AI security review — the vocabulary.
Definitions for the terminology of structured AI security review. Each term has its own page with a short definition, a longer explanation, and links to the hubs, resources, and blog posts that use it.
AI Security Clearance
A structured decision, supported by evidence, on whether an AI system can reach production and under what controls.
AI Risk Disposition
The structured memo recording the AI Committee's decision about an AI system, the rationale, the required controls, the residual risks accepted, the evidence gaps, and the re-assessment triggers.
Evidence Pack
The structured bundle of artefacts that supports an AI system's security clearance decision — threat model, control plan, evidence gaps, framework mapping, and disposition.
Clearance Decision
The specific outcome of an AI security review: one of proceed, conditional, restricted pilot only, hold, or decline.
Control Gap
An identified, named difference between a required control and the evidence on file — a control that should be in place but is not yet evidenced, implemented, or both.
Delegation Chain
The sequence of authorisations that allows an orchestrator agent to spawn sub-agents and each sub-agent to invoke tools or call other systems.
Agent Blast Radius
The set of resources, actions, and identities that an agent can reach through its tools, delegation chain, and memory — and therefore the maximum possible impact if the agent is compromised.
Vendor AI Assessment
A security review of a third-party AI feature or SaaS AI product, performed without runtime access to the vendor's source — based on documented architecture, declared data flows, and contractual control claims.
AI Go-Live Review
The structured security review that runs before an AI system passes the production-readiness gate — verifying that pre-pilot and pilot controls are in place and that production-readiness controls are operational.
Audit-Ready Dossier
A versioned, sign-off-bearing record of an AI system's security review — exportable for auditor or regulator review, structured so each stakeholder can find their part without reading the whole.
Prompt Injection
An attack where input the model treats as trustworthy instruction — from a user, a retrieved document, or a tool response — redirects the model's behaviour away from its intended task.
Model Context Protocol (MCP)
An open standard, published by Anthropic in 2024, for connecting AI models to external tools and data sources — an MCP server exposes tools and resources; an MCP host (typically an LLM client or agent framework) consumes them.
Retrieval-Augmented Generation (RAG)
An architecture pattern where an LLM's response is grounded by content retrieved at query time from an external knowledge base, rather than relying solely on the model's trained-in knowledge.
AI Bill of Materials (AI-BOM)
A structured inventory of an AI system's components — models, datasets, frameworks, and infrastructure — analogous to a software bill of materials (SBOM), but covering the AI-specific supply chain an SBOM does not.
Shadow AI
AI tools and features in use inside an organisation without security review, procurement oversight, or IT visibility — the AI-specific instance of shadow IT.
Excessive Agency
An LLM-based agent granted more capability, autonomy, or permission than its task requires — so that a manipulated or malfunctioning agent can exercise harm beyond what the task should ever need.
System Prompt Leakage
Exposure of an LLM application's system prompt — the instructions, scoping rules, and sometimes credentials that define the model's behaviour — through adversarial prompting or error/debug output.
High-Risk AI System (EU AI Act)
An AI system classified under the EU AI Act (Regulation (EU) 2024/1689) as posing significant risk to health, safety, or fundamental rights — triggering specific provider and deployer obligations under Articles 9-15 and Article 26 respectively.
OWASP LLM Top 10
A community-maintained risk taxonomy, published by OWASP, naming the ten most critical security risks for applications that incorporate large language models — a taxonomy, not a certification framework or a control library.
OWASP Agentic Top 10
A risk taxonomy naming the ten most critical security risks specific to agentic AI systems — tool use, delegation, memory, and autonomous action — distinct from and complementary to the OWASP LLM Top 10.
Confused Deputy (Agentic AI)
A vulnerability where an agent with legitimate but broad authority is manipulated into using that authority on behalf of an attacker who could not exercise it directly — the agentic-AI instance of a classical access-control problem.
Human-in-the-Loop (AI)
A design pattern requiring explicit human approval before an AI system executes a defined class of consequential or irreversible actions — a control, not a description of how carefully a system was built.
Apply these concepts