Glossary
In short: The glossary defines forty terms used across the register, in plain language and with the definition first. Each term links to the controls that use it. Terms cover identity basics such as least privilege, agent-specific ideas such as shadow agents and MCP gateways, and framework names such as the AI Act.
Which terms are defined?
- Agent governance
- Agent governance is the set of rules, owners and records that decide what AI agents may do.
- Agent inventory
- An agent inventory is the single, current list of every AI agent an organisation runs.
- Accountable owner
- An accountable owner is the named person who answers for what an AI agent does.
- Agent sponsor
- An agent sponsor is Microsoft's term for the person responsible for an agent identity in Entra Agent ID.
- Purpose statement
- A purpose statement is a short written description of what an agent is for, which tasks it may perform and which data it needs.
- Shadow agent
- A shadow agent is an AI agent running with real access that nobody registered.
- Non-human identity
- A non-human identity is any account, key, token or certificate used by software rather than a person.
- Least privilege
- Least privilege is the principle that an identity should hold only the permissions its task needs, and nothing more.
- Just-in-time access
- Just-in-time access grants permissions only at the moment they are needed and removes them when the task ends.
- Short-lived credential
- A short-lived credential is a token or certificate that expires within minutes or hours and is often scoped to one task.
- Standing privilege
- Standing privilege is access that stays granted whether or not it is being used.
- Per-action policy
- Per-action policy is a rule checked each time an agent tries to do something, rather than once at sign-in.
- Allow ask deny
- Allow, ask, deny is a three-outcome policy model for agent actions.
- Human in the loop
- Human in the loop means a person must take part in a decision before an agent's action goes ahead.
- Human oversight
- Human oversight is the ability of people to monitor an AI system, override or reverse its outputs and stop it safely.
- Separation of duties
- Separation of duties is the rule that no single person or system should both request and approve a sensitive action.
- Self-approval
- Self-approval happens when the party asking for an action is also the one allowed to approve it.
- Policy replay
- Policy replay tests a new or changed policy by running it against recorded agent sessions before enforcing it.
- Tool allow-list
- A tool allow-list is the approved set of tools an agent may call.
- Kill switch
- A kill switch is a control that cuts one agent, or every agent, off from tools and data immediately.
- Decommissioning
- Decommissioning is the removal of an agent's identity, credentials and access once its task or project ends.
- Audit trail
- An audit trail is the ordered record of what happened, who caused it and what was decided.
- Chain of custody
- Chain of custody is an unbroken record that links an outcome back to the person who started it.
- Evidence retention
- Evidence retention is the rule for how long logs, approvals and review records are kept, and how they are protected from change.
- SIEM
- A SIEM, or security information and event management system, collects security events from across an organisation so analysts can search, correlate and alert on them.
- Access review
- An access review is a scheduled check in which an owner confirms or removes each permission an identity holds.
- Certification campaign
- A certification campaign is an organised round of access reviews run across many identities at once, usually quarterly or twice a year.
- Delegation
- Delegation is the act of a person letting an agent act on their behalf.
- On-behalf-of
- On-behalf-of describes an agent acting with a specific person's authority rather than its own.
- MCP
- MCP, the Model Context Protocol, is an open protocol that lets AI agents connect to tools and data sources through MCP servers.
- MCP server registry
- An MCP server registry is the approved list of MCP servers agents may connect to, with each server's endpoint, owner and environment recorded.
- MCP gateway
- An MCP gateway is a proxy that sits between agents and MCP servers.
- Policy enforcement point
- A policy enforcement point is the place in a system where a policy decision is applied to a real request.
- Conditional access
- Conditional access applies access rules based on conditions such as identity, device, location or risk at the time of a request.
- Risk tier
- A risk tier is a label that groups agents or actions by potential harm, such as low, medium and high.
- High-risk action
- A high-risk action is an agent action whose harm would be serious or hard to reverse.
- AI management system
- An AI management system is the set of policies, roles, processes and records an organisation uses to run AI responsibly and improve over time.
- AI RMF
- AI RMF is the NIST AI Risk Management Framework, a voluntary framework for managing risks from AI systems.
- AI Act
- The AI Act is Regulation (EU) 2024/1689, the European Union law on artificial intelligence.
- Control crosswalk
- A control crosswalk is a table that shows which controls in one framework correspond to requirements in another.