Glossary

Term	Meaning in this project
AI system	The full data, model, application, infrastructure and human workflow, not only the model weights.
Agent	A system in which a model selects actions/tools or coordinates a sequence of work.
Control	A mechanism or process intended to reduce a risk. Its existence and effectiveness require evidence.
Finding	A documented claim about an actual target, with evidence and a verification state.
Risk	A possible harmful outcome and mechanism; an applicable catalog entry is not itself a finding.
RAG	Retrieval augmented generation: the model receives retrieved information as context.
Prompt injection	Untrusted text influences the model to follow unintended instructions. A retrieved document can be the entry point.
Tool poisoning	A tool definition or implementation contains content or behavior intended to redirect the agent.
Confused deputy	A more privileged component is induced to misuse its authority for a less privileged requester.
Least privilege	Each identity can perform only the operations it needs, on the resources it needs.
MCP	Model Context Protocol: a client/server interface for tools, resources and prompts.
Trust boundary	A point where identity, permissions or trust level changes. Validate authority at that boundary.
Source mapping	An association reported by the compendium; it does not prove compliance.
Unspecified applicability	A blank source cell preserved as null. It is different from No.
Evidence	Inspectable observations or artifacts with provenance, version, time and scope.
Residual risk	What remains after mitigation, including unknowns and explicitly accepted tradeoffs.
Negative control	A legitimate comparison case that should continue to work during a security test.

Definitions are project-authored explanations informed by the source register.