> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/start-here/glossary.md). # Glossary Plain-language definitions of every technical term used across the AI Sec Handbook, from AI agent and MCP to vibe coding and Zero Data Retention. ## Glossary *Last reviewed: August 18, 2026* **In short:** Plain-language definitions of every technical term used across the AI Sec Handbook, from AI agent and MCP to vibe coding and Zero Data Retention. #### AI acceptable use policy (AUP) An AI acceptable use policy defines which AI tools employees may use, what data is allowed into them, and how personal accounts, connectors, and agents are handled. #### AI agent / Agentic AI An AI agent is a system that plans and takes actions through tools with varying autonomy, rather than only returning text. Agentic AI is the broader category of these tool-using systems. #### AI data security AI data security is the practice of detecting and controlling sensitive data as it moves into, through, and out of AI tools, prompts, and agent actions, where traditional data controls have no visibility. #### AI gateway An AI gateway is a control point that proxies model traffic to apply policy, logging, rate and spend limits, and routing. #### AI governance AI governance is the set of policies, controls, and monitoring an organisation uses to decide which AI tools and data uses are allowed, and to enforce those decisions across every AI surface. #### AI surface An AI surface is any point where a person or agent sends data to an AI model, including web chat, desktop apps, IDE extensions, browser agents, and inference APIs. #### Agentic AI security Agentic AI security is the discipline of governing AI agents that take autonomous actions — covering identity, tool access, approval policies, sandbox containment, and audit — rather than only governing prompt-level data exposure. #### Agent bill of materials An agent bill of materials is a structured inventory of every tool, connector, MCP server, skill, and data source an AI agent can access, used to assess and govern its attack surface before deployment. #### App An app is a packaged capability or integration surfaced inside an AI platform, often built on connectors. #### Artifact (live) A live artifact is a persistent, interactive output that makes authenticated connector calls each time it is opened. #### Browser agent A browser agent is an AI that operates inside a user's signed-in browser session, able to read page content and take actions — making every visited page a potential prompt injection source. #### Claude Code Claude Code is Anthropic's agentic coding tool that reads and writes files, runs commands, and connects to MCP servers, giving it developer-level access to the local environment rather than only answering questions. #### Coding agent A coding agent is an AI system that generates, edits, and executes code autonomously inside an IDE, terminal, or CI pipeline, with direct access to files, credentials, and system resources. #### Compliance API A compliance API is a vendor API that exposes audit logs, chat content, and file activity for investigations and retention requirements. #### Computer Use Computer Use is a mode where an AI controls the desktop directly through screenshots, clicks, and typing, often outside the sandbox and without per-action user approval. #### Confused deputy A confused deputy is an over-privileged agent that is tricked into misusing its legitimate access on an attacker's behalf. #### Connector A connector is a pre-built integration that gives an AI tool authenticated access to an external service such as Slack, Google Drive, or Salesforce. #### Data loss prevention (DLP), AI era Data loss prevention is the set of controls that stop sensitive data from leaving an organisation. In the AI era, the exit point is a prompt or tool call rather than email or USB, which classic DLP does not inspect. #### Destructive action (AI) A destructive action is an agent-initiated operation that cannot be undone — including file deletion, credential exposure, sending messages, making purchases, or modifying production systems — executed without explicit per-step user approval. #### Dispatch Dispatch is a mobile-to-desktop bridge that triggers agent tasks on a user's desktop from their phone, creating a remote execution surface that inherits the desktop's full tool and file access. #### Domain claiming Domain claiming is the process of migrating personal accounts on a verified domain into a managed enterprise workspace, bringing shadow accounts under governance. #### Hook A hook is a script that runs automatically at defined points in an AI session, before the user sees a trust dialog, making it a code execution and prompt injection surface. #### IDE extension An IDE extension is a plugin that runs inside a code editor such as VS Code or JetBrains, operating outside the browser and invisible to network-based and browser-based AI governance controls. #### Indirect prompt injection Indirect prompt injection is an attack where hidden instructions embedded in content the AI reads — a web page, document, MCP response, or tool output — hijack the model's behaviour without the user's knowledge. #### MCP (Model Context Protocol) MCP is an open protocol that standardizes how AI clients connect to tools and data through MCP servers, running locally over stdio or remotely over HTTP/SSE. #### MCP gateway An MCP gateway is a broker that centralizes, allowlists, and mediates an organization's access to MCP servers, preventing users from adding unauthorized servers. #### MCP read vs write permissions MCP read permissions allow an AI agent to retrieve data from a connected system. Write permissions allow the agent to create, modify, or delete data. Write-enabled MCP connections carry significantly higher risk because agent actions become irreversible. #### OpenTelemetry (OTel) OpenTelemetry is an open standard for emitting traces, metrics, and logs, used to route AI runtime events including prompt activity, tool calls, and errors into a SIEM or observability platform. #### Personal AI account A personal AI account is an account created by an employee using their personal email on an AI platform such as Claude.ai or ChatGPT, outside enterprise governance and invisible to security teams without browser or endpoint controls. #### Plugin A plugin is a bundle that can contain skills, connectors, sub-agents, and hooks, distributed through a marketplace or repository and reviewed like a software dependency. #### Prompt injection Prompt injection is an attack where hidden instructions in content or tool output hijack a model's behavior, either directly through user input or indirectly through retrieved content. #### Prompt-level DLP Prompt-level DLP is data loss prevention applied at the moment a user or agent submits a prompt to an AI model, inspecting the content before it leaves the organization rather than monitoring network traffic after the fact. #### RBAC (role-based access control) RBAC is a model that assigns capability permissions to roles or groups rather than to individuals, used across AI platforms to control who can access which tools, connectors, and administrative functions. #### Remote MCP server A remote MCP server is an MCP server accessed over HTTP or SSE rather than locally via stdio, typically requiring OAuth or token-based authentication and carrying network-level attack surface in addition to the tool access it grants. #### Sandbox A sandbox is an isolated execution environment, often a virtual machine, that constrains what code or agents can touch — limiting filesystem access, network egress, and system calls. #### SCIM SCIM is a standard for automated user and group provisioning from an identity provider, used to keep AI platform access in sync with joiners, movers, and leavers without manual deprovisioning. #### Shadow AI Shadow AI is AI tools or accounts used by employees outside a security team's visibility and controls, typically personal accounts on managed devices or AI features embedded in approved SaaS tools. #### Skill A skill is an instruction file, such as SKILL.md, that an agent loads on demand when a task matches its description. It may bundle scripts and resources, making it executable trust rather than passive documentation. #### Small language model (SLM) A small language model is a compact model that can run locally or in-tenant for detection and classification tasks — such as identifying sensitive data in prompts — without sending data to a third-party model provider. #### Stdio (Local) MCP server A stdio MCP server is an MCP server that runs locally on the user's machine over standard input and output, with full access to the local filesystem and environment by default and no network boundary between it and the endpoint. #### Supply chain attack (AI) A supply chain attack targeting AI systems uses malicious MCP configurations, skill files, plugin packages, or repository content to execute code or inject instructions when the artefact is opened or loaded — often without any user interaction beyond opening a project. #### Tenant restriction A tenant restriction is a network control, such as an org-id HTTP header injected by a proxy, that blocks use of non-managed accounts on corporate networks or managed devices. #### Tool poisoning Tool poisoning is the use of malicious tool metadata or descriptions in an MCP server or plugin to manipulate an agent into unsafe tool use, privilege escalation, or data exfiltration. #### Vibe coding Vibe coding is the practice of building software by describing intent to an AI coding tool and accepting its generated output, often with limited review of what the code actually does or what data it accesses. #### Workload identity federation Workload identity federation is a method of granting AI agents and automated workloads scoped, short-lived credentials from an identity provider rather than static API keys, reducing the blast radius of a compromised agent. #### API application An API application is software that calls a model or agent API under application-controlled identity, authorization, logging, and runtime policy. The application owner is responsible for the full loop, including tools, data, approvals, and downstream actions. #### Browser or desktop agent A browser or desktop agent can read or act through a browser session, local application, clipboard, filesystem, or operating-system interface. Its risk depends on the signed-in user, local permissions, protected sites, and the evidence available from the endpoint and target systems. #### Data poisoning Data poisoning is the deliberate or accidental introduction of misleading, malicious, or policy-breaking content into training, fine-tuning, evaluation, retrieval, memory, or knowledge-base data so later model or agent behavior is altered. #### Denial of wallet Denial of wallet is an attack or failure mode that causes excessive model, tool, infrastructure, or third-party usage costs through repeated, recursive, or unusually expensive work. #### Derived AI data Derived AI data is information created from source content, including embeddings, summaries, indexes, caches, traces, labels, evaluations, and generated artifacts. It may remain sensitive even when it does not reproduce the original record verbatim. #### Hosted agent A hosted agent is an agent that executes in a vendor-managed or centrally managed runtime, often asynchronously. Security review must cover session state, isolation, credentials, egress, limits, termination, retention, and hosted evidence. #### Low-code agent builder A low-code agent builder is a managed platform that lets users assemble and publish agents from templates, instructions, knowledge sources, connectors, and actions. Governance must cover who can build, connect, collaborate, publish, transfer, and delete agents. #### Memory poisoning Memory poisoning is the insertion of malicious or misleading information into persistent agent memory so it influences later tasks, users, or automated runs after the original interaction ends. #### Retrieval-augmented generation (RAG) Retrieval-augmented generation is a pattern where an AI system retrieves documents or records from a knowledge source and supplies them to a model as context. The retrieval index, permissions, source freshness, and retrieved content are part of the security boundary. #### Telemetry completeness objective A telemetry completeness objective defines which expected AI events must arrive, how quickly they must arrive, and how the team proves that events were not silently dropped. It turns logging from a configuration claim into a measured control. #### Tool-result spoofing Tool-result spoofing is the manipulation or fabrication of content returned by a tool, connector, browser, agent, or model so the receiving agent makes an unsafe decision or action. #### Vector store A vector store holds embeddings and metadata used for semantic search and RAG. It can expose sensitive relationships, preserve deleted content indirectly, and bypass source-system permissions if access and deletion are not synchronized. #### Workforce chat Workforce chat is an employee-facing AI conversation surface used for research, drafting, analysis, and questions. Connectors, files, memory, browser access, and action capabilities can raise it beyond a read-only chat risk profile. #### Zero Data Retention (ZDR) Zero Data Retention is a contractual mode in which a provider does not retain prompt or response data beyond the duration of the API call, used to satisfy data residency and confidentiality requirements. ## Related handbook guidance * [AI Security Handbook](/ai-security-handbook.md) * [What is AI Security?](/start-here/what-is-ai-security.md) * [1. Identity & Access](/handbook/1.-identity-and-access.md) * [2. Supply Chain & Extensibility](/handbook/2.-supply-chain-and-extensibility.md) * [5. Threats & Adversarial](/handbook/5.-threats-and-adversarial.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/start-here/glossary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.