AI Security & Governance Glossary

Adversarial machine learning

The discipline of attacking and defending machine learning systems, with NIST AI 100-2 providing the canonical taxonomy security teams map coverage against.

Agentic AI

The category term for the shift from AI that responds to AI that acts, describing a change in how AI is deployed rather than any particular architecture.

Agent identity

A distinct, traceable identity for an AI agent, separate from the user who initiated it, recording its author, its credential type, and its downstream scope.

Agent sprawl

AI agents accumulating faster than any process can register and govern them, driven by low-code builders, embedded SaaS features, and agents creating other agents.

AI agent

A system that reasons about a goal, calls tools to act on it, and adapts to results, holding an identity, permissions, a reasoning loop, a tool catalog, and memory.

AI agent governance

The policies and enforcement mechanisms determining which agents may exist and what they may do, spanning inventory, identity, permission, runtime policy, and audit.

AI asset tagging

Attaching labels such as owner, environment, and risk level to discovered AI assets, turning a flat inventory of thousands into groups that policy can address.

AI Bill of Materials (AIBOM)

A structured inventory of every component inside an AI system, extending the software bill of materials concept to models, datasets, prompts, agents, and tool catalogs.

AI compliance

Meeting the regulatory, standards-based, contractual, and internal obligations governing enterprise AI use, from inventory and risk assessment to incident reporting.

AI control plane

The platform layer governing every agent, model, and MCP server in an enterprise, and the AI-layer analog to the control planes already running for cloud and identity.

AI discovery

Continuous identification and inventory of every AI asset across an environment, read from several surfaces because no single signal source sees the whole footprint.

AI guardrails

The controls defining what an AI system may accept, produce, and do at runtime, and the colloquial umbrella above the policy engine that actually enforces them.

AI hallucination

Model output presented as factual but grounded in nothing, ranging from small factual drift up to fabricated citations, APIs, and wholly invented sources.

AI intervention

The runtime control function that acts on an agent's action before it completes, and the third core function of an AI control plane after discovery and observation.

AI Observability

Continuous, evidence-grade visibility into what AI agents, models, and MCP servers are and how they behave at runtime, spanning inventory through to behavioral baselining.

AI orchestration

The layer routing and governing AI traffic across providers, MCP servers, and agents, covering LLM gateways, MCP gateways, and agent-level workflow composition.

AI policy engine

The runtime component compiling authored governance rules into checks that intercept prompts and agent actions before they execute, beneath AI agent governance.

AI red teaming

Adversarial probing of AI systems to find security, safety, and reliability failures before production, combining human creativity with automated agent-driven testing.

AI ROI

Measurement of the business return on AI investment alongside its cost and risk, across four metric families: adoption, value, cost, and risk exposure.

AI runtime security

The inline layer inspecting and controlling AI activity as it executes, narrower and more specific than LLM security, which spans the whole model lifecycle.

AI security posture management (AI-SPM)

Continuous inventory, evaluation, and prioritized remediation for AI assets, extending cloud and SaaS posture management to agents, models, and AI applications.

AI TRiSM

Gartner's category for AI trust, risk, and security management, spanning four pillars: explainability, ModelOps, AI application security, and model privacy.

EU AI Act

The EU's horizontal AI regulation, classifying systems as unacceptable, high, limited, or minimal risk and placing obligations on both providers and deployers.

Human-in-the-loop

An architectural pattern where an AI system pauses for human review before specified actions, gated selectively on action class, blast radius, or model confidence.

Just-in-time access (for agents)

Granting an agent the permissions a specific request requires at the moment of the request, evaluated against live context and released rather than held standing.

LLM data leakage

Sensitive information escaping through a model's outputs, training data, or tool calls, along direct, indirect, and structural paths conventional DLP was not written to see.

LLM jailbreaking

Bypassing the safety training in a language model so it produces content it would normally refuse, through role-play framing, encoding, or multi-turn conditioning.

LLM observability

The engineering discipline of instrumenting LLM applications for quality and cost, distinct from AI observability, which asks a security and governance question.

LLM security

Protecting language models and the applications built on them across four lifecycle layers: training data integrity, deployment, inference, and application architecture.

MCP gateway

An inline proxy between agents and MCP servers that brokers every tool call and tool list response, creating the chokepoint MCP traffic otherwise has nowhere to be inspected at.

MCP security

Protecting agents and the systems they touch from threats over the MCP surface, across three vectors: agent-to-MCP, MCP-to-agent, and rogue server infrastructure.

MITRE ATLAS

MITRE's knowledge base of adversary tactics, techniques, and case studies against AI systems, structured like ATT&CK so it fits existing security practice.

MLSecOps

Security built into the machine learning lifecycle rather than added after a model ships, spanning data, model, supply chain, runtime monitoring, and incident response.

Model Context Protocol (MCP)

An open protocol standardizing how AI applications reach external tools and data, where servers expose tools and resources and clients discover and call them.

Multi-agent system

An architecture where several AI agents collaborate and delegate, which compounds governance because identity and policy must propagate through every handoff.

NIST AI Risk Management Framework

Voluntary US guidance for managing AI risk across the lifecycle, organized into four functions and extended to generative systems by the Generative AI Profile.

Non-human identity

An identity belonging to a service, workload, machine, or AI agent rather than a person, now the majority of identities in most mature enterprise environments.

OWASP

The open-source community behind the Top 10 vulnerability lists, including the Top 10 for LLM Applications that security teams evaluate AI platforms against.

Prompt injection

Crafted input that overrides a model's developer instructions and redirects its behavior, arriving directly from a user or indirectly through content the model reads.

Remote Code Execution (RCE)

A vulnerability class letting an attacker run arbitrary code on a target system, which in AI contexts arises when an agent's tool use can be steered into executing it.

Retrieval-augmented generation (RAG)

Retrieving source material at query time to ground a model's answer, the dominant pattern for connecting models to enterprise data and the main indirect injection path.

Shadow AI

AI tools and agents operating outside the visibility and policy framework of IT and security, including AI features inside approved software nobody assessed.

Supervisory AI

AI that oversees other AI rather than performing the task itself, unifying discovery, observation, and intervention so agent decisions are reviewed at machine scale.

Tool use/function calling

The mechanism letting a model invoke external code and read the result, and the primitive underneath every action an AI agent takes or is manipulated into taking.

Onyx Glossary