AI agent governance and security glossary

Controls that determine what an AI agent may do, who authorizes it, when a human must intervene, and what evidence proves the resulting action.

Security for AI systems that can plan and take actions through tools, APIs or workflows, with emphasis on authority, tool access, execution limits and recoverability.

A decision made before an external effect occurs, using authenticated identity, resolved authority and deterministic policy.

A distinct authenticated identity for the acting software, separate from free-form fields in the request body.

The person, organization or authority on whose behalf an agent is acting.

The actions an authenticated identity is permitted to perform for a particular principal and context.

Rules that return the same decision for the same versioned inputs rather than relying on probabilistic model judgment.

A policy decision that permits an action to proceed within the active limits.

A policy decision that produces no effect until a required human approval is present.

A policy decision that prevents the action from producing an effect.

A separately authenticated human decision required by policy before a held action can execute.

An approval tied to one exact action payload so changing the action invalidates the approval.

A control that prevents one actor from unilaterally requesting, approving and attesting the same sensitive action.

A hard ceiling such as amount, rate, count, destination or action class that is checked before execution.

Withdrawal of an agent's authority so future actions cannot execute under the revoked grant.

A property that prevents retries or recovery from causing the same intended external effect more than once.

A mechanism that makes repeated processing of the same logical request safe from duplicate effects.

A record of the request, identity, policy version, decision, approval where applicable, timestamps and execution outcome.

Evidence that a requested action was denied and produced no authorized effect.

Records structured so unauthorized modification can be detected through signatures, hashes or linked integrity checks.

A sequence where each record commits to the prior record's hash so deletion or alteration breaks continuity.

Checking evidence without relying on the production database, signing capability or operator assertion that produced it.

A separately signed commitment to the state of an evidence chain used to detect later rewriting or truncation.

Using distinct cryptographic keys or service identities for different security functions so compromise of one key does not imply all functions.

Who can actually access and control a key or service in a deployment. Key separation alone does not prove independent custody.

Authorization, provenance and execution controls applied to Model Context Protocol tools before they create real effects.

Evidence identifying which tool, server or integration path produced or requested an action.

Reusing a previously valid request, token or approval in an attempt to trigger another effect.

A more privileged component being induced to exercise its authority for a caller that should not have that authority.

An agent operating outside intended authority because of compromise, misconfiguration, uncontrolled delegation or goal drift.

Controls that bound an agent's ability to spawn, delegate, call tools, consume resources or continue acting after revocation.

Artifacts that let a reviewer determine what control ran, what it decided, who approved, and what occurred.

Technical records mapped to regulatory or framework obligations without implying certification or legal compliance by themselves.