Glossary
- Agent Identity
- A distinct, authenticatable principal for each agent, with its own scoped and short-lived credentials, so that actions can be attributed and privileges bounded per agent rather than shared across a system.
- Agentic AI (Agentic System)
- An AI system that does not merely produce output but takes actions — calling tools, reading and writing state, invoking other agents — to pursue a goal across multiple steps with limited human input.
- Audit Trail
- The queryable record of what an agent did and why — model version, prompt template, tool called, argument digest, authorization decision, approval reference, and outcome. Without it, an incident cannot be investigated.
- Blast Radius
- The scope of damage a single action or compromise can cause — how many systems, records, or users it can reach before something stops it. A primary criterion for deciding which agent actions need approval gates.
- Confused Deputy
- A privilege-escalation pattern in which a component acts on a low-privilege caller's request using its own higher privileges. Agents holding broad service credentials are a textbook instance.
- EU AI Act
- European Union regulation that classifies AI systems by risk tier and attaches obligations accordingly, with a separate regime for general-purpose AI models. Obligations phase in over time; always verify current dates against the official text.
- Excessive Agency
- Granting an agent more functionality, permission, or autonomy than its task requires, so that a successful influence attack converts directly into a damaging action.
- Guardrail
- An input or output control that filters, classifies, or blocks content around a model. Useful as defense in depth, but insufficient alone: durable control for agents lives at the tool, identity, and approval layers.
- Human-in-the-Loop (HITL)
- A design in which a person must review and approve specific agent actions before they execute. Reserved for actions that are irreversible or have large blast radius, so approval does not degrade into click fatigue.
- Indirect Prompt Injection (IPI)
- Prompt injection delivered through content the agent retrieves rather than through the user's own input — a web page, document, code comment, calendar entry, or tool error message that carries hidden instructions.
- ISO/IEC 42001 (AIMS)
- The certifiable management-system standard for artificial intelligence, structured like ISO/IEC 27001 around Plan-Do-Check-Act: policy, roles, risk treatment, documented information, internal audit, and continual improvement.
- Jailbreak
- A technique that bypasses a model's safety training or system-prompt constraints to elicit output the model was configured to refuse.
- Memory Poisoning
- Contaminating an agent's persistent memory or knowledge store so that a single malicious input keeps influencing behavior in later sessions, long after the original interaction ended.
- MITRE ATLAS (ATLAS)
- Adversarial Threat Landscape for Artificial-Intelligence Systems: an ATT&CK-style knowledge base of adversary tactics and techniques against AI systems, used to structure red team engagements and detection coverage.
- MLSecOps
- Securing the machine learning lifecycle itself — training data provenance, model signing, SBOMs for AI artifacts, registry access control, and deployment pipeline integrity.
- Model Card
- A short structured document describing a model's intended use, limitations, evaluation results, and known risks. In agentic deployments, its analogue at the system level is a system card covering tools, permissions, and gates.
- Model Context Protocol (MCP)
- An open protocol for exposing tools, resources, and prompts to AI applications through a standard server interface. Because it centralizes tool exposure, it is also the natural place to enforce authorization and argument validation.
- NIST AI Risk Management Framework (AI RMF)
- A voluntary framework organizing AI risk work into four functions — Govern, Map, Measure, and Manage — that translate technical findings into organizational responsibility and tracked risk.
- OpenTelemetry (OTel)
- A vendor-neutral standard and SDK for traces, metrics, and logs. In agent security it is the practical substrate for audit trails: one root span per agent run, child spans per model and tool call.
- OWASP Top 10 for LLM Applications (LLM Top 10)
- A community-maintained list of the most critical vulnerability classes in LLM applications, used across the industry as shared triage vocabulary between AI and application security teams.
- Policy-as-Code (PaC)
- Expressing authorization and data-access rules as versioned, testable code rather than prose, so policy decisions are reviewable in pull requests and their evaluations are logged as evidence.
- Prompt Injection (PI)
- An attack that inserts adversarial instructions into text an LLM processes, causing it to follow the attacker's intent instead of the operator's. The root cause is that instructions and data share a single channel.
- Red Teaming
- Adversarial evaluation of a system by simulating a motivated attacker, producing reproducible evidence of failure. In this field, negative results — attacks that did not work — are recorded as evidence too.
- Retrieval-Augmented Generation (RAG)
- An architecture that retrieves relevant documents from an external store and places them in the model's context before generation. It is also the most common delivery path for indirect prompt injection.
- SBOM for AI (AI-BOM)
- An inventory of the components that make up an AI system — models, weights, datasets, adapters, prompts, tools, and dependencies — with versions and provenance, enabling impact analysis when one component is found vulnerable.
- STRIDE
- A threat-modeling taxonomy — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — used here to enumerate threats per element of an agent's data flow.
- System Prompt Leakage
- Disclosure of the instructions, tool definitions, or configuration in an agent's system prompt, giving an attacker a map of the agent's capabilities and guardrails.
- Tool Misuse
- Inducing an agent to call a legitimate, authorized tool with unintended arguments or in an unintended context, producing harm without ever breaking the tool itself.
- Trust Boundary
- A point where data or control crosses between zones of different trust levels. In agentic systems, a boundary is crossed whenever untrusted retrieved content enters the same context window as operator instructions.
- Unbounded Consumption
- Resource exhaustion caused by uncapped agent behavior — runaway loops, recursive sub-agent spawning, or unlimited tool calls — producing cost and availability impact even without data compromise.