference

This section explains the technologies a business meets around Connect — protocols, formats, mail and telephony standards, database mechanisms and model behaviour. Every page states plainly whether Connect uses the thing, and pages exist for technologies Connect deliberately does not use, because knowing what a system avoids is as useful as knowing what it runs.

- **Status:** Reference
- **Audience:** both, developer
- **Last verified:** 2026-09-10
- **Canonical:** https://connectbyjbrh.com/docs/technology/

## The ten questions every page here answers

1. What the technology is, in one paragraph without jargon.
2. Why a business would care — the decision it changes.
3. Whether Connect uses it, stated as one of five words.
4. Where it appears in Connect, named concretely.
5. The architecture in miniature: what talks to what.
6. The Connect workflow it belongs to, with a link.
7. The security concerns it brings with it.
8. Its limits, including the unflattering ones.
9. The neighbouring terms it is confused with.
10. The official specification, with its URL.

The order varies. Some pages open with a worked example, some with the failure that made the topic interesting, some with the wire exchange itself. What does not vary is that the usage question is answered explicitly rather than implied.

## Does Connect use everything described in this section?

No, and that is the point of the section. A technology page is background first. Roughly one page in ten here describes something Connect runs in production; the rest are context a reader needs in order to understand a decision, a limit or a provider's behaviour.

Three examples of the difference. Connect uses server-sent events for its own event stream, so [that page](/docs/technology/sse/) says **used**, and names the surface. Connect does not use WebSocket for its application data, so [that page](/docs/technology/websocket/) says where WebSocket genuinely does appear — the browser softphone's SIP signalling — and where it deliberately does not. Connect does not publish BIMI, so [that page](/docs/technology/bimi/) is educational only and says so in its second sentence.

## The five status words

| Word | What it means on a technology page |
|---|---|
| Reference | Background on a standard. Connect's own use of it, if any, is stated separately in the page's usage section. |
| Available | The page's subject is itself a Connect capability that runs in production for both audiences. |
| Foundation | The model, service and tests exist; the usable capability is deliberately narrower than the code. |
| Not yet | Designed, written down, not implemented. Nothing on such a page describes behaviour you can use. |
| Available (operator) | Running, but part of operating the platform rather than of using Connect. |

Most pages in this section carry **Reference**. A page carries **Available** only when its subject is a shipped capability rather than a general technology — [call routing](/docs/technology/call-routing/) is Connect's, [SIP](/docs/technology/sip/) is the industry's.

## Version strings and dates

Where a page quotes a protocol revision — the Model Context Protocol's date-stamped version, OpenAPI 3.1.0, AsyncAPI 3.1.0, JSON-RPC 2.0, RFC 9309 — the string comes from the corpus's verified fact table and was re-read from the primary source on 10 September 2026. A version is never inferred from a library's changelog or from memory.

> **Note** Every page prints the date it was last checked. A technology page that has drifted is a defect worth reporting; a version string that disagrees with the specification it links to is the same defect.

## Where to go next

- For the wire protocols Connect *publishes* to machines — MCP, A2A, OpenAPI, Arazzo, AsyncAPI — read [Protocols](/docs/protocols/).
- For one-line definitions of Connect's own vocabulary, read the [Glossary](/docs/glossary/).
- For the machine-readable status of every capability, read [Product status](/docs/product/status/).
- For integration work rather than concepts, start at the [developer section](/developers/).

## Everything in this section

119 pages, each with its own status and the date it was last checked against the running system.

| Page | What it covers |
|---|---|
| [Agent observability](/docs/technology/agent-observability/) | Recording an agent's work so a decision taken weeks ago can be explained: what to capture, what is useless afterwards, and where Connect keeps it. |
| [Agent orchestration](/docs/technology/orchestration/) | Sequencing agent work, retrying what failed, and the single-thinker rule that stops two loops from answering the same message twice. |
| [Agent security](/docs/technology/agent-security/) | The threat model for software that holds real mail credentials and takes real actions on a business's behalf, and the boundaries that keep a mistake small. |
| [Agentic workflow](/docs/technology/agentic-workflow/) | Multi-step work with tools and checkpoints: how an agentic workflow differs from a script, and where the human checkpoints have to sit to be worth having. |
| [AI agent](/docs/technology/ai-agent/) | The AI agent concept: the perceive-decide-act loop, the three things that make one useful in a business, and the two that make one dangerous. |
| [Audit logs](/docs/technology/audit-log/) | The four things an entry needs before a log counts as an audit trail, why refusals belong in it, and what turns the same file into a liability. |
| [Authorisation models](/docs/technology/authorization-models/) | Allowlists, roles, scopes and row policies compared by the failure each one produces, and how Connect layers three of them over one request. |
| [Backups and restore](/docs/technology/backup-restore/) | What a backup has to contain before a restore actually works, the parts that live outside the database, and the rehearsal that turns a hope into a fact. |
| [Barge-in](/docs/technology/barge-in/) | Interrupting a talking voice agent: the two ways it fails, how an ignored interruption is measured, and why resuming afterwards is usually wrong. |
| [BIMI](/docs/technology/bimi/) | What BIMI actually requires before a logo appears anywhere: DMARC at enforcement, a constrained SVG, and for some clients a mark certificate. |
| [Bounces](/docs/technology/bounce/) | Hard, soft and the classes in between: what a bounce actually is, why some rejections never bounce at all, and the response each one deserves. |
| [Call quality measurement](/docs/technology/call-quality/) | Two different things are called call quality. What a conversation review can measure on the wire, what a network metric measures, and what neither can judge. |
| [Call routing](/docs/technology/call-routing/) | How a ringing number becomes a workspace, a line and a handler, and why direction, opening hours and worker capacity are part of that decision. |
| [Call transcripts](/docs/technology/call-transcript/) | What a call transcript contains on a speech-to-speech call, what it is reliable evidence for, and why timing read from transcript rows is wrong. |
| [Canonical URLs](/docs/technology/canonical-url/) | What a rel=canonical element actually decides, the duplicate URLs it consolidates, and the signals that quietly overrule it. |
| [Choosing a model](/docs/technology/model-selection/) | The axes that decide which model does a piece of business work, how a default gets set, and what actually changes when you move one. |
| [Circuit breakers](/docs/technology/circuit-breaker/) | Open, closed and half-open: how a failure counter stops a dying provider taking your own workers with it, and what Connect runs in place of one. |
| [Complaint feedback loops](/docs/technology/feedback-loop/) | What a mailbox provider sends back when someone presses the spam button, why the recipient is often redacted, and the only correct response. |
| [Content Security Policy](/docs/technology/csp/) | Content Security Policy as a source allowlist: what it blocks, why inline script is the usual casualty, and why these docs carry no JavaScript. |
| [Context compression on a live call](/docs/technology/context-compression/) | Why a live model is re-billed for its whole context every turn, what a compression trigger and target do, and why the trigger has to be sized. |
| [Context window](/docs/technology/context-window/) | The span of text a model can attend to in one call: what has to be re-sent every turn, what it costs, and why a larger window is not a longer memory. |
| [CORS](/docs/technology/cors/) | What the same-origin policy stops, what a preflight is really asking, and why an Allow-Origin header protects a browser rather than a server. |
| [Credential rotation](/docs/technology/credential-rotation/) | Why a password is read from a managed secret at boot rather than kept in a file, what a stale copy breaks, and how OAuth tokens rotate themselves. |
| [CSV formula injection](/docs/technology/csv-injection/) | A CSV cell that begins with an equals sign becomes a formula when a spreadsheet opens it. The attack, the neutralisation, and why an export looks escaped. |
| [Data residency](/docs/technology/data-residency/) | What residency, sovereignty and localisation each mean, which parts of a system they actually constrain, and the questions worth asking a supplier. |
| [DID — a direct inward dialling number](/docs/technology/did/) | A business phone number as a technical object: what direct inward dialling means, what renting a number gives you, and where routing is decided. |
| [Digital employee](/docs/technology/digital-employee/) | What a digital employee is as a category: a permanent role with responsibilities, memory and oversight, rather than a task-shaped agent you launch and forget. |
| [DKIM](/docs/technology/dkim/) | DKIM signatures: what is signed, how a receiver verifies, why signatures break in transit, and how keys are rotated with a selector. |
| [DLT — Distributed Ledger Technology registration in India](/docs/technology/dlt/) | India's distributed-ledger registration for commercial messaging: what the regulator requires, who registers what, and why an unregistered message is rejected upstream. |
| [DMARC](/docs/technology/dmarc/) | How DMARC works: alignment against the From header, the three policies, the two report types, and the deployment order that does not lose mail. |
| [DNS](/docs/technology/dns/) | The record types a business communications setup actually depends on, and why TTL is an operational commitment rather than a number in a form. |
| [DTMF](/docs/technology/dtmf/) | Keypad tones: how a digit is encoded, the three ways it travels, and why a voice agent should mostly listen instead of asking for keypresses. |
| [Email deliverability](/docs/technology/deliverability/) | The factors that decide whether mail reaches an inbox, ranked honestly: who you send to first, authentication second, content much later. |
| [Encryption at rest](/docs/technology/encryption-at-rest/) | Which threats storage encryption actually removes, the three layers it can be applied at, and why an authenticated query reads plaintext no matter what. |
| [End-of-turn detection](/docs/technology/turn-detection/) | Deciding that a caller has finished rather than paused: silence timers against semantic endpointing, and why this dominates perceived latency. |
| [Evidence in an agent system](/docs/technology/evidence/) | What counts as evidence when software claims something happened, how it is attached to the record, and the price of a claim with nothing behind it. |
| [Gmail API](/docs/technology/gmail-api/) | Gmail's HTTP mail API: history IDs for incremental sync, labels instead of folders, and why write-back must never block a reply. |
| [Grounding](/docs/technology/grounding/) | Tying an answer to a source a person can check, and the practical difference between a grounded statement and a merely plausible one. |
| [hreflang](/docs/technology/hreflang/) | Language and region annotations that survive contact with reality: the reciprocity rule, x-default, and when hreflang is the wrong tool. |
| [HTML email](/docs/technology/html-email/) | What actually renders in a mail client, what is stripped, and why a mail reader must sanitise incoming HTML rather than trust it. |
| [HTTP](/docs/technology/http/) | The request-and-response model everything here runs on, the status codes that carry real meaning in Connect, and the three that routinely mislead. |
| [HTTP caching and revalidation](/docs/technology/http-caching/) | Freshness, validators and revalidation: how ETag and Last-Modified work, and the header that stops a browser serving a module from the last deploy. |
| [HTTPS and TLS](/docs/technology/https/) | What TLS protects on the wire, the four things it does not protect at all, and how a terminating proxy changes what the application can see. |
| [Human in the loop](/docs/technology/human-in-the-loop/) | Putting a person at the point where a decision is expensive to reverse, and the review-speed problem that decides whether the pattern survives contact with a working week. |
| [Idempotency](/docs/technology/idempotency/) | Why the same request arriving twice must not do the thing twice, the three mechanisms that achieve it, and the actions where it is the only defence. |
| [Identifiers](/docs/technology/uuid-identifiers/) | UUIDs, sequential keys and opaque identifiers compared, and the rule that saves the most trouble later: never parse an identifier you were given. |
| [IMAP](/docs/technology/imap/) | Reading a mailbox over IMAP: folders, UIDVALIDITY, flags and the cursor a client must keep — and the way a cursor loses mail. |
| [IndexNow](/docs/technology/indexnow/) | IndexNow in full: the key file, the shape of a submission, the 10,000-URL bulk limit, and what is worth telling a search engine about. |
| [JSON](/docs/technology/json/) | The data format every Connect surface speaks, and the two traps — number precision and re-serialisation — that break systems holding JSON in more than one place. |
| [JSON Schema](/docs/technology/json-schema/) | Describing the shape of a payload so a machine can check it: what a schema pins down, what it cannot say, and why valid is not the same as allowed. |
| [JSON-LD and structured data](/docs/technology/json-ld/) | Structured data as JSON-LD: what it changes, the rule that markup must match visible text, and the types not worth adding. |
| [Knowledge base](/docs/technology/knowledge-base/) | What a knowledge base is when an agent has to answer from it, and the properties that make one usable rather than merely large. |
| [Message delivery status](/docs/technology/message-status/) | Sent, delivered, read, failed: what each state is actually evidence of, why the ladder differs per channel, and why a late status must not overwrite a decision. |
| [Microsoft Graph mail](/docs/technology/microsoft-graph/) | Microsoft Graph as a mail transport: the folder model, delta queries, change notifications, and what differs from Gmail in practice. |
| [MIME](/docs/technology/mime/) | Why an email is a tree: multipart structures, transfer encodings, header encoding, and the parts a reader never sees. |
| [Multi-tenancy patterns](/docs/technology/multi-tenancy/) | Shared schema, separate schema or separate database: what each isolation pattern actually costs, and why the pattern is never the security control. |
| [Multilingual voice](/docs/technology/multilingual-voice/) | How a call's language is chosen and changed: language tags, the gap between language and script, code-mixing, and what counts as evidence of a switch. |
| [OAuth 2.0](/docs/technology/oauth/) | Delegated access without handing over a password: the code flow, what a scope really grants, and why the refresh token is the credential that matters. |
| [Observability](/docs/technology/observability/) | Metrics, logs and traces are built around requests; this system's unit of work is a conversation. What changes, and where the signals actually surface. |
| [Office Open XML](/docs/technology/office-open-xml/) | DOCX, XLSX and PPTX are ZIP archives of XML parts. What each one holds, what a reader can get from it, and the two archive attacks that get refused. |
| [One-click unsubscribe](/docs/technology/unsubscribe/) | The List-Unsubscribe headers, what a one-click POST must not do, and the gap between honouring an opt-out and advertising one. |
| [OpenID Connect](/docs/technology/openid-connect/) | The identity layer built on OAuth 2.0: what an ID token asserts, which claim is the stable one, and where identity stops and permission begins. |
| [Page experience and Core Web Vitals](/docs/technology/core-web-vitals/) | LCP, INP and CLS explained by what causes them, plus what a text-heavy documentation site should fix first and what it can ignore. |
| [PDF text extraction](/docs/technology/pdf-text/) | PDF stores positioned glyphs rather than a document, so extraction is reconstruction — and a scanned page has no text in it at all to reconstruct. |
| [Personal data](/docs/technology/pii/) | What counts as personal data, the eight places it collects in a communications system, and the handling rules that keep the collection from spreading. |
| [PostgreSQL](/docs/technology/postgresql/) | What a relational database buys a multi-tenant application, which PostgreSQL features this system actually depends on, and the costs that come with them. |
| [Prompt injection](/docs/technology/prompt-injection/) | Instructions smuggled into content an agent reads, what the attack looks like when it arrives as ordinary business mail, and the boundary that contains it. |
| [Provenance](/docs/technology/provenance/) | Recording where a statement came from, why the origin has to survive an edit, and how Connect attaches evidence to facts, memories and files. |
| [Provider webhook signatures](/docs/technology/webhook-signature/) | How a provider signs a webhook, how to verify one without introducing a hole, and why a valid signature still does not stop the same event arriving twice. |
| [PSTN](/docs/technology/pstn/) | The public telephone network as a software dependency: what you cannot do without a carrier, and the constraints a phone call imposes on an agent. |
| [Query cost](/docs/technology/query-cost/) | Counting statements instead of timing a machine, the N+1 that grows with the business, and four measured before-and-after numbers from this system. |
| [Rate limiting](/docs/technology/rate-limit/) | Caps that protect a provider, a workspace and you: the algorithms behind them, and why a 429 is a message to your queue rather than to one request. |
| [Realtime voice agents](/docs/technology/realtime-voice/) | How a speech-to-speech voice agent is actually assembled, what each part is responsible for, and the failure surface a live call exposes. |
| [Relational data modelling](/docs/technology/relational-data/) | Normalisation in plain terms, what a foreign key is really buying, and the three places this system keeps a second copy of something on purpose. |
| [Relationship memory](/docs/technology/relationship-memory/) | Memory keyed to a person rather than to a conversation, why that key changes the answers, and what it takes to hold one identity across channels. |
| [REST](/docs/technology/rest/) | The architectural style behind most web APIs, what its constraints actually buy, and the four places Connect departs from it on purpose. |
| [Retries and backoff](/docs/technology/retry/) | Which failures deserve another attempt, which are already a final answer, and why backoff without jitter turns one outage into a second one. |
| [Retrieval-augmented generation](/docs/technology/rag/) | The retrieve-then-generate pattern, the failure modes nobody advertises, and a plain account of what Connect implements and what it deliberately does not. |
| [Reversible and irreversible actions](/docs/technology/reversible-actions/) | The three-way taxonomy an agent needs before it offers undo: what can be withdrawn, what can only be corrected, and what a person must approve first. |
| [robots.txt](/docs/technology/robots-txt/) | RFC 9309 in practice: what a robots file controls, the thing people wrongly believe it does, and how Connect serves its own. |
| [Row-level security](/docs/technology/row-level-security/) | How a database enforces who may see which rows: the mechanism, why FORCE matters, the difference between USING and WITH CHECK, and what it cannot protect. |
| [RTP and media transport](/docs/technology/rtp/) | How call audio really travels: small UDP packets, a jitter buffer that costs latency, and loss that is concealed rather than repaired. |
| [Schema migrations](/docs/technology/migrations/) | Migrations that run at every boot, why every guard has to be idempotent, and the expression index a reflection API cannot find for you. |
| [Secret management](/docs/technology/secret-management/) | Where a credential should live, how rotation is supposed to work, and why a convenience copy of a rotated password becomes a fuse that blows at the next restart. |
| [Sender IDs](/docs/technology/sender-id/) | The four kinds of sender identity a recipient can see, why an alphanumeric name cannot be replied to, and what changing one costs you. |
| [Server-sent events](/docs/technology/sse/) | A single long-lived HTTP response that the server keeps writing to: how it streams updates one way, and why Connect uses it rather than WebSocket. |
| [Session resumption](/docs/technology/session-resumption/) | What a realtime model session is, why a server ends one mid-call, and how a resumption handle carries the conversation across the reconnect. |
| [Sessions and cookies](/docs/technology/sessions-cookies/) | How a browser stays signed in between requests, which cookie attributes do the real work, and why holding one is not permission to do anything. |
| [SIP](/docs/technology/sip/) | Signalling for calls: SIP methods and responses, why it carries no audio, what registration binds, and what a host:5060 URI means. |
| [SIP over WebSocket](/docs/technology/sip-over-websocket/) | Carrying call signalling into a browser that cannot open a UDP socket: registration, what keeps it alive, and the addressing mistakes that fail silently. |
| [SIP trunks](/docs/technology/sip-trunk/) | Inbound and outbound SIP trunks: what an origination URI is, what a dispatch rule decides, and the configuration mistakes that fail silently. |
| [SMS](/docs/technology/sms/) | How the short message service actually works: the 140-octet payload, the alphabets, what concatenation costs, and why one emoji halves your message. |
| [SMTP](/docs/technology/smtp/) | The protocol that moves mail between servers: envelope versus headers, what a 250 response proves, and the states after it. |
| [Speech recognition](/docs/technology/asr/) | Automatic speech recognition: what it does on a turn-based path, what a transcript actually is once the model speaks directly, and why it lands late. |
| [Speech-to-speech models](/docs/technology/speech-to-speech/) | A model that takes audio in and gives audio back, with no synthesiser in the loop: what that buys on a call, and what it takes away. |
| [SPF](/docs/technology/spf/) | Sender Policy Framework: the DNS record that authorises sending hosts, the ten-lookup limit, and the claim SPF cannot make. |
| [STOP and opt-out keywords](/docs/technology/stop-keyword/) | The opt-out words a recipient may send, what honouring one actually requires, and why your suppression list and the operator's can quietly disagree. |
| [Structured memory](/docs/technology/structured-memory/) | Keeping what an agent knows as records rather than as conversation history, and the operations that only become possible once you do. |
| [Suppression lists](/docs/technology/suppression/) | The list that outranks every campaign: what belongs on a suppression list, what does not, and why entries must be hard to remove. |
| [System prompts and instructions](/docs/technology/model-context/) | The instruction block a model is given before it sees a message: what belongs in it, what does not, and why its size is a latency decision on a live call. |
| [Telephony carriers](/docs/technology/carrier/) | What a telephony carrier actually supplies, which capability differences change your architecture, and why you should ask rather than assume. |
| [Text to speech](/docs/technology/tts/) | Turning written words into speech: where a synthesiser still earns its place on a realtime call, and the three things it cannot do. |
| [Tool calling](/docs/technology/tool-calling/) | How a model asks for an action it cannot perform itself, what the schema is really doing, and the checks a tool must run before it changes anything. |
| [Transactional and marketing email](/docs/technology/transactional-vs-marketing/) | Why the transactional and marketing distinction governs consent, how a single hybrid message destroys it, and what Connect separates instead. |
| [Unicode, scripts and transliteration](/docs/technology/unicode-and-scripts/) | Why a language and a writing system are different things, what normalisation and collation actually decide, and how both show up in a call transcript. |
| [Unsupported claims](/docs/technology/hallucination/) | Why a confidently wrong answer costs a business more than a slow one, and the controls that reduce unsupported claims rather than apologising for them. |
| [Versioning](/docs/technology/versioning/) | Three problems that share one word: versioning a document, versioning a record, and versioning an interface other people have already built against. |
| [Virtualised rendering](/docs/technology/virtualised-rendering/) | Drawing only the rows a screen can show, the four things that break when you do, and why virtualising the view never fixes an unbounded query. |
| [Voice activity detection](/docs/technology/vad/) | Voice activity detection decides one thing — speech or not speech — and the choice of where it runs shapes what a voice agent can react to. |
| [Voice latency](/docs/technology/voice-latency/) | Where the seconds go on a voice call: the measured components, the floor no setting removes, and why a transcript is the wrong place to measure from. |
| [Voice profiles](/docs/technology/voice-profile/) | How a voice profile splits into session parameters the engine enforces and written directions the model only approximates, and which setting wins. |
| [WAI-ARIA](/docs/technology/aria/) | WAI-ARIA roles, states and properties: the five rules, the patterns that genuinely need it, and the ways it makes a page worse. |
| [Web accessibility](/docs/technology/accessibility/) | Accessible pages start with semantic HTML: name, role and state, keyboard order and focus — and the same structure that helps browser agents. |
| [Webhooks](/docs/technology/webhook/) | A provider calling you when something happens: verifying the sender, answering fast, and building a receiver that survives the same event arriving twice. |
| [WebRTC](/docs/technology/webrtc/) | How a browser sends and receives call audio directly: the media path, why signalling is not part of it, and the security policy that does not reach it. |
| [WebSocket](/docs/technology/websocket/) | A two-way connection that starts as an HTTP request and stops being HTTP: the one place Connect uses it, and the reason it is not used anywhere else. |
| [What a model call costs](/docs/technology/llm-cost/) | What a model call is actually billed for: tokens by direction and modality, context carried on every turn, and the spending that never appears on a per-request line. |
| [WhatsApp Business messaging](/docs/technology/whatsapp-business/) | How business messaging on WhatsApp actually works: the 24-hour window, pre-approved templates, opt-in, and Meta's coexistence route for a number already on a phone. |
| [XML sitemaps](/docs/technology/sitemap/) | XML sitemaps as a discovery aid: what belongs in one, why lastmod must be true, and when an index file becomes necessary. |

## Questions

### Why write pages about technologies Connect does not use?

Because the question gets asked, and an unanswered question gets answered by a guess. A buyer who asks whether Connect uses a vector database deserves a page that says no and explains what it does instead, rather than silence that reads like yes.

### Are these pages accurate about other vendors' products?

They describe standards and mechanisms, not vendors' feature lists. Where a provider's behaviour is named it is because Connect depends on it, and the page says which provider and on what evidence.

### How current is a version number on one of these pages?

It carries the date the corpus was verified, printed at the foot of every page. Specifications move; treat the linked specification as the authority and this manual as a reading of it on that date.

## Related

- [Protocol reference](https://connectbyjbrh.com/docs/protocols/)
- [Glossary](https://connectbyjbrh.com/docs/glossary/)
- [Capability status](https://connectbyjbrh.com/docs/product/status/)
- [AI agent](https://connectbyjbrh.com/docs/technology/ai-agent/)
- [HTTP](https://connectbyjbrh.com/docs/technology/http/)
- [Developers and AI agents](https://connectbyjbrh.com/developers/)

## What this page is based on

- Connect capability registry (docs-source/facts.py) — STATUS and PROTOCOLS
- AGENTS.md §2 — where things are
- docs-source/WORKER-BRIEF.md §4 — the status vocabulary