Glossary — Enterprise AI Security Workshop

AI foundations

Large Language Model (LLM): A model trained on large volumes of text that generates and reasons over natural language; powers an agent's reasoning and language understanding (Chapter 2).
Prompt: The input text given to a model to elicit a response.
System prompt: Instructions given to a model that define its behavior and constraints, distinct from user-supplied prompts. A target of "prompt override" attacks (Chapter 8).
Meta prompt: A prompt used to generate or refine other prompts.
Tokens: The units (word fragments) a model processes; attacker influence over even a single token can change a model's output (Chapter 6).
Context window: The maximum amount of text (in tokens) a model can consider at once, including the prompt, retrieved content, and conversation history.
Inference: The act of a model producing an output from an input; the runtime execution of a model (as opposed to training).
Hallucination: A model producing output that is fluent but factually incorrect or fabricated, including invented actions or commands (Chapter 8).
Groundedness: The degree to which a model's output is supported by retrieved or provided source data, rather than fabricated.
Embedding: A numeric vector representation of text (or other content) used for similarity search in a vector database.
Neural network / model training: The underlying architecture and process by which a model learns from data.

Chatbot: A passive, single-model conversational system with a static trust boundary between user and model (Chapter 1, Stage 1).
Agent: An AI system with a spectrum of autonomy — interactive, autonomous, or collaborative — that can plan and take action, not just respond (Chapter 1, Stage 2).
Interactive agent: An agent that performs a single, specific, repetitive task on demand, acting only when the user asks.
Autonomous agent: A goal-oriented agent that creates plans and coordinates actions on the user's behalf and schedule.
Collaborative agent: A learning-driven agent that provisions its own access and resources and pursues goals on its own behalf.
Skills: Discrete capabilities an agent can invoke, often via tools or plugins.
Agent sprawl: The proliferation of agents across an organization without centralized inventory or governance (Chapters 2 and 3).
Agentic AI Security Framework: The 8-domain framework (Asset Inventory, Identity & Access, Data Security, Secure SDLC, Red Team, Runtime Security, Incident Response, Third-Party & Shadow AI) used throughout this workshop to map controls to responsibility (Chapter 1).

Retrieval-Augmented Generation (RAG): Grounding a model's response in retrieved data rather than relying solely on the model's training. Covered as a 7-stage pipeline in Chapter 8.
Vector database: A database optimized for storing and searching embeddings by similarity, used at the Indexing and Retrieval stages of a RAG pipeline.
Model Context Protocol (MCP): A standard interface for AI clients to discover and use context — data sources, APIs, memory, tools — through MCP servers (Chapter 7).
Tool poisoning: An attacker embedding malicious instructions inside a tool's description or metadata, which the calling model reads and follows as legitimate guidance (Chapter 7).
Tool shadowing: A malicious tool registering under a name or description that impersonates a trusted tool, redirecting calls intended for the real one (Chapter 7).
Shadow MCP: An MCP server deployed without being registered or governed — the MCP-specific analog of shadow AI (Chapter 7).

Jailbreak: A technique used to bypass a model's safety guardrails and elicit disallowed behavior.
Prompt injection: An attack that manipulates a model's behavior through crafted input. See UPIA and XPIA below.
UPIA (User Prompt Injection Attack): Direct prompt injection — malicious instructions supplied directly by the user in a prompt.
XPIA (Cross Prompt Injection Attack): Indirect prompt injection — malicious instructions embedded in retrieved content (a document, web page, or tool output) that the model treats as trustworthy.
Data poisoning: Corrupting training data, retrieved context, or platform-level data so a model's behavior or output is manipulated; appears at multiple layers of the Gen AI threat landscape (Chapter 6).
Model theft: Unauthorized extraction or replication of a proprietary model's weights or behavior.
Shadow AI: Unapproved use of AI tools, agents, or coding assistants outside organizational governance (Chapter 4).

Microsoft Entra Agent ID: Identity platform for AI agents built on the Register, Govern, Protect model (Chapter 3).
Conditional Access: Policy enforcement that grants or denies access based on identity, device, location, and risk signals — extended to agents in Chapter 3.
Identity Protection: Risk-based detection that flags anomalous sign-in or access behavior and can automatically restrict access.
RBAC (Role-Based Access Control): Assigning permissions based on role rather than individual identity; a recurring control across Storage and Indexing stages in Chapter 8.
DSPM (Data Security Posture Management): Visibility into data risk and exposure, extended to AI agents by Microsoft Purview (Chapter 4).
DLP (Data Loss Prevention): Controls that detect and block sensitive data from leaving a managed boundary, including via AI prompts (Chapter 4).
CSPM (Cloud Security Posture Management): Continuous assessment of cloud configuration against security best practices; Defender CSPM extends this to AI workloads (Chapter 5).
Microsoft Agent 365: Unified IT control plane for agent registration, governance, security, and lifecycle across first-party, third-party, and custom agents (Chapter 6).

PyRIT (Python Risk Identification Tool): Microsoft's open-source framework for automated adversarial testing of AI systems, used by the Azure AI Foundry AI Red Teaming Agent (Chapter 5).
Attack Success Rate (ASR): A metric tracking what proportion of adversarial test prompts successfully elicit unsafe or unintended model behavior (Chapter 5).
OWASP MCP Top 10: An emerging OWASP project cataloguing the top security risks specific to Model Context Protocol deployments (Chapter 7). See owasp.org/www-project-mcp-top-10.