Glossary

This glossary defines the vocabulary of Tools: the four kinds of tool, the identifier families, the scales and levels, and the artefacts, methods and third-party tools that the chapters treat. Each entry gives the term in one to three sentences, as the originating volume of the series defines it, and names that volume and, where it helps, the chapter of this book that treats the term. It adds no claim of its own. Laws and regulations are not tools, so they have no entry here; the instruments the books attribute statements to are named in the chapters.

How to use this glossary

Entries are in alphabetical order, with identifier families in code formatting (SVC-*, RST-*) sorted by their letters. An identifier such as SLO-* names a pattern: the wildcard stands for the number the organisation assigns to each record, and the worked examples use NR for Nordvik Region and HM for Hansa Mutual. A reference to an earlier volume is written as the series writes it: Architecture as Code (Chapter N), AI Governance, Chapter N, and so on. A reference to "Chapter N" alone is a chapter of this book. A prefix can name more than one artefact (Chapter 2); where it does, the entry says so.

A

ADR (Architecture Decision Record). A short, structured record of the context, decision and consequences of a significant architectural choice (126, Nygard, 2011). It is defined in Architecture as Code and used beside the AI Decision Record in the later volumes (Chapter 4).

AGENTS.md. A repository configuration file that tells coding agents how to work in the repository, treated in this book as an artefact of the agent's configuration (AI Platform and Security; Chapter 18).

Agent identity record. The record that gives an agent an identity of its own, with its owner and credentials, so that its actions can be attributed (Chapter 20).

Agent Skills (SKILL.md). A format in which a capability of an agent is packaged as a skill: a directory that contains at least a SKILL.md file. The book treats a skill as an artefact that needs an owner and a review (Chapter 20).

AI Decision Record (AIDR). The record of a decision about an AI system or capability. Each volume from The Transformed Security Architect reserves a number range: AIDR-0500 to 0599, 0600 to 0699, 0700 to 0799, 0800 to 0899 and 0900 to 0999 for Books 6 to 10 respectively (AI Governance; Chapters 2 and 7).

Alert-correlation policy (ACP-*). The policy that sets, per alert class, what a correlation or noise-reduction layer may group, suppress or page, and what it may never suppress (AI Operations; Chapter 15).

Algorithmic management. Directing, evaluating, rewarding and disciplining people by means of AI, the subject of AI Boss (Chapter 22).

Allocation map. A record of how the cost of a platform is allocated to teams and services, used for showback (Architecture as Code; Chapter 17).

Anti-pattern record (AP-*). A record of a recurring wrong way of doing something, with its symptoms and the remedy (The Transformed Security Architect).

Apprenticeship plan. The plan by which a person learns a craft by doing it, with assessment by demonstration, kept so that a craft survives the assistant (Chapter 21).

Architecture as Code. The companion discipline of the series, in which architecture is codified, version-controlled and continuously validated; also the title of Book 1.

Artefact. One of the four kinds of tool: a template, manifest, record, register, checklist, policy or schema that a book defines (Chapter 1).

ATLAS (MITRE ATLAS). A knowledge base of adversary tactics and techniques against AI-enabled systems, used as shared vocabulary for threats to AI (Chapter 10).

ATT&CK (MITRE ATT&CK). A knowledge base of adversary tactics and techniques drawn from observed intrusions. The series names techniques by identifier and never by procedure (Chapter 10).

ATT&CK Navigator. A tool that displays ATT&CK techniques as a matrix and records which are covered (Chapter 10).

Atomic Red Team. An open library of small, catalogued tests of ATT&CK techniques, used in emulation under written rules of engagement (207, Red Canary, n.d.) (AI Red Team; Chapter 11).

Autonomy budget. The tolerance for faulty actions that a Level 3 action class has in a window, consumed by autonomy errors as a service level budget is consumed by failures (AI Operations, Chapter 4; Chapter 18).

Autonomy level. The degree of delegation granted to an AI capability in a context, from Level 0 Advisory to Level 4 Autonomous. It is a property of a capability in a context, not of a model (AI Red Team, Chapter 6; Chapter 18).

B

Backstage. An open platform for a developer portal, named in the series as a way to offer self-service to platform users (152, Cloud Native Computing Foundation, 2022) (Architecture as Code; Chapter 6).

Blast radius. How far a mistake or a failure spreads, from one instance to the group. It is one of the answers that set a delegation ceiling (90, Principles of Chaos Engineering community, n.d.) (AI Operations, Chapter 4; Chapter 16).

Board page. A one-page statement to the board about a loop or a team (AI Blue and AI Purple; Chapter 8).

Burn-rate alerting. Multi-window alerting on the speed at which the error budget is consumed (221, Thurgood et al., 2018) (AI Operations; Chapter 15).

C

C4 model. A way of describing software architecture at four levels of detail (context, containers, components and code), used in the series for architecture diagrams (Chapter 4).

CALM (Common Architecture Language Model). An open model from FINOS for describing architecture as a definition that tools can check (Chapter 4).

Capacity record (CAP-*). The record of the capacity of a service and of what is planned for it. The same prefix also names the cost-and-latency budget of an AI service (AI Operations; Chapter 17).

Carbon-aware scheduling. Placing work in time or place according to the carbon intensity of the energy available (177, Green Software Foundation, n.d.) (AI Operations; Chapter 17).

Case record (CASE-*). The record of an investigation: evidence, queries, reasoning and who or what reached each conclusion, so that the case can be reproduced (AI Blue; Chapter 12).

Catalogue. In this book, Appendix A: the list of every tool in the inventory, with its kind, origin, purpose and identifier family (Chapter 1).

Change class. A kind of change defined by what may be released without a person in the path. A model, prompt or routing change is never a standard change in Hansa Mutual's rule (AI Operations; Chapter 16).

Change record (CHG-*). The record of a change, with author, approvers, tested rollback and verification. The prefix is used for more than one artefact (Chapters 2 and 16).

Chaos experiment. A catalogued test that injects a defined condition, with a steady-state hypothesis, rollback and blast-radius limits (90, Principles of Chaos Engineering community, n.d.) (AI Red Team, AI Purple; Chapter 14).

Clock sheet. A sheet that tracks the reporting clocks of an incident and who is to report what, and by when (Chapter 13).

Competence framework. A versioned statement of the competences of a role against which people are assessed, such as SA-CF, SOC-CF and OPS-CF (Chapter 21).

Competence record (CMP-*). The versioned evidence of one person's competence in a stated area, with the test and the date (The Transformed Security Architect; Chapter 21).

Conftest. A tool that tests structured configuration files against policies written in Rego (Chapter 5).

Constructive debate in four steps. The method of stating the case for concern, the case for calm, where the positions meet and what can be done, before a verdict (AI Threat; Chapter 23).

Containment profile. The artefact that states the limits within which an agent runs: what it can reach, what it can write and how it can be isolated (AI Platform and Security; Chapter 20).

Contestation record (CNT-*). The record of a worker's challenge to a management decision and its outcome, owned by a reviewer outside the decider's line (AI Boss; Chapter 22).

Control catalogue entry (CTRL-*). An entry in the versioned set of controls, mapped to obligations and evidence (AI Platform and Security; Chapter 8).

Control mapping matrix. A matrix that maps one control to the obligations of several instruments, so that an organisation can assure once and comply many times (Chapter 8).

Coverage record (COV-*). The record of what a loop covers, with the test, the date and the result for each technique, and the age of the evidence (AI Purple; Chapter 14).

Crux map. A map of the questions whose answers would change at least one of two disagreeing positions (AI Threat; Chapter 23).

D

Data contract. An agreement on the shape, meaning and quality of data that a producer offers to its consumers (Chapter 9).

Data product descriptor. The description of a data product, with its retention rule, owner and use (AI Platform and Security; Chapter 6).

Decay estimate (DCY-*). An estimate of how fast detections decay between tests (AI Blue; Chapter 12).

Degradation mode. A defined, reduced way for a service to run when a dependency, such as an AI component, is not available (AI Operations; Chapter 13).

Delegation profile (DLG-*). The statement, for one system or team, of the degree of delegation per function and action class, with the stop holders and the evidence for each level. An action that is not listed is not delegated. The prefix also names a decision-rights file with a checker in AI Operations (Chapters 2 and 18).

Delegation register. The register of the delegations in force, with the level, the record that granted each, the fallback and the date of the next reversibility test (The Transformed Security Architect, AI Boss, AI Operations; Chapter 18).

Detection as code. The practice of keeping detections as versioned, tested code with an owner and a review date (AI Blue; Chapter 12).

Detection record (DET-*). The record that defines a detection with its logic, data sources, ATT&CK mapping, tests, owner and review date (AI Blue; Chapter 12).

Disparate-impact test record. The record of a test of whether a management system treats groups of people differently, with its result (AI Boss; Chapter 22).

Documentation as Code. The practice of keeping documents as text in version control and building them with the same pipeline as code (Architecture as Code; Chapter 4).

E

Emulation plan (EMU-*). The plan of an adversary emulation, mapped to ATT&CK techniques and bound by the rules of engagement (AI Purple; Chapter 11).

Error budget. 100 per cent minus the service level objective: the unreliability a service may spend in a window (220, Thurgood et al., 2018) (AI Operations; Chapter 15).

Evidence age. The time since the test or measurement that supports a claim. A claim that something is covered, recoverable or competent states what was tested, when and with what result (AI Operations, AI Purple; Chapter 2).

Evidence ladder. The five rungs for grading a claim: fiction, argument, laboratory demonstration, incident in the wild and pattern at scale (AI Threat; Chapter 23).

Evidence manifest (EVD-*). The manifest that lists the evidence for a finding or a claim, with its provenance and date (AI Threat, AI Blue, AI Purple; Chapter 5).

Exception record (EXC-*). The record of a time-limited departure from a policy, with the approver and the compensating control (AI Governance; Chapter 7).

Exit and substitution plan. The plan by which an organisation leaves a supplier and replaces the service. An exit never tested is an asserted claim (Chapter 9).

Expected. One of the three labels for statements about the future: strongly evidenced but uncertain in timing or form (AI Governance, Chapter 22; Chapter 23).

F

Finding record (FND-*). The record of a finding from a test or an exercise, which closes only when its re-test passes (AI Red Team; Chapter 11).

FRIA (FRIA-*). A fundamental rights impact assessment, the assessment that Article 27 of the AI Act requires before certain deployers first use a high-risk AI system (195, European Union, 2024) (AI Governance; Chapter 7).

Freeze calendar. The calendar of windows in which change on a critical function is not allowed (AI Operations; Chapter 16).

G

Gaia-X. A European initiative for federated data infrastructure, which the series names among its references for sovereignty (Chapter 9).

Game day. A rehearsed exercise in which a fault is introduced under written rules to test a hypothesis about resilience (AI Operations; Chapter 13).

GitOps. Operating a system by declaring its desired state in version control and letting software agents pull and reconcile it (96, OpenGitOps, n.d.). The reconciler is a change actor (AI Operations; Chapter 16).

Graded evidence record. A record that places a claim on the evidence ladder with its sources (AI Threat; Chapter 23).

H

Helm. A package manager for Kubernetes applications (Chapter 6).

Honeytoken. A credential, key or data item planted solely so that its use reveals unauthorised access (AI Blue; Chapter 23).

Horizon register (HZN-*). A versioned record of trends, each labelled observable, expected or speculation, with a trigger, an owner and a review date (AI Governance; Chapter 23).

Hunt record (HNT-*). The record of a hunt's hypothesis, data, queries, result and coverage statement (AI Blue; Chapter 12).

I

Incident clock. The configuration that sets the reporting clocks of a class of incident (Chapter 13).

Incident record (INC-*). The record of a service incident, with its timeline, classification and actions (AI Operations; Chapter 13).

Independence principle. A check is evidence only if the side that performs it can fail in ways the side being checked does not share (AI Purple; Chapter 14).

Independence statement. The declaration, with an expiry, that an observer does not depend on the system it observes (AI Operations; Chapter 19).

Intelligence record (INTEL-*). The record of an intelligence item, traced to a hunt and a detection requirement (AI Blue; Chapter 12).

Inventory. In this book, the file of 1,629 tools of Books 1 to 10 from which the catalogue and the chapters were compiled (Chapter 1).

K

Kubernetes. An open system for running containerised workloads, whose objects are declared as manifests (Chapter 6).

L

Learning path (LP-*). A plan, with dates, by which a person acquires a competence (Chapter 21).

Level 0 Advisory. The AI suggests, and a person decides and acts (AI Red Team, Chapter 6).

Level 1 Assisted. The AI drafts, and a person reviews and executes (AI Operations, Chapter 4).

Level 2 Supervised. The AI executes after explicit approval of each action (AI Operations, Chapter 4).

Level 3 Bounded. The AI executes pre-approved, reversible actions within a codified runbook; a person is informed and can stop it (AI Operations, Chapter 4).

Level 4 Autonomous. The AI selects and executes without per-action approval. The series never uses it for an irreversible action on production data, for an action that disables the observation or the stop path, or for an action that decides about a named person's access to work (Chapter 18).

M

Mandate manifest (MND-*). The written mandate of an agent: its purpose, tasks, level per action class, tools, data, approvers, review date and expiry, enforced outside the agent (The Transformed Security Architect; Chapter 18).

Management Decision Record (MDR-*). The record of a decision in a management function, with its decider, the delegation and the way to contest it (AI Boss; Chapter 22).

Maturity Radar. The own tool of Architecture as Code that displays the results of the maturity self-assessment (Chapter 8).

Method. One of the four kinds of tool: a named, repeatable procedure that the reader applies (Chapter 1).

MITRE D3FEND. A knowledge graph of cybersecurity countermeasures (Chapter 10).

MLflow. An open platform for tracking experiments and managing models, named in the series for the model registry (Chapter 6).

Model card. A short document on a model's intended use, training data, evaluation results and limitations (130, Mitchell et al., 2019) (AI Governance).

Model registry entry. The record of a model in a registry, with its version, provenance and approval (AI Platform and Security; Chapter 6).

Mode 0 Ambient AI. AI embedded in products and services whose behaviour the organisation does not choose (AI Governance, Chapter 2).

Mode 1 Conversational assistants. Chat assistants used under a person's identity (AI Governance, Chapter 2).

Mode 2 Embedded workplace assistants. Assistants inside workplace tools (AI Governance, Chapter 2).

Mode 3 Agentic work tools. Tools that draft code, runbooks and changes under a person's identity (AI Governance, Chapter 2).

Mode 4 Built AI applications. Applications that the organisation builds or procures around a model (AI Governance, Chapter 2).

Mode 5 Autonomous production agents. Agents that act with an identity and permissions of their own and so become privileged machine insiders (AI Governance, Chapter 2).

N

Noise budget. The amount of noise in alerts that a team accepts, against which a correlation policy is evaluated (AI Operations; Chapter 15).

O

Observable. One of the three labels for statements about the future: happening now and documented (AI Governance, Chapter 22).

Observer manifest (OBS-*). The manifest of an observer that verifies an operations action, with its independence statement and heartbeat (AI Operations; Chapter 19).

Observer principle. What verifies an operations action must be independent of what performed it, and the stop path must work when the platform does not (AI Operations; Chapter 19).

Obligation register (OBL-*). A register of the obligations that apply to an organisation, with the controls that evidence them (Chapter 8).

On-call charter. The statement of the terms on which people carry on-call duty (Chapters 21 and 22).

OpenSLO. An open specification for describing service level objectives in YAML as a vendor-neutral format (Chapter 15).

OpenTelemetry. Vendor-neutral instrumentation for traces, metrics and logs (Chapter 15).

Open Policy Agent (OPA) and Rego. An open policy engine and the language, Rego, in which its policies are written (Chapter 5).

OSCAL. The Open Security Controls Assessment Language, a machine-readable format for controls, profiles and assessments (Chapter 8).

Own tool. One of the four kinds of tool: software or a script that a book or its repository provides (Chapter 1).

P

Playbook manifest (PBK-*). The manifest of a response playbook, with its steps, levels and stop conditions (AI Blue; Chapter 13).

Policy as code. Machine-readable policy under version control, evaluated automatically (51, Open Policy Agent, n.d.) (Architecture as Code; Chapter 5).

Post-incident review (PIR-*). The blameless, evidence-based review of an incident. AI Blue defines one for security incidents and AI Operations one for service incidents (Chapter 13).

Problem record (PRB-*). The record that tracks an action from a review to a verified closure (AI Operations; Chapter 13).

Progressive delivery. Limiting what a bad change can do by controlling who is exposed and for how long before it is judged (168, Flagger project, n.d.) (AI Operations; Chapter 16).

Purple loop. The joint loop between the red team and the blue team, in five stages: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify (AI Purple; Chapter 14).

Purple session record (PRP-*). The record of a session in which red and blue work together, with its charter and results (AI Purple; Chapter 14).

R

Regression case (REG-*). A test kept so that a fixed finding stays fixed (AI Purple; Chapter 14).

Reversibility test (RVT-*). The test of whether a function could still be performed without the system (AI Threat).

Risk definition (RISK-*). The document that defines a risk and its register entry (Architecture as Code; Chapter 7).

Risk register entry. A record of a risk with its owner, rating and treatment (Chapter 7).

Role charter (ROLE-*). The versioned definition of a role: its purpose, decision rights, ceilings and what it may not do (The Transformed Security Architect; Chapter 21).

Rules-of-engagement manifest (RoE-*). The signed, versioned manifest that says what may be done to which systems, when, with whose consent and under what stop conditions (AI Red Team; Chapter 11).

Runbook manifest (RBK-*). The runbook as code: preconditions, action, independent verification, failure path, who may stop it and when it was last exercised (AI Operations; Chapter 16).

S

Scenario record (SCN-*). The record of an adversary scenario for an exercise (AI Purple; Chapter 14).

Security chaos experiment (SCE-*). A chaos experiment that tests a security control against a steady-state hypothesis. (Chapter 14).

Seeded error, gap, fault and incident. A known mistake, weakness, fault or case introduced on purpose to show that a reviewer, an observer or a defender can fail and does catch it (The Transformed Security Architect, AI Purple, AI Operations; Chapter 19).

Service level objective record (SLO-*). The record of what users are promised and how it is measured, alerted on and evidenced (AI Operations; Chapter 15).

Service record (SVC-*). The unit of the service catalogue: tier, owner, dependencies, objectives, blast radius and the evidence of recovery (AI Operations; Chapter 15).

Showback. Reporting the cost of a service to the team that consumes it, without charging (Chapter 17).

Sigma. An open, vendor-neutral format for detection rules (Chapter 12).

Sigstore. A set of open tools, including Cosign, for signing and verifying software artefacts (Chapter 5).

SLSA and in-toto. A framework for the provenance of software and a framework for attesting the steps of its supply chain (Chapter 5).

Software Carbon Intensity. A specification of the Green Software Foundation for the carbon emitted per unit of work (Chapter 17).

Speculation. One of the three labels for statements about the future: plausible but not yet evidenced (AI Governance, Chapter 22).

STIX and TAXII. OASIS standards to structure (STIX) and exchange (TAXII) threat intelligence (Chapter 12).

Stop path. The route by which named people halt a system, which runs outside the system it stops and is drilled (AI Platform and Security, AI Operations; Chapter 19).

Structurizr. A tool for describing the C4 model as text (Chapter 4).

T

Team consumption envelope. The amount of a shared resource that a team may consume (AI Operations; Chapter 17).

Terraform. A declarative tool for describing and provisioning infrastructure (Chapter 6).

Third-party tool. One of the four kinds of tool: software, a platform, a library, a service or an open standard that a book names as something practitioners use (Chapter 1).

Threat register entry (THR-*). An entry in the AI threat register, graded on the evidence ladder (AI Threat; Chapter 23).

Timed stop drill record (STOP-*). The record of a timed drill of a stop path (The Transformed Security Architect; Chapter 19).

TIBER-EU. A European framework for threat-intelligence-based ethical red teaming (Chapter 11).

Tier 0. The set of assets whose compromise gives control of everything else. The operator's agents and observability pipeline are Tier 0 (AI Operations; Chapter 19).

Tool. In this book, an artefact, an own tool, a third-party tool or a method (Chapter 1).

Trope (T1 to T10). One of the ten science-fiction tropes treated as a hypothesis (AI Threat; Chapter 23).

U

Usage mode. One of the six patterns of AI use, Mode 0 Ambient AI to Mode 5 Autonomous production agents (AI Governance, Chapter 2; Chapter 18).

Usage-mode register. The register that records the usage mode of each AI capability (AI Governance; Chapter 7).

Use case (UC-*). An entry in the intake and portfolio of AI use cases (AI Governance; Chapter 7).

V

Vendor assessment record. The record of an assessment of a supplier (Chapter 9).

W

White team. The control group that governs an exercise: it authorises, controls the window and holds the stop (AI Red Team, AI Purple; Chapter 11).

Y

YAML. The plain-text format in which most artefacts of the series are written (Chapter 1).