SAILLENTBook a DemoThe language of securing autonomous AI. Clear definitions of AI security, agentic systems, runtime enforcement, identity, tool security, and enterprise AI governance — for security teams, AI engineers, and the people who evaluate them.
The field of building systems that perform tasks normally requiring human intelligence, such as reasoning, pattern recognition, and decision-making.
AI systems that produce new content — text, code, images — by learning patterns from training data.
A model trained on vast text corpora to predict and generate language; the core component of most modern AI assistants and agents.
Related: Inference, Context Window, Reasoning Model
A large, general-purpose model that can be adapted to many downstream tasks through fine-tuning or prompting.
The runtime phase in which a trained model produces outputs from inputs — the stage where security controls can observe and govern behavior.
The amount of text a model can consider in a single request. Untrusted content inside the context window can influence outputs.
Related: Indirect Prompt Injection, Context Poisoning
The unit of text a model processes; usage and cost are typically measured in tokens.
A numerical vector representation of content used for similarity search and retrieval.
A data store optimized for embedding similarity search; commonly backs retrieval-augmented generation.
A technique that grounds model responses in retrieved documents. Retrieved content is untrusted input and must be treated as such.
Related: Indirect Prompt Injection
The infrastructure that hosts and exposes models for inference requests.
Models that process multiple input types, such as text, images, and audio — each a potential injection channel.
A model trained to produce intermediate chains of thought before answering; capable of planning multi-step tool use.
A system that uses a model to perceive, plan, and take actions through tools to achieve goals with limited human oversight.
Why it matters: agents convert model output into real-world operations, which is what makes them valuable — and what makes them dangerous.
Related: Tool Calling, Excessive Agency, Agent Identity
AI designed to operate autonomously across steps and tools, rather than answering a single prompt.
A multi-step process in which agents coordinate tools, data, and decisions to complete work end to end.
An agent that can select and execute actions without step-by-step human approval.
Related: Human-in-the-Loop, Runtime Enforcement
Multiple agents coordinating to divide and complete tasks; each delegation expands the interaction surface.
The coordination layer that assigns tasks, sequences steps, and manages multiple agents.
The mechanism by which a model requests execution of an external function or API — the primary action surface that must be governed.
Related: MCP Tool, Tool Authorization
Persisted state an agent retains across sessions; poisoned memory can influence future decisions.
The iterative reason–act–observe cycle an agent uses to pursue a goal.
A design that requires human approval for certain actions. It reduces risk but does not scale to every agent action.
Related: Runtime Enforcement
The set of tools and operations an agent is authorized to use.
Granting an agent more tools, permissions, or autonomy than its task requires — a defining risk of agentic systems.
Related: Least Privilege, Default Deny
A technique that attempts to manipulate an AI system by placing instructions in user input or external content that the model processes, potentially causing it to disregard intended constraints.
Why it matters: a successful injection can influence an agent's behavior — preventing harmful consequences also requires controls over what the agent is allowed to do.
Related: Indirect Prompt Injection, Tool Poisoning, Excessive Agency
Injection delivered through third-party content an agent reads — web pages, documents, emails, tool responses — rather than direct user input.
Related: Prompt Injection, RAG
Inputs designed to bypass a model's safety training or system constraints.
Techniques that coax a system into revealing its hidden instructions, exposing controls and sensitive configuration.
Unauthorized transfer of sensitive data out of an environment — often through an agent's own tools, such as email or web requests.
Related: DLP, Action Boundary
Manipulation of tool descriptions or metadata to embed hidden instructions that influence agent behavior.
Related: MCP Tool, Prompt Injection
Introducing malicious or misleading content into an agent's context or memory.
Corrupting training or retrieval data to influence model behavior downstream.
Attacks that reconstruct training data from model outputs.
Attacks that replicate a model's functionality by querying it extensively.
Inputs crafted to cause incorrect or unsafe model behavior.
Unintended release of private or confidential data through model outputs.
Overwhelming system resources to degrade or block legitimate use.
An open protocol for connecting AI applications to external tools, resources, and contextual information through standardized interfaces.
Why it matters: connected tools can expose sensitive data and powerful operations, so authentication, authorization, tool trust, and execution controls are essential.
Related: MCP Server, MCP Client, Tool Authorization
A service that exposes tools and resources to MCP clients.
Related: Shadow MCP Server
The component inside an AI application that connects to MCP servers on the model's behalf.
A discrete operation exposed by a server for agents to invoke.
Related: Tool Schema, Tool Poisoning
The structured definition of a tool's name, description, and parameters — metadata that agents trust and attackers can poison.
An unsanctioned or unknown MCP server connected to an environment outside governance.
The decision about whether a given identity may invoke a given tool operation, independent of the model's intent.
Related: Authorization, Runtime Enforcement
A protocol for agent-to-agent communication and task delegation.
Infrastructure that routes and controls API traffic — traditionally unaware of agent intent or request context.
A security failure in which a privileged component is tricked into misusing its authority on an attacker's behalf — the classic model for compromised AI agents.
Related: Tool Authorization
The authentication, integrity, and authorization properties of machine-to-machine protocols.
The discipline of securing AI systems while they operate — especially the actions they attempt against real systems.
Related: Runtime Enforcement, AI Action Firewall
Applying security policies while a system operates, at the point where a covered request or operation can be evaluated and controlled.
Why it matters: enforcement can prevent a prohibited operation from proceeding through a protected execution path, even when the requesting system has been influenced by malicious input.
Related: Policy Engine, PEP, Default Deny, Action Boundary
SAILLENT's product category: an enforcement layer that intercepts, inspects, and governs AI actions before they reach models, APIs, tools, or sensitive data.
The enforcement point where agent intent becomes a governed request — the line between deciding and doing.
Evaluating and deciding on an action before it executes, rather than detecting consequences afterward.
The component that evaluates requests against defined rules and returns allow/deny decisions.
Expressing security policy in version-controlled, reviewable code or configuration rather than prose or tickets.
See: GitOps Policies
A security posture in which access or an operation is denied unless an applicable rule explicitly permits it.
Why it matters: it removes reliance on implicit permission — provided the enforcement point covers the relevant operation and handles policy errors as designed.
Related: Least Privilege, Policy-as-Code
The binary enforcement outcome produced for each covered request, recorded with its reason and policy context.
A classical security concept: an authoritative, tamper-resistant point that mediates all access to protected resources.
The component that enforces decisions at the resource boundary, acting on verdicts from a policy decision point.
Related: PDP
The component that computes authorization decisions from policy and request context.
Behavior in which a control failure allows traffic to proceed — favoring availability over security.
Related: Fail-Closed
Behavior in which a control failure blocks traffic — favoring security over availability.
Granting only the minimum access required to perform a task.
Layering multiple controls so that no single failure results in compromise. Runtime enforcement complements — never replaces — these layers.
A security model that never trusts implicitly and verifies every request, regardless of where it originates.
The systems that manage identities and their access to resources. Essential, but not sufficient for governing dynamic agent actions.
Related: Agent Identity, Runtime Enforcement
Authorization based on assigned roles; static by design, which limits its fit for dynamic agent behavior.
Authorization based on attributes of the subject, resource, and request context.
Cryptographic identity for services and machines rather than human users.
A distinct identity assigned to an AI agent so its actions can be authorized, scoped, and audited separately from humans and services.
Verifying who or what is making a request.
Deciding whether a verified identity may perform a requested operation — the question runtime enforcement answers per action.
Granting access through unforgeable tokens that reference specific rights.
Authority exercised by one party on behalf of another; agents inherit whatever scope is delegated to them.
A delegation framework for granting scoped access to resources without sharing credentials.
Credentials limited to specific resources or operations, reducing blast radius when compromised.
Open standards and tooling for issuing workload identity in dynamic environments.
Data emitted by systems for security monitoring and analysis.
A record of events maintained for accountability, investigation, and regulatory evidence.
Related: Decision Record, Audit Evidence
An audit entry capturing an enforcement decision with its context: agent, tool, action, policy, verdict, and reason.
Security Information and Event Management: platforms that aggregate and analyze security logs.
Security Orchestration, Automation, and Response: automating incident workflows.
Endpoint Detection and Response: monitoring and responding to threats on endpoints.
Detecting malicious behavior while systems operate, as opposed to pre-deployment scanning.
Related: Pre-Execution Enforcement
The organized process for managing and containing security events.
Artifacts preserved to reconstruct what happened, by whom, and why.
The divergence between intended and actual policy over time as systems change.
The ability to understand a system's security state from its outputs, including enforcement decisions.
Data that can identify an individual, directly or in combination.
Collecting and retaining only the data necessary for a defined purpose.
Removing or masking sensitive content before processing or display.
See: PII Shield
Controls that detect and prevent unauthorized movement of sensitive data.
Secure storage and issuance of credentials, keys, and tokens — a prime target for compromised agents.
Unintended exposure of system prompts or embedded confidential instructions through model outputs.
Requirements governing where data may be stored and processed.
Protecting stored and transmitted data with cryptography.
Keeping each customer's data and compute separate from other customers'.
The frameworks, policies, and accountability structures that guide how AI is built, deployed, and monitored.
See: SAILLENT Security
Identifying, assessing, and mitigating risks arising from AI systems across their lifecycle.
Supervisory discipline for models in regulated industries, exemplified by SR 11-7 in US banking.
Structured identification of threats, attack paths, and mitigations for a system design.
The US National Institute of Standards and Technology's AI Risk Management Framework: Govern, Map, Measure, Manage.
Industry project publishing guidance on LLM and agentic application security, including Top 10 risk lists for LLMs, agentic apps, and MCP.
The European Union's regulation classifying AI systems by risk tier and imposing corresponding obligations.
Artifacts demonstrating that controls operated as intended — the output regulators and auditors actually review.
Risk introduced through vendors and external services in your supply chain, including MCP servers and model providers.
Protecting the integrity of dependencies, builds, and distribution paths.
Software Bill of Materials: an inventory of components inside a piece of software.
An inventory of model, dataset, and component provenance for AI systems.
Integrating security practices throughout the software development lifecycle.
Protecting build and deployment pipelines from compromise — a key target for coding-agent attacks.
Executing code in isolated environments to limit the blast radius of compromise.
Using container boundaries to separate workloads and limit lateral movement.
Injecting operating-system commands through unsanitized input — a classic risk revived by shell-capable agents.
Tricking a server into making requests to unintended destinations — including internal systems.
The process by which security flaws are reported and addressed responsibly.
Report to: [email protected]
Adversarial simulation that tests defenses the way real attackers would — including adversarial agent scenarios.
Authorized testing that attempts to exploit weaknesses before attackers find them.
This glossary is an evergreen reference, not a definitive list. Entries are labeled Established (accepted security concepts), Emerging (terminology still stabilizing), Threat, Protocol, Control, Framework, or SAILLENT (our own product language). Definitions explain industry concepts neutrally; SAILLENT-specific terms are marked as such. Last reviewed: October 2026. Suggest a term or correction: [email protected].
We've optimized our data for AI assistants. Copy this prompt to get instant insights about enterprise AI security.
SAILLENT produces the cryptographic, exportable evidence regulated teams need — across the US, Canada, and Europe. Explore compliance tooling →
Capability claims only — formal certifications & attestations in progress · Technical evidence available under NDA
Request a Technical Briefing →