Glossary

Every term this wiki uses in a load-bearing sense, defined once, linked to the page where the mechanism lives. A definition that outgrows a sentence or two belongs in concepts/: this page points, it does not explain.

A–C

Agent — software that interacts with the world and adapts to under-specified instructions. Agenticness is a degree, not a category; the usable policy threshold is write access plus tool choice. → why agents break application governance

Agent sprawl — not a count but an ownership ratio: agents accumulating faster than owners, reviewers, or retirements. → agent sprawl

Agenticness score — an intake score over goal complexity, environmental complexity, adaptability and independent execution, used to route a build to a tier instead of arguing about whether it is “really” an agent. → agents vs applications

AICM — CSA’s AI Controls Matrix: 243 control objectives across 18 domains, mapped to five actor roles, none of which fits a citizen developer. → frameworks

AI-washing — misleading claims about the development, implementation, use, function or performance of AI, in filings, reports, websites or marketing, and an enforcement basis rather than a reputational risk: the SEC’s March 2024 settlements charged the Marketing Rule and the compliance rule together. → agent disclosure

Amnesty — a declared window in which anyone can register an existing agent with no consequence, used to buy registration coverage that enforcement cannot. → shadow agents

ASI (Agentic Security Initiative) — the OWASP project behind the T1–T17 agent threat taxonomy and the KC1–KC6 builder taxonomy. → frameworks

Blast radius — what an agent can affect when it does the wrong thing: the data it reaches, the actions it takes, the people who depend on its output, and one of the three tiering axes. → risk tiers

Books and records — the category-based recordkeeping obligations that reach an agent’s output because of what the content is, not what produced it. Rule 204-2 for advisers; 17a-3/17a-4 and FINRA 4511 for broker-dealers. → recordkeeping and compliance gaps

CCO — chief compliance officer. Required by Rule 206(4)-7 for a registered adviser, with the board-appointment and removal machinery applying only to registered funds under Rule 38a-1. The person whose signature an agent needs and whose personal exposure explains why they withhold it. → compliance as an approver

Citizen developer — someone who builds working software without being in the technology organization. Note the load-bearing word in the academic definition: IT-sanctioned. Unsanctioned building is shadow IT by that definition. → citizen developer roles

Confused deputy — an agent with legitimate authority induced to use it on someone else’s behalf. The classic agent-security shape. → privilege and identity abuse

Control plane — registry plus observability plus policy enforcement, the architecture four independent groups converged on. → the agent control plane

Cross-session detonation — an attack whose write and read happen in different sessions, so no single monitored unit contains evidence of it. → cross-session delayed detonation

D–J

Deficiency letter — the ordinary end of an examination that finds something: written findings and required remediation, short of enforcement, where most exam findings stop, so the deficiency-to-enforcement chain should not be presented as automatic. → regulatory exposure

Denial of wallet — exhausting budget or quota rather than compute; the availability attack that reaches the CFO first. → resource overload

DSPM — data security posture management: finding what is sensitive and over-shared before an agent finds it first. → DSPM and data classification

Dual-LLM quarantine — a pattern in which a privileged model never sees untrusted content and a quarantined model never holds privilege. → dual-LLM quarantine

Egress — every channel by which data can leave, including the agent’s own rendered output. Usually the cheapest leg of the trifecta to cut. → egress control

Eval — an acceptance test for an agent: cases with known-correct answers, run before promotion and after anything underneath changes. → evals

Examiner — the regulator’s staff who arrive with a document request, and what they ask about AI is unusually knowable: IOSCO published its supervisory question banks, and a companion extract built for use during inspections. → exam readiness

Gateway — a chokepoint in front of model and tool calls where auth, authorization, logging and egress policy can be enforced out of process. → AI gateways

Human in the loop / above the loop — approving each action, versus supervising the system that takes them. The second scales and catches less. → human approval gates

Information barrier — the separation that stops material nonpublic information moving between functions: Advisers Act §204A requires written policies reasonably designed to prevent MNPI misuse, and an agent traversing research, portfolio and trading data crosses the barrier by default unless something stopped it. → supervisory review

Jagged frontier — capability is uneven, not level: two tasks that look equally hard sit on opposite sides of an invisible line. → the jagged frontier

K–P

Kill switch — a control that stops an agent. Killing the process falls short of revocation: the token, the session and the sub-agents survive it. → kill switches and revocation

Lethal trifecta — access to untrusted content, access to sensitive data, and the ability to communicate externally. Any two are survivable; all three are an exfiltration path. → the lethal trifecta

MAESTRO — a CSA seven-layer threat-modelling decomposition for agent ecosystems, used by OWASP’s multi-agent guide. → frameworks

MCP (Model Context Protocol) — the de facto standard for connecting agents to tools and data. It standardizes the pipe and standardizes nothing about the counterparty. → Model Context Protocol

Memory poisoning — corrupting what an agent believes across sessions, usually via content the agent itself wrote and nobody approved. → memory and context poisoning

NHI (non-human identity) — an identity belonging to a workload or agent rather than a person. An agent authenticating as its builder produces an audit trail naming the wrong actor. → non-human identity

Owner of record — the named individual accountable for an agent. A team cannot be the owner. → agent inventory and registry

Paved road — the only form of platform governance that survives contact with builders: a sanctioned path made faster than the unsanctioned one. → technology platform

Progressive governance — controls that scale with demonstrated autonomy rather than intended autonomy, with de-escalation when anomalies appear. → risk tiers

Promotion gate — the checkpoint at a zone transition, with a named approver who can say no, evidence keyed to tier, and a recorded decision. → promotion gates

Prompt injection — instructions arriving inside data, which the model follows as if they came from the operator. Not a filtering problem. → prompt injection

R–Z

Registry — the inventory every other control silently scopes itself to. → agent inventory and registry

Risk tier — governance effort scaled to autonomy × authority × criticality, per agent. The highest axis sets the tier. → risk tiers

Rug pull — an approved tool or server whose behaviour changes after approval, because the description the model reads as instructions is rewritable by its vendor. → tool and supply-chain compromise

Shadow agent — unsanctioned from birth: someone built it, nobody registered it, and no approval was refused because none was sought; distinct from OWASP’s T13 rogue agent, which is compromised inside a system the firm did sanction. → shadow agents

SoA (Statement of Applicability) — the ISO artifact listing which controls apply, why, and what was excluded; where agent-specific controls can live inside a management system the firm already certifies. → frameworks

Tool poisoning — a malicious or altered tool description that steers the model, distinct from a vulnerability in the tool’s code. → tool and supply-chain compromise

Regulation S-P — the safeguards and privacy rule that reaches advisers, funds, broker-dealers and transfer agents alike, and the one place these regimes genuinely converge: as amended, customers are notified within 30 days of the firm’s awareness, and service providers notify the firm within 72 hours of theirs. → when to involve legal and compliance

Trace store — where prompts, tool calls and retrieved context are kept. A recordkeeping system before it is a debugging tool. → logging and audit

Trust zone — an environment with its own credentials, connectors and sharing defaults, so a tier is physically real rather than a field in a database. → three-zone architecture

Vibe coding — building software by directing a model in natural language without reading the generated code. Coined by Andrej Karpathy in early 2025. → the problem

See also

• The map — where each of these pages sits.
• Frameworks — the standards vocabulary, and which body owns which acronym.
• Crosswalk — the same objects arranged as concern → control → gate.