Glossary.

The discipline of intercepting an AI agent's tool calls before they execute so a policy + anomaly + judge stack can decide allow, block, or escalate.

Read more → What is AI agent runtime safety?

An attacker's malicious instruction placed directly in the user turn or system prompt that hijacks the model's subsequent tool calls.

See also ↑

An attack that hides instructions inside content the agent later reads — a web page, email, retrieved document — so the payload runs when the agent processes tool output.

Read more → Indirect prompt injection: 5 examples

Labelling every tool-call argument with its provenance and refusing sensitive sinks (payment, email, file-write) when any argument is untrusted; drops IPI ASR from 4.43% to 0.69% (IPIGuard).

See also ↑

A structured request from the LLM to invoke a named external function — the atomic unit that runtime safety filters.

A policy-enforcement device between the agent (untrusted zone) and its tools (trusted zone) that applies rules, anomaly detection, and judge checks per call.

An LLM asked to score whether a tool call is safe, returning a decision plus confidence; typically deployed as the last layer of a cascade.

Read more → LLM judge calibration

A per-agent statistical baseline that scores each tool call by distance from that agent's learned normal behaviour, catching drift the rules and judge both miss.

A grammar-constrained rule language for allow / block / escalate decisions — deterministic, fast, and reviewable, unlike an LLM judge.

A single operator control that revokes all of a compromised agent's access with immediate effect and an audited receipt.

The average gap between a model's stated confidence and its actual accuracy in each confidence bin; Guo et al. 2017 estimator, 10 bins is standard.

Read more → LLM judge calibration

A one-parameter post-hoc calibrator that divides pre-sigmoid logits by a learned scalar T, correcting systematic over/underconfidence without changing accuracy.

Mean squared error between predicted probability and 0/1 outcome; a single scalar that captures both calibration and accuracy.

A binned plot of predicted-vs-actual confidence, used to visualise where a model is over- or under-confident.

The fraction of attempted attacks that reach a sensitive sink in a benchmark; the primary quality metric for prompt-injection defences.

A binary hash tree whose root commits to every leaf; changing any leaf changes the root, so append-only append gets you tamper-evidence with O(log n) proofs.

An append-only Merkle tree whose signed root is published so third parties can catch retroactive edits — the same standard browsers use for SSL certificate transparency.

Read more → Cryptographic audit logs

Multiple independent signers cosign the same log root so the operator can't silently rewind the log; Sigstore pattern.

See also ↑

A short Merkle-path receipt proving a specific leaf is committed by a given root, verifiable offline in O(log n).

A Merkle-path receipt proving one tree root is a valid append-only extension of another; detects any retroactive edit between the two.

Payment Card Industry Data Security Standard; Req 10 (tamper-evident logging) and Req 8 (per-agent access control) directly govern AI agents that touch cardholder data.

Read more → Fintech AI agent compliance

US Health Insurance Portability and Accountability Act; Security Rule §164.312 has 5 implementation specs (2 required, 3 addressable) that all apply to agents automating PHI access.

Read more → HIPAA-compliant AI agents

AICPA Trust Services Criteria for security, availability, and confidentiality; CC6.1 / CC7.2 / CC8.1 cover most of a fintech AI agent security review.

Financial Action Task Force rule requiring originator + beneficiary information on every VASP-to-VASP crypto transfer over $1,000.

Read more → Stablecoin agent security

Human-oversight and transparency requirements for high-risk AI systems; a counterfactual explainer plus tamper-evident audit log satisfies the decision-explainability clause.

A long-running transaction that either fully completes or triggers compensating actions to undo prior steps; Garcia-Molina 1987, applied here to multi-step agent rollback.

The registered inverse of a tool call — a refund for a payment, a delete for a create — that a rollback service fires to undo an effect.

Binding a delegation_id at trace-ingest time so forensic queries ("what happened under delegation X") don't fall back on heuristic time-window correlation; Toledo et al. arXiv:2606.09692.

A governance stack in which Ring 1 is production, Ring 2 is a deterministic strategies-based control plane, and Ring 3 is the non-deterministic LLM layer; Toledo et al. arXiv:2606.07119.

A holding queue for compensations that failed after all retries so an operator can review, retry, or dismiss instead of losing the failure into a log.

An input crafted to bypass a model's safety training and elicit a policy-violating response; typically evaluated as an adversarial-robustness metric.

Movement of sensitive data (PII, secrets, PHI) out of a trusted zone via an authorised tool call; runtime safety catches this at the sink.

Encoding a malicious payload (base64, hex, unicode homoglyphs) so token-level classifiers miss it while the model still decodes it downstream.