The words this field uses, and what they actually mean.
- Terms defined
- 43
- Clusters
- 6
- With a confusion resolved
- 43
- That mention the product in the definition
- 0
Every term, alphabetically
If you arrived knowing the word you wanted, it is here. If you did not, the clustered view below is the better way in.
The category itself
What the field is called, what its members have in common, and the one property that separates them from each other.
Agent action assurance
action assurance · AI action assurance · agent effect assurance · authority and effect assurance
Agent action assurance is the practice of proving that the exact authority delegated for one agent action was the authority actually used, and that the action produced the business effect it reported producing. Its subject is the consequential, externally observable action — a refund, a deployment, an outbound email, a ticket transition, a row written to a system of record — where a provider returning a success status is evidence that a request was transported, and not evidence that anything happened.
Not the same as Observability and tracing, Identity and access management, Guardrails
AI agent governance
agent governance · agentic AI governance · AI agent governance framework · autonomous agent governance
AI agent governance is the practice of deciding, outside the agent and before it acts, whether the authority it is about to exercise is authority somebody actually delegated to it — and of recording afterwards what it did with that authority in a form that survives the people who could edit it. What separates it from model safety, from observability and from identity management is where the decision sits: in the path the action must travel, where it can refuse, rather than in a policy document, a dashboard, or a nightly reconciliation.
Not the same as AI governance, Model safety and alignment, LLM observability
AI control plane
agent control plane · AI agent control plane · agentic control plane · AI governance platform
An AI control plane is the layer that holds the authoritative configuration for an organisation’s AI agents — which agents exist, who owns each one, what each may call, what each may spend, and what happens when a rule is broken — and that makes the configuration binding by sitting in, or being consulted by, the path those agents’ requests take. The name is borrowed from networking, where the control plane decides what should happen and the data plane carries the traffic that does it; the distinction matters here because a product can implement either half and still be sold under the same label.
Not the same as LLM gateway, Agent registry or AI inventory, AI control tower
AI gateway
AI firewall · agent gateway · AI runtime security gateway · MCP gateway · AI security gateway
An AI gateway is a policy-bearing proxy for AI traffic: it terminates the calls an application or agent makes to models, tool servers and other agents, and applies authorisation, inspection, quota and logging rules to them before they reach the upstream. The term is used for at least three different products — an API gateway extended to model traffic, a security-inspection layer sold as an AI firewall, and a cloud runtime that bundles gateway, identity and observability — so the label describes a position in the architecture rather than a set of guarantees.
Not the same as LLM gateway, AI firewall, MCP gateway
Fail-closed
fail closed · fail secure · deny on failure · fail-closed enforcement
Fail-closed describes a control that denies the action it governs whenever it cannot complete its own check — because a dependency is unavailable, a required piece of evidence is missing or stale, a value cannot be evaluated, or the control itself is down. The opposite arrangement, fail-open, permits the action in those same circumstances, which turns every outage in the control into a temporary and silent absence of the control.
Not the same as Fail-open, Fail-safe, Graceful degradation
Inline enforcement
in-path enforcement · inline policy enforcement · runtime enforcement · in-line governance
Inline enforcement means the decision to allow, refuse, alter or hold an action is taken in the path the action must travel, before it takes effect, by a component the acting system cannot bypass or overrule. The alternatives — a rule the agent is asked to follow, a check inside the agent’s own framework, an alert raised afterwards — are advisory rather than enforcing, because in each case the party being governed is also the party enforcing.
Not the same as Detection and monitoring, Guardrails, Shadow mode
LLM gateway
AI proxy · LLM proxy · model gateway · LLM router · AI model gateway
An LLM gateway is a proxy that sits between applications and one or more model providers, presenting a single endpoint and a single credential while handling provider routing, failover, rate limiting, caching, key custody and usage accounting on their behalf. Applications adopt one by changing a base URL rather than by rewriting code, which is why it is usually the first piece of shared AI infrastructure an organisation deploys.
Not the same as AI gateway, API gateway, AI control plane
Identity, permissions and delegation
What it means for an agent to be allowed to do something, and why the answer stops being obvious the moment one agent can ask another.
Action-level permissions
fine-grained agent permissions · tool-level permissions · action-level RBAC · granular agent authorisation
Action-level permissions authorise a specific operation on a specific named resource — one tool on one server, or one model — rather than granting access to a system as a whole. The unit is what matters: an agent granted a system inherits every operation that system exposes, including the ones next to the operation it actually needed.
Not the same as OAuth scopes, Roles, Policy
Agent identity
AI agent identity · non-human identity · machine identity for AI agents
Agent identity is what establishes which AI agent is making a given call: a credential the agent presents, and a registered record that credential resolves to, carrying the agent’s owner, declared purpose, permissions and lifecycle status. It is a different thing from the identity of the human the agent is acting for and from the identity of the workload the agent runs inside, and treating any two of the three as interchangeable is the most common source of authorisation error in agent systems.
Not the same as Workload identity, Service account, On-behalf-of
Agent recertification
agent access review · agent attestation · periodic agent review
Agent recertification is a periodic attestation by a named person that a specific AI agent’s configuration — its owner, declared purpose, permissions, limits and lifecycle status — is still appropriate, recorded against the exact configuration that was reviewed. Its value depends entirely on that binding: a review that records which roles an agent held, rather than what those roles granted, certifies nothing the moment somebody edits the role.
Not the same as User access review, Certification, Audit log
Agent registry
AI agent inventory · AI system inventory · agent catalogue
An agent registry is the system of record for the AI agents an organisation runs: one record per agent carrying its identity, a named human owner, a declared purpose, its permissions, its lifecycle status and its operating limits. It becomes a control rather than a document only when it is the same record the enforcement point resolves on every call, because an inventory maintained alongside the runtime is updated by whoever remembers while the runtime is updated by whoever ships.
Not the same as Model registry, CMDB or service catalogue, Observability inventory
Delegation chain
agent delegation chain · agent-to-agent delegation · A2A delegation · delegated authority chain
A delegation chain is the ordered list of agent identities a request has passed through when one AI agent asks another to act for it. The rule that makes it a security control rather than a breadcrumb trail is that effective permissions are the intersection of every link and never the union: the request proceeds only if every agent in the chain would have been permitted to perform that exact action alone, so passing work along a chain can only narrow authority.
Not the same as Trace or span tree, Token exchange with an actor claim, Impersonation, Role assumption
Deny by default
default deny · deny-by-default · implicit deny
Deny by default is an authorisation model in which an action is refused unless some permission explicitly allows it, and in which an explicit deny overrides every allow. An agent holding no roles, a role with an empty permission list, and a resource no permission names all produce the same answer — refused — so the failure mode of a misconfiguration is a blocked request somebody notices rather than a standing grant nobody does.
Not the same as Least privilege, Allowlist and blocklist, Zero trust
On-behalf-of
OBO · acting on behalf of a user · user-delegated agent authority
On-behalf-of is the assertion, carried on a request, that an AI agent is acting for a named human rather than on its own account. Used for attribution it makes the request traceable to a person; used for authorisation it should bound the agent to the intersection of what the agent may do and what that person may do, so that naming a human can only narrow the agent’s authority and never extend it.
Not the same as Impersonation, The OAuth on-behalf-of flow, Delegation chain
Workload identity
SPIFFE identity · workload attestation · federated workload identity · SVID
Workload identity is an identity for a running process — a container, pod, virtual machine or function — established by attesting the environment it is running in rather than by a secret it stores, and normally exchanged at runtime for a short-lived credential. It answers what is running and where, which is a different question from which agent is calling and which person the call is for.
Not the same as Agent identity, Service account key, mTLS
Threats and defences
How agents actually get hijacked, and what the available defences are worth. Every entry here states its own false-negative rate honestly.
Data exfiltration
AI data exfiltration · LLM data leakage · markdown image exfiltration · OWASP LLM02
Data exfiltration in an AI system is the movement of sensitive data out of the boundary that held it by way of the model’s own context — carried in a prompt sent to a provider, in a link or image the receiving client renders automatically, in the arguments of a tool call, or in a response the model was persuaded to produce. Its defining property is that the channel is usually legitimate: no malware runs and no unusual connection is made, because the agent is doing exactly what it was built to do and the data is riding along.
Not the same as Data leakage, Prompt injection, Training-data extraction
Indirect prompt injection
second-order prompt injection · cross-domain prompt injection · XPIA · RAG poisoning · tool result injection
Indirect prompt injection is prompt injection delivered through content an AI system retrieves rather than through anything its user typed — a web page, a document, an email, a support ticket, a database row, a code comment or a tool’s response — so the attacker never needs an account, a session or any access to the application itself, only write access to something the agent will read. It is the form of injection that hijacks autonomous agents, because the attacker’s text arrives inside a request that is otherwise entirely legitimate.
Not the same as Prompt injection, Data poisoning, Retrieval-augmented generation poisoning, Confused deputy
PII redaction
PII masking · prompt redaction · data masking for LLMs · PII scrubbing
PII redaction is the removal or replacement of personal and sensitive data in a payload before it crosses a boundary — in an AI system, typically before a prompt reaches a model provider, before a response reaches a user, and before either is written to a log or a trace. It comes in two forms with different consequences: masking, which destroys the value irreversibly, and tokenising, which replaces it with a stable placeholder so the text still makes sense to whatever reads it next.
Not the same as Anonymisation, Data loss prevention, Tokenisation in payments
Prompt injection
prompt injection attack · LLM prompt injection · OWASP LLM01
Prompt injection is an attack in which text an attacker controls is read by a language model as instruction rather than as data, so the model follows the attacker’s directions instead of the ones its operator gave it. It works because a model receives its system prompt, the user’s message and any retrieved content as one undifferentiated token stream, in which the separation between instruction and data is a convention the model has been trained to respect rather than a boundary it is unable to cross.
Not the same as Jailbreaking, Indirect prompt injection, Data poisoning
Shadow AI
ungoverned AI · unsanctioned AI use · BYOAI · shadow LLM usage
Shadow AI is any use of AI models, assistants or agents inside an organisation that does not pass through the controls the organisation built for them — a service calling a provider API directly with a key issued from the vendor console, a coding assistant left pointed at its default endpoint, an agent nobody registered, or a model whose usage no internal system meters. It is a coverage problem before it is a security problem: it is what makes the denominator of every governance claim unknown.
Not the same as Shadow IT, Data leakage to AI vendors, Model inventory
Tool poisoning
MCP tool poisoning · rug pull attack · tool description injection · line jumping · descriptor drift
Tool poisoning is an attack that places attacker-controlled instructions in a tool’s own metadata — its name, its description or its input schema — which a model reads when deciding what to call and how. The instruction therefore reaches the model before any tool is invoked and without any tool ever returning a result, and in its most dangerous form the metadata is rewritten after a human approved it, so the text that was reviewed is not the text the model now reads.
Not the same as Indirect prompt injection, Supply-chain attack on a dependency, Excessive agency
Unicode tag smuggling
ASCII smuggling · invisible prompt injection · Unicode tags block attack · hidden text prompt injection
Unicode tag smuggling is the encoding of text in the Unicode Tags block, U+E0000 to U+E007F, a range that mirrors printable ASCII one-for-one but renders as nothing at all — so a paragraph of instructions can sit inside an ordinary-looking document, message or filename where no human reader sees it and many language models still read it. It is the sharpest member of a family of invisible-character attacks collectively called ASCII smuggling.
Not the same as Zero-width character smuggling, Homoglyph attacks, Steganography, Trojan Source
Evidence and audit
What a record of an agent's actions proves, and the several places where a word in common use claims more than the mechanism delivers.
Attributable read
audited read · read auditing · evidence access logging
An attributable read is a read of a sensitive record that is itself recorded as an event naming the identity that performed it, the query or scope it used, and how much data came back. It applies to looking the accounting normally reserved for changing, on the basis that access to a record of people’s activity is an exercise of authority rather than a passive act.
Not the same as Access log, Access control, Non-repudiation
Audit chain
hash-chained audit log · audit log chain · chained audit trail
An audit chain is a record of administrative actions in which every entry carries a cryptographic digest computed over its own content and over the digest of the entry before it, so the entries form one linked sequence rather than a set of independent rows. Editing, reordering or removing an entry breaks that sequence at an identifiable point, which is what lets the integrity of the record be demonstrated rather than asserted.
Not the same as Append-only log, Blockchain, Trace or request log
Digest-sealed export
sealed export · digest-sealed evidence bundle · sealed not signed
A digest-sealed export is an evidence bundle issued together with a cryptographic digest computed over the canonical serialisation of its contents, so that a recipient holding that digest from another source can recompute it and confirm the file has not changed since it was issued. The seal establishes integrity relative to a value the recipient already holds; it establishes nothing about origin, because anyone able to rewrite the bundle can recompute the digest.
Not the same as Signed export, Checksum, Notarised or timestamped bundle
Evidence anchoring
audit anchoring · off-box anchoring · audit log anchoring · signed chain head
Evidence anchoring is the practice of periodically signing a short statement about the state of a record — typically the sequence number and digest of its most recent entry, linked to the previous such statement — and publishing that statement somewhere the keeper of the record cannot reach. The claim it supports is narrow and checkable: any copy of an anchor held elsewhere contradicts any rewrite of the record made after that copy was taken.
Not the same as Trusted timestamping (RFC 3161), Digest-sealed export, WORM or object-lock export
Flight recorder
agent flight recorder · black box recorder · agent trace record
A flight recorder, in an agent system, is the durable record of every governed request — what was asked, which checks ran, what was decided, what was called and what it cost — written by the component that enforces the decision rather than by the agent making the request. That authorship is the defining property: a record produced by the process under investigation describes what that process believes it did, while a record produced by the enforcement point survives that process misbehaving.
Not the same as Observability tracing, Audit chain, Transcript
Hash chaining
hash chain · hash-chained log · chained digests · hash linking
Hash chaining is the technique of computing each record’s cryptographic digest over both its own content and the digest of the record before it, so that a change to any record changes its digest and invalidates every digest after it. It makes alteration detectable by anyone who recomputes the digests; it does not prevent alteration, and it constrains only an attacker who cannot recompute them.
Not the same as Merkle tree, Digital signature, Checksum
Tamper-evident
tamper evident · tamper-proof · tamperproof · tamper-resistant
Tamper-evident describes a record whose alteration can be detected afterwards by whoever checks it. Tamper-proof would describe a record that cannot be altered at all — a property no scheme delivers over storage the alterer administers — so a claim of tamper-evidence means something only when it names the attacker it holds against and the check that would reveal the change.
Not the same as Tamper-proof, Tamper-resistant, Immutable, Non-repudiation
Cost, routing and limits
Where the money goes, why providers disagree about how to count it, and what a spend control has to do to be a control rather than an alert.
Circuit breaker
provider circuit breaker · breaker · failure breaker
A circuit breaker is a state machine in front of a remote dependency that stops sending it traffic once a threshold of consecutive failures is reached, waits a fixed cooldown, then allows one probe request to decide whether to resume. Its purpose is to fail immediately against a dependency already known to be down, instead of paying a full timeout on every request until it recovers.
Not the same as Rate limiting, Kill switch, Retry with backoff
Kill switch
big red button · emergency stop · agent kill switch
A kill switch is an operator-engaged control that refuses all further requests from a named agent, a team, or an entire estate, checked before every other governance decision and released only by a person. It is the control that has to work when everything more precise has failed, which is why it is scoped by identity rather than by rule, and why engaging it records who did it and what reason they gave.
Not the same as Circuit breaker, Agent suspension, A rate limit of zero
Model routing
LLM routing · provider routing · model gateway routing
Model routing is the resolution, at the moment of the call, of a requested model name to a concrete provider and model, together with the ordered list of alternatives that may serve it if the first one fails. It lets a client that only knows one model name be pointed at a different vendor, region or price without the client changing, and it is where a multi-provider estate’s data-handling and cost constraints are actually applied.
Not the same as Load balancing, Tier routing
Prompt caching
prompt cache · cached input tokens · context caching · prefix caching
Prompt caching is a provider feature that stores the processed form of a repeated prompt prefix so that later requests beginning with the same bytes are charged at a reduced input rate instead of the full one. It changes the billing shape of a call rather than its content: the prefix still counts as input tokens and still occupies the context window, but the tokens move into a cheap cache-read bucket and, on the call that populates the cache, into a cache-write bucket that on some vendors costs more than uncached input.
Not the same as Response caching, Context window
Tier routing
model tiering · dynamic model selection · model downgrade · cost-based routing
Tier routing is the substitution of a cheaper model for the one a caller named, decided before the call by classifying what the request is actually asking the model to do. It is a cost control rather than a quality feature, so the two properties that make it defensible are that it never routes above the tier that was requested, and that it records why it moved.
Not the same as Model routing, Model cascading
Token cost accounting
LLM cost accounting · token metering · AI spend attribution
Token cost accounting is the practice of turning a provider’s reported token usage into a defensible monetary figure for each model call: resolving the price row for the model and provider that actually served the request, splitting the reported usage into token classes that do not overlap, and applying the right rate to each. It is harder than multiplying tokens by a rate because providers disagree about whether cached prompt tokens are reported inside or outside the prompt total, and because the model that gets billed is not always the model that was asked for.
Not the same as Token counting, Blended rate
Typed failover
typed fallback · classified failover · provider failover
Typed failover is a fallback policy that decides whether to try the next provider from the class of the failure rather than from a retry count: transient classes — a timeout, a rate limit, a server error — move to the next candidate, while failures that are properties of the request or the credential stop where they are. It exists because some failures are identical at every vendor, and because one of them is a refusal that a second attempt would convert into an apparent success.
Not the same as Retry with backoff, Circuit breaker
Protocols and standards
The substrate everything here conforms to, and the four regulatory instruments that decide what evidence an operator has to be able to produce.
A2A protocol
Agent2Agent · Agent-to-Agent protocol · A2A · agent card
The Agent2Agent (A2A) protocol is an open specification for one AI agent to hand work to another across vendor and organisational boundaries without either side exposing its internal tools, memory or reasoning. Each agent publishes a JSON Agent Card describing what it can do and where to reach it, and a caller sends a Message that opens a Task with a defined lifecycle, carried over JSON-RPC, gRPC or HTTP+JSON.
Not the same as MCP, A multi-agent framework (LangGraph, CrewAI, AutoGen), An Agent Card and a service registry entry
EU AI Act
Regulation (EU) 2024/1689 · Artificial Intelligence Act · AI Act · EU AI Act deployer obligations
The EU AI Act is Regulation (EU) 2024/1689, which regulates AI systems placed on the market or used in the European Union in proportion to the risk they present, and which places materially different duties on the organisation that builds a system (the provider) and the organisation that uses it under its own authority (the deployer). It entered into force on 1 August 2024 and applies in stages: the prohibited practices from 2 February 2025, the general-purpose AI model obligations from 2 August 2025, and most remaining obligations, including those on high-risk systems listed in Annex III, from 2 August 2026.
Not the same as GDPR, Provider and deployer, FRIA and DPIA
ISO/IEC 42001
ISO 42001 · AI management system · AIMS · ISO/IEC 42001:2023
ISO/IEC 42001:2023 is the international standard specifying requirements for an artificial intelligence management system — the governance structure, processes and records an organisation puts in place to develop or use AI responsibly. It is the first AI standard an organisation can be certified against by an accredited certification body, and, like ISO/IEC 27001, it certifies a management system within a declared scope rather than any product, model or software.
Not the same as ISO/IEC 27001, NIST AI RMF, ISO/IEC 23894
Model Context Protocol (MCP)
MCP · MCP protocol · MCP server · Anthropic MCP
The Model Context Protocol (MCP) is an open specification that lets an AI application connect to external tools, data and prompt templates through a uniform JSON-RPC 2.0 interface, so a capability written once can be called by any client that speaks the protocol. It defines how a client discovers what a server offers, how it invokes it, and how the two negotiate a dated protocol revision — and it deliberately says nothing about which caller is allowed to invoke which capability, which is left to the deployment.
Not the same as Function calling / tool use, A2A, OpenAPI or a plugin manifest
NIST AI RMF
NIST AI Risk Management Framework · AI RMF 1.0 · NIST AI 100-1 · GOVERN MAP MEASURE MANAGE
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance published by the United States National Institute of Standards and Technology in January 2023 for identifying, measuring and managing the risks of AI systems across their life cycle. Its core organises that work into four functions — GOVERN, MAP, MEASURE and MANAGE — and, unlike a management-system standard, it carries no conformity or certification scheme, so an organisation adopts it and evidences its own adoption rather than being certified against it.
Not the same as ISO/IEC 42001, NIST Cybersecurity Framework (CSF 2.0), NIST SP 800-53
OTLP
OpenTelemetry Protocol · OTLP/HTTP · OTLP over gRPC · OTel protocol
OTLP, the OpenTelemetry Protocol, is the vendor-neutral wire format OpenTelemetry uses to carry traces, metrics and logs from an instrumented process to a collector or a backend. Its payloads are Protocol Buffers messages sent over gRPC or HTTP — as binary protobuf or its canonical JSON mapping — and it is a one-way export: the receiver acknowledges what it accepted and names what it rejected, and never sends telemetry back.
Not the same as OpenTelemetry, An audit record, The OpenTelemetry Collector
OWASP Top 10 for LLM Applications
OWASP LLM Top 10 · OWASP Top 10 for Large Language Model Applications · LLM01 prompt injection · OWASP GenAI Security Project
The OWASP Top 10 for Large Language Model Applications is a community-maintained list of the ten most significant security risks in applications built on large language models, published by the OWASP GenAI Security Project. It is an awareness and prioritisation document rather than a standard: nothing certifies against it, and its ranking comes from consensus among contributing practitioners rather than from measured incident data.
Not the same as OWASP Top 10 (web applications), MITRE ATLAS, The OWASP Agentic Top 10
If a term here is missing, say which.
The glossary is written to be the best explanation of each of these that exists, and it is not finished. If something in this field confused you and is not defined here, that is a gap worth hearing about.
no form · no qualification step · no sales desk · the other three ways in