Glossary

A context budget is an explicit allocation of the model's window between system instructions, retrieved evidence, conversation history, tool output, and the response. This explainer covers why unbudgeted systems fail silently through truncation, how to size each component, and what to drop first when the budget is exceeded.

An AI regression suite is a fixed set of cases run on every change to catch quality that has silently degraded. This explainer covers why probabilistic outputs make regression testing different, what belongs in the suite, how cases should be added from incidents, and how to judge results that are not pass or fail.

A scratchpad is the working space where an agent records intermediate reasoning and findings across steps. This explainer covers why structured scratchpads outperform free text, how they interact with the context budget, what they contribute to debugging, and when a scratchpad should persist beyond a single run.

A simulation environment lets agents be tested against realistic replicas of the systems they will act on, without real consequences. This explainer covers what fidelity is actually needed, how to generate representative scenarios including failures, what simulation cannot capture, and how it fits alongside production evaluation.

Continuous evaluation measures AI quality on an ongoing basis rather than once before launch, because models, data, and traffic all change. This explainer covers what can be measured automatically from production, how sampling and human review fit in, and why evaluation sets must be refreshed from real traffic.

Prompt compression shortens what is sent to a model while preserving the information that matters. This explainer covers the main techniques from summarisation to token pruning, what each loses, why better retrieval usually beats compressing bad retrieval, and how to measure whether it is working.

A confused deputy attack persuades a privileged system to use its authority on behalf of someone who does not have it. This explainer covers why AI agents have made this old vulnerability newly common, how it differs from ordinary injection, and why acting on the user's identity rather than the agent's is the fix.

A sovereign AI cloud provides infrastructure operated under a specific jurisdiction's legal control, not merely located there. This explainer covers why location alone does not satisfy sovereignty, what these offerings actually provide, the capability and cost trade-offs, and how to judge whether the requirement applies to you.

An AI model licence governs what you may do with the model and sometimes with its outputs, and open weights do not mean open licence. This explainer covers the common restriction types, why output ownership is less settled than assumed, what changes when a licence is revised, and what to verify before building.

An air-gapped AI deployment runs entirely within an isolated environment with no external connectivity. This explainer covers what that forecloses, why model updates and evaluation become substantially harder, which sectors genuinely require it, and what a realistic air-gapped architecture looks like.

Least privilege for AI agents means granting only the authority a specific task requires, and agents accumulate permissions faster than people because nothing reviews them. This explainer covers scoping by task rather than role, time-bounding agent access, why read and write need separating, and how to review what agents hold.

Open-weight AI means the model's parameters are published for download, which enables self-hosting, fine-tuning, and inspection. This explainer covers what that permits and what it does not, why it is distinct from open source, the operational cost of running your own inference, and when it is the right decision.

A guardrail policy is the set of enforced rules constraining what an AI system may accept, produce, and do. This explainer covers input, output, and action guardrails, why enforcement must live outside the model, how to avoid over-blocking, and what belongs in a policy versus a prompt.

A retrieval index is the searchable structure behind grounded AI answers, and it holds considerably more than vectors. This explainer covers what each entry must carry, why update strategy determines freshness, how indexes decay silently, and what separates an index that stays useful from one that quietly stops working.

An agent registry records every autonomous agent an organisation runs, with its identity, permissions, owner, and authority limits. This explainer covers why agents need their own register rather than appearing in an AI inventory, what each entry must capture, and how agent identities escape conventional access governance.

Late interaction retrieval scores documents by matching query tokens against document tokens individually rather than comparing two summary vectors. This explainer covers why that recovers detail single-vector similarity loses, what it costs in storage and computation, and why it usually belongs as a reranker.

Query expansion rewrites or augments a user's query to improve what retrieval finds. This explainer covers the main techniques including hypothetical answers and multi-query generation, when expansion genuinely improves recall, how it introduces drift away from the original intent, and how to measure it.

Semantic chunking splits documents where the meaning changes rather than at fixed character counts. This explainer covers the methods, why structure-aware splitting often achieves most of the benefit more cheaply, what the extra ingestion cost buys, and how to tell whether your corpus needs it.

Tool poisoning manipulates an agent through the tool descriptions it reads or the results tools return, rather than through user input. This explainer covers how the attack works, why shared and third-party tool servers make it practical, what changes when a tool definition is updated silently, and what defends against it.

A prompt template is a reusable, parameterised prompt managed as a versioned artefact rather than a string in application code. This explainer covers why inline prompts become unmaintainable, how variable injection creates security risk, why prompt changes need the same gates as code, and how to organise templates.

AI literacy is the practical understanding people need to use AI systems well and judge their output. This explainer covers what different roles actually need to know, why tool training is not literacy, which misconceptions cause the most damage, and how to build capability that changes behaviour.

AI risk tiering classifies systems by the impact they can cause, so that governance effort follows risk rather than applying uniformly. This explainer covers what actually drives a tier, why uniform controls fail in both directions, how to stop teams under-classifying, and when a system should be re-tiered.

Algorithmic transparency covers what organisations disclose about the automated systems affecting people. This explainer covers the different audiences and what each needs, why publishing technical detail is not transparency, what disclosure is increasingly expected, and how to be transparent without exposing what should stay closed.

An AI inventory records every AI system an organisation operates, and building one almost always reveals more than governance knew about. This explainer covers what each entry must capture, how to discover systems nobody registered, why the inventory underpins every other control, and how to keep it from going stale.