Glossary: Systems & Backend
All 177 cards in this deck
The systems vocabulary — consistency, queues, caching, failure modes — straight from the glossary. Answer each question before you open it — then run the review above, which schedules every card with spaced repetition so it comes back right before you would forget it.
CAP Theorem
During a network partition a distributed store must choose consistency or availability, not both.
Consistent Hashing
Mapping keys and nodes onto a ring so adding a node moves only ~K/N keys, not all of them.
Idempotency
A property where doing an operation twice has the same effect as doing it once.
Rate Limiting
Capping how many requests a client may make, protecting a service from overload and abuse.
Sharding
Splitting data across many machines so no single node holds — or bottlenecks on — all of it.
Quorum (N/R/W)
Requiring a minimum number of replicas to agree on a read or write to tune consistency.
Eventual Consistency
Replicas may briefly disagree but converge to the same value once writes stop.
Backpressure
Signaling upstream to slow down when a system can’t keep up, instead of collapsing.
Cache Invalidation
Keeping cached data correct as the underlying source changes — famously one of the hard problems.
p99 Latency (tail latency, percentile latency)
The response time your worst 1% of requests exceed — the tail users actually feel.
Raft (consensus algorithm, Paxos)
The understandable consensus algorithm — how a cluster agrees on one log despite crashes.
Leader Election
Picking exactly one node to be in charge — and handling the moment the old leader doesn’t know it lost.
Two-Phase Commit (2PC, atomic commit)
All-or-nothing across systems: everyone votes, then everyone commits — at the price of blocking.
Saga Pattern (compensating transactions)
A distributed transaction as a chain of local ones — undo by compensation, not rollback.
Outbox Pattern (transactional outbox)
Write the event in the same DB transaction as the data; publish it afterwards — no lost, no phantom events.
Change Data Capture (CDC)
Streaming a database’s change log to other systems — sync caches, indexes and warehouses without dual writes.
Write-Ahead Log (WAL, redo log)
Append the change to a log before touching the data — the trick behind durability in nearly every database.
LSM Tree (log-structured merge tree)
Write fast by appending; read by merging sorted layers — the engine inside Cassandra, RocksDB, LevelDB.
B-Tree (B+ tree)
The wide, shallow sorted tree behind nearly every relational index — few disk reads to any row.
Gossip Protocol (epidemic protocol)
Nodes trade state with random peers; information spreads like rumor — no coordinator, log-time propagation.
Vector Clock (logical clock, Lamport clock)
Counters that capture causality — decide whether two events are ordered or truly concurrent.
Circuit Breaker
Stop calling a failing dependency; fail fast, probe for recovery — the pattern that prevents cascade failures.
PII Redaction
Stripping or masking personally identifiable information from data before it reaches a model, a log, or a third party.
Differential Privacy
A formal, mathematical guarantee that no individual record in a dataset can be detected from a system’s outputs.
Zero-Trust Architecture
Never implicitly trust a request because of where it came from — verify identity and authorization on every single call.
Principle of Least Privilege
Grant a component only the minimum access it actually needs to do its job — nothing more, so a compromise stays small.
RBAC (Role-Based Access Control) (role-based access control)
Granting permissions to roles, not individual users — a user gets access by being assigned a role, not by direct configuration.
Secrets Management
Storing API keys, credentials, and certificates in a dedicated vault, outside source code, with rotation and audited access.
Service Mesh
An infrastructure layer of sidecar proxies that handles service-to-service traffic — retries, mTLS, observability — without touching application code.
Sidecar Pattern
Running a helper process alongside your main application container to handle a cross-cutting concern, independent of your app’s own code.
API Gateway
The single entry point that routes, authenticates, and rate-limits every request before it reaches a backend service.
Service Discovery
How a service finds the current network address of another service, when instances are constantly starting, stopping, and moving.
Health Check
A lightweight endpoint or probe a system polls to decide whether an instance is ready to receive traffic.
Canary Release
Shipping a change to a small slice of production traffic first, watching for regressions, before rolling it out to everyone.
Blue-Green Deployment
Running two identical production environments and switching traffic between them atomically, for a release with zero downtime.
Chaos Engineering
Deliberately injecting failures into a production-like system to verify it actually survives them, instead of hoping it would.
Distributed Tracing
Following one request’s path across every service it touches, via a shared trace ID, to see exactly where time and errors happen.
Thundering Herd
Many clients or workers waking up and retrying at the exact same moment, overwhelming the resource they’re all trying to reach.
Load Shedding
Deliberately dropping or rejecting some requests under overload, to protect a system’s ability to serve the rest.
Load Balancer
Distributing incoming requests across multiple backend instances, so no single one is overwhelmed and a failed one can be routed around.
x402 (HTTP 402, x402 protocol)
A payment protocol that revives HTTP’s 402 “Payment Required” status so agents and APIs can settle micropayments inline over the web.
AP2 (Agent Payments Protocol) (AP2, Agent Payments Protocol)
An open protocol for letting AI agents make payments on a user’s behalf, backed by verifiable mandates.
Mandate
In agent payments, a signed authorization proving a user let an agent transact within specific limits.
Agentic Browser (AI browser, agent browser)
A browser driven by an AI agent that navigates and acts on web pages on the user’s behalf.
ACID
The four guarantees — Atomicity, Consistency, Isolation, Durability — that make database transactions reliable.
Materialized View
A precomputed, stored query result you read like a table — fast reads, at the cost of freshness.
CDN (content delivery network)
A network of edge servers that cache content near users, cutting latency and origin load.
Read Replica
A read-only copy of a database that absorbs read traffic, scaling reads and easing load on the primary.
Message Queue
A buffer that lets services hand off work asynchronously — the producer drops a message, the consumer picks it up later.
Dead-Letter Queue (DLQ)
A side queue for messages that repeatedly fail processing, so one poison message cannot block the pipeline.
Connection Pool
A reusable set of open database connections, so requests skip the expensive handshake each time.
Denormalization
Deliberately duplicating data across tables to make reads faster, trading write complexity for read speed.
Database Index
A lookup structure that lets the database find rows without scanning the whole table.
Exactly-Once (exactly-once delivery)
The hard delivery guarantee that a message is processed once and only once — usually approximated with idempotency.
Replication Lag
The delay between a write hitting the primary and showing up on a replica.
SLO / SLA / SLI (service level objective, error budget)
The reliability targets: an SLI measures it, an SLO is your goal for it, an SLA is the contract with penalties.
Cache-Aside (lazy loading)
The default caching pattern: check the cache, and on a miss load from the database and populate the cache yourself.
Write-Through Cache
Write to the cache and the database together on every write, so the cache is always fresh — at a write-latency cost.
N+1 Query Problem
A performance bug where fetching a list then looping to fetch each item’s details fires 1 + N queries instead of one.
At-Least-Once (at-least-once delivery)
A delivery guarantee that a message is never lost but may be delivered more than once — so consumers must be idempotent.
Partition Key (shard key)
The field a system uses to decide which shard or partition a row lives on — choose it wrong and you get hotspots.
Foreign Key
A column that references another table’s primary key, letting the database enforce that relationships stay valid.
Webhook
A reverse API: instead of you polling for events, the other service calls YOUR URL when something happens.
OAuth (OAuth 2.0)
The standard for letting an app act on your behalf on another service without ever seeing your password.
JWT (JSON Web Token)
A signed, self-contained token carrying claims that a server can verify without a database lookup.
CORS (cross-origin resource sharing)
The browser rule that a page cannot call a different origin’s API unless that API opts in with the right headers.
WebSocket
A persistent two-way connection over one TCP socket, for real-time push both directions — unlike request/response HTTP.
GraphQL
A query language for APIs where the client asks for exactly the fields it needs in one request.
gRPC
A fast, contract-first RPC framework using Protocol Buffers over HTTP/2 — common for service-to-service calls.
Feature Flag (feature toggle)
A runtime switch that turns features on or off without a deploy — for gradual rollout, testing, and instant rollback.
Observability
Understanding a system’s internal state from its outputs — logs, metrics, and traces — especially for problems you did not predict.
Server-Sent Events (SSE)
A simple one-way stream: the server pushes a sequence of events to the browser over one long-lived HTTP connection.
Cold Start
The extra latency when a serverless function or scaled-to-zero service handles its first request and must spin up.
Autoscaling
Automatically adding or removing server instances based on load, so capacity follows demand.
mTLS (mutual TLS)
Mutual TLS: both client and server present certificates, so each cryptographically proves its identity to the other.
Exponential Backoff (backoff and jitter)
Retry failed operations with exponentially increasing waits (plus jitter), so a struggling service is not hammered.
Graceful Shutdown
Draining in-flight work and closing connections cleanly before a process exits, so a deploy drops no requests.
Strong Consistency
Every read reflects the most recent write — the opposite of eventual consistency, at a latency and availability cost.
Horizontal Scaling (scale out, vertical scaling)
Adding more machines to share load (scale out), versus making one machine bigger (scale up).
Statelessness (stateless service)
A service that keeps no per-client state between requests, so any instance can handle any request — the key to easy scaling.
Sticky Session (session affinity)
Load-balancer routing that pins a user to the same backend instance — a workaround for stateful servers.
Throttling
Deliberately slowing or capping a client’s request rate to protect a service — the enforcement side of rate limiting.
TLS (SSL, HTTPS)
The protocol that encrypts data in transit and authenticates the server — the S in HTTPS.
Split-Brain
When a network partition makes two halves of a cluster each think they are in charge — risking divergent, conflicting writes.
Fencing Token
A monotonically increasing number handed out with a lock, so a stale lock-holder can be rejected.
Lease
A lock with an expiry: a node holds a resource only for a bounded time, so a crashed holder cannot block others forever.
Heartbeat
A periodic “I am alive” signal between nodes, used to detect failures — miss enough and you are presumed dead.
Pagination (cursor pagination, keyset pagination)
Returning a big result set in bounded pages instead of all at once — cursor-based beats offset at scale.
API Versioning
Evolving an API without breaking existing clients — via version in the path, header, or backward-compatible changes.
MVCC (multi-version concurrency control)
Multi-Version Concurrency Control: readers see a consistent snapshot while writers create new versions — so reads do not block writes.
Deadlock
Two transactions each hold a lock the other needs, so both wait forever — the database must detect and kill one.
Optimistic Locking (optimistic concurrency control)
Assume conflicts are rare: do not lock, but check on write that nobody changed the row since you read it.
Pessimistic Locking
Assume conflicts are likely: lock the row up front so no one else can touch it until you are done.
Snapshot Isolation
Each transaction reads from a frozen snapshot of the database, so it sees a consistent world regardless of concurrent writes.
Compaction
Merging and rewriting storage files in the background to reclaim space and keep reads fast — the housekeeping of LSM stores.
Tombstone
A marker that records a deletion in a log-structured store, since you cannot erase in place — later removed by compaction.
SSTable (sorted string table)
A Sorted String Table: an immutable, sorted-on-disk file of key-value pairs — the on-disk unit of LSM-tree stores.
Memtable
The in-memory, sorted write buffer of an LSM store — flushed to an immutable SSTable when it fills.
Container (Docker container)
A lightweight, isolated package of an app plus its dependencies that runs the same everywhere — sharing the host OS kernel.
Kubernetes (K8s)
The standard orchestrator that schedules, scales, heals, and networks containers across a cluster of machines.
Infrastructure as Code (IaC, Terraform)
Defining servers, networks, and services in version-controlled code instead of clicking through a console — reproducible infra.
GitOps
Operating infrastructure by making Git the single source of truth: the cluster continuously syncs itself to what is in the repo.
Immutable Infrastructure
Never patch a running server — replace it with a freshly built one. No config drift, easy rollback.
Edge Computing
Running compute close to users (at CDN edge locations) instead of a central region — for low latency and less origin load.
Serialization (deserialization, marshalling)
Turning an in-memory object into bytes to store or send it — and deserialization turns it back.
Protocol Buffers (protobuf)
A compact, schema-first binary serialization format from Google — the payload behind gRPC.
Hedged Request
Send a duplicate request to a second replica if the first is slow, and take whichever returns first — to cut tail latency.
Request Coalescing (single-flight, request collapsing)
Collapse many identical in-flight requests into one — so a cache miss on a hot key hits the origin once, not thousands of times.
Disaster Recovery (DR)
The plan and infrastructure to restore service after a major outage — a region failure, data loss, or catastrophe.
RPO and RTO (recovery point objective, recovery time objective)
The two DR targets: RPO = how much data you can lose; RTO = how long recovery may take.
Failover
Automatically switching to a standby replica when the primary fails, so service continues with minimal interruption.
Geo-Replication
Keeping copies of data in multiple geographic regions — for low-latency local reads and survival of a regional outage.
Multi-Region (active-active, active-passive)
Running an application across multiple cloud regions for lower latency and resilience — at a big jump in complexity.
Bulkhead
Isolating resources into pools so a failure in one part cannot sink the whole ship — named after a ship’s compartments.
Graceful Degradation
Keeping the core working when a dependency fails by dropping non-essential features, instead of failing entirely.
Blast Radius
How much of a system a single failure or change can damage — you design to keep it small.
Serializable Isolation
The strictest isolation level: transactions behave as if run one at a time, ruling out all concurrency anomalies.
Write Skew
A subtle anomaly where two transactions read the same data, each writes something valid alone, but together break a rule.
Anycast
One IP address announced from many locations, so the network routes each user to the nearest instance automatically.
Timeout
A cap on how long to wait for an operation before giving up — the most basic and most-forgotten resilience control.
REST (RESTful API)
The dominant style for web APIs: resources at URLs, manipulated with standard HTTP methods, stateless requests.
HTTP Status Codes
The three-digit codes an HTTP response carries — 2xx success, 3xx redirect, 4xx client error, 5xx server error.
SQL Injection (SQLi)
A classic attack: unescaped user input is treated as SQL code, letting an attacker read or destroy your database.
XSS (cross-site scripting)
Cross-Site Scripting: an attacker gets malicious JavaScript to run in another user’s browser via unescaped output.
CSRF (cross-site request forgery)
Cross-Site Request Forgery: tricking a logged-in user’s browser into making an unwanted state-changing request.
Cache-Control
The HTTP header that tells browsers and CDNs how (and how long) they may cache a response.
Primary Key
The column(s) that uniquely identify each row in a table — the anchor foreign keys point to.
Database Normalization (normal forms, 3NF)
Structuring a database to eliminate redundancy — each fact stored once — trading some read joins for write integrity.
Session (server-side session)
Server-side state that remembers a logged-in user across requests, keyed by an ID stored in a cookie.
Cookie (HTTP cookie)
A small piece of data the server stores in the browser, sent back on every request — how the web remembers you.
ETag (entity tag)
A fingerprint of a resource’s content that lets the browser ask “changed since this version?” and skip re-downloading.
API Key
A secret token identifying and authorizing an application (not a user) when it calls an API.
Model Registry
A versioned catalog of trained models — their versions, metrics, and lineage — the source of truth for what is deployed.
Model Serving
The infrastructure that runs a trained model behind an API for real-time or batch predictions.
ONNX (open neural network exchange)
An open format for exchanging trained models between frameworks, so a model trained in one tool runs in another.
Pub/Sub (publish-subscribe)
A messaging pattern where publishers broadcast events to topics and any number of subscribers receive them — sender and receiver never know each other.
Event-Driven Architecture (EDA)
An architecture where components communicate by emitting and reacting to events, rather than calling each other directly.
Event Sourcing
Storing state as an append-only log of events, and deriving current state by replaying them — full history, perfect audit.
CQRS (command query responsibility segregation)
Separate the write model from the read model, optimizing each independently.
Reverse Proxy
A server in front of your backends that forwards client requests to them — the entry point for TLS, routing, caching, and load balancing.
Forward Proxy
A proxy in front of clients that forwards their outbound requests — for filtering, caching, or hiding the client.
Serverless
Running code without managing servers — the cloud provisions, scales, and bills per-execution, scaling to zero when idle.
FaaS (function as a service)
Function as a Service: deploy individual functions that the platform runs and scales per-event — the core of serverless.
IaaS / PaaS / SaaS (cloud service models)
The cloud service spectrum: rent raw machines (IaaS), a managed platform (PaaS), or finished software (SaaS) — each hands more to the provider.
Virtualization
Running multiple isolated virtual machines on one physical server by abstracting the hardware — the foundation of cloud computing.
Virtual Machine (VM)
A software emulation of a full computer — its own OS and virtual hardware — running isolated on shared physical hardware.
Hypervisor (virtual machine monitor)
The software layer that creates and runs virtual machines, sharing one physical machine’s hardware among them.
Monolith (monolithic architecture)
An application built and deployed as a single unit — simple to start, harder to scale a large team on.
Microservices
Splitting an app into many small, independently-deployable services — team autonomy and independent scaling, at the cost of distributed complexity.
Domain-Driven Design (DDD)
Designing software around the business domain and its language, keeping the model and the code aligned.
Bounded Context
A boundary within which a domain model and its terms have one consistent meaning — the seam for splitting systems and teams.
SOAP
An older, XML-based, contract-heavy protocol for web services — verbose but strictly standardized, still seen in enterprise/finance.
Twelve-Factor App
A set of 12 principles for building cloud-native apps that are portable, scalable, and disposable.
TCP (Transmission Control Protocol)
The reliable, ordered, connection-based transport protocol most of the web runs on.
UDP (User Datagram Protocol)
A lightweight, connectionless transport protocol that sends packets fast with no delivery guarantees.
DNS (Domain Name System)
The internet’s phone book — it translates human domain names into machine IP addresses.
HTTP/2
A major HTTP upgrade that multiplexes many requests over one connection to cut latency.
HTTP/3 (QUIC)
The newest HTTP version, built on UDP/QUIC to eliminate TCP’s head-of-line blocking.
RPC (Remote Procedure Call)
A style where calling a remote service looks like calling a local function.
Message Broker
Middleware that receives, buffers, and routes messages between producers and consumers.
Forward Deployed Engineer (FDE)
An engineer embedded with a specific customer who owns the full arc of a deployment — discovery to production, inside the customer’s environment.
FDSE (Forward Deployed Software Engineer)
Palantir’s title for the engineering half of forward-deployed work — the person who writes the production code at the customer.
Deployment Strategist
The non-engineering half of forward-deployed work: owns the problem framing, the stakeholders and the direction of a deployment.
Decomposition Round
The signature FDE interview round: an open, non-coding problem where you are scored on the clarifying questions you ask before proposing anything.
Learning Round
An interview round where you absorb unfamiliar documented material live and apply it — testing learning speed, not recall.
ACV (annual contract value)
The annualised revenue of a customer contract — the number that determines how much deployment effort a vendor can afford to spend.
SOW (statement of work)
The contract document defining scope, deliverables and acceptance criteria for an engagement — including, often, your eval thresholds.
Champion
The person inside the customer who wants your project to succeed and spends their own credibility defending it.
Economic Buyer
The person who controls the budget for your project — often not the person you talk to most.
Blocker (stakeholder)
Someone whose interests your project threatens, and whose objections are therefore an incentive problem rather than a comprehension gap.
Air-Gapped Deployment
A deployment in an environment with no network path to the internet — updates and model weights arrive physically or through a controlled transfer.
FedRAMP (IL4, IL5, impact level)
The US government programme that authorises cloud services for federal use; impact levels (IL4/IL5) grade how sensitive the data may be.
VPC Deployment
Running your software inside the customer’s own cloud account and network, rather than in your SaaS.
Deflection Rate
The share of cases resolved without a human touching them — the metric that proves capacity was actually created.
Handoff Runbook
Symptom-first operating documentation that lets the customer’s team run the system without the engineer who built it.
Generalisation Memo
The write-up of what an engagement produced that should become a product capability — the artefact that separates an FDE from a contractor.
Services Trap
When a product company’s deployment organisation drifts into consultancy economics: utilisation targets, bespoke builds, engagements that never end.