AI security glossary

The whole framework — a repeatable method for scoring AI-system risk from 0 to 10 using constrained, auditable assessor judgment.

The final 0–10 number. It combines all three layers; higher means more residual risk. It can never reach zero because of the α floor.

How strong the system is on its own. 23 checks across five security areas, each scored at one of five normalized anchors from 0.00 to 1.00. Reported as a five-number profile, not a single score.

How risky the deployment is: autonomy, exposure, blast radius, and how hard it is to fix. Produces the Compound Risk Multiplier (CRM).

How much we can trust the evidence, given how it was gathered and how old it is. Low confidence inflates the score and triggers re-assessment.

A step-up factor (1.00–1.60, capped at 1.75) that kicks in when several operational risks are high at once — because combined risks compound.

How the ORP Cascade Potential (Cp) dimension is scored: computed from a verified System Dependency Graph via layer reachability, privilege amplification, and fault-injection blast radius — the worst indicator governs the score.

A directed graph of the deployment — model, orchestration, tools, and downstream consumers as nodes with privilege tiers, and containment gates on edges. The evidence artifact from which Cascade Potential is derived.

The irreducible 15% of risk that remains even with perfect controls. It stops any score from reaching zero — AI risk can't be fully eliminated.

Resistance to adversarial input, distribution shift, inconsistent output, and data poisoning. (4 sub-metrics)

Demographic parity, calibration consistency, representation bias, and counterfactual fairness. (4 sub-metrics)

Explainability, confidence calibration, audit-trail completeness, and model-lineage disclosure. (4 sub-metrics)

Training-data leakage, inference-attack resistance, data minimization, and re-identification risk. (4 sub-metrics)

Keeping an agent inside its limits: scope, escalation, output filtering, side channels, identity, action reversibility, and resource/execution-loop containment. The axis that carries AITBM's agentic-systems coverage. (7 sub-metrics)

The trusted declaration of principals, delegated identities, capability grants, resource budgets, and approval obligations against which runtime behavior is evaluated.

A per-boundary record that distinguishes what was declared, configured, enforced, and observed, preventing a policy document from being mistaken for runtime effectiveness.

The first of Cn-6's three reversibility classes: a state change the agent or an operator can cleanly undo within the deployment boundary.

The second Cn-6 reversibility class: the action cannot be undone, but its impact scope stays contained within the deployment boundary.

The third Cn-6 reversibility class: an irreversible action with external impact. Executing one requires explicit human authority.

In a multi-step or multi-agent chain, the whole chain is governed by the reversibility class of its highest-impact hop — a single irreversible step makes the chain irreversible. Enforcing this rule before chain execution is what the top Cn-6 rubric levels require.

How well the system's origins and supply chain are documented — for example, via an AI Bill of Materials (AIBOM).

How much was tested, how independent the tester was, and how production-like the test environment was. A weak link in any one drags it down.

How recent the evidence is. It decays over time on a tier-specific half-life, and can be capped instantly by a change event such as a model swap.

Accelerates freshness decay for containment evidence in agentic and tool-augmented systems, where permission boundaries can change at runtime. It halves the containment evidence half-life relative to the tier half-life, putting a floor on Temporal Freshness.

An ACI staleness floor for architectures with mutable behavioral state — writable memory, multi-agent messaging, self-modifying prompts, closed feedback loops. Behavioral evidence half-life is one third of the tier half-life (M_Em = 3.0), and only a passing Behavioral Attestation Battery resets the clock.

The lightweight scheduled test whose pass resets the behavioral staleness clock (Δt_beh): CTPR ≥ 0.95, zero critical invariant violations, BBD < 0.15, and MPSR ≥ 0.90. The pass is binary — no partial credit.

The framework constant behind the Behavioral Attestation Window: behavioral state mutates through ordinary operation, so behavioral evidence ages at three times the tier rate — one third the half-life of calendar evidence.

A five-band cap (1.00 / 0.90 / 0.75 / 0.60 / 0.40) on Temporal Freshness reflecting how much behavior-specific instrumentation — canaries, invariant monitors, drift computation, memory-write anomaly detection — actually runs in production. A system receives the highest band whose criteria are all met.

A 0–1 measure of how far the system has drifted from what was assessed. Higher drift makes freshness decay faster.

The statistical distance between how the system behaved at assessment and how it behaves now. Crossing thresholds escalates from alert to re-assessment to automated quarantine.

A floor a dimension must meet. Failing one flags a severity on its own, regardless of the overall score. A "Critical MVT" means unacceptable risk.

Risk-based assessment cadence: Tier 1 Critical (most frequent) through Tier 4 Research (annual). Higher tiers re-assess more often and let evidence decay faster.

How often an attacker can successfully impersonate an agent. A core test for Cn-5 — lower is better.

How quickly a compromised agent is detected and isolated. Another Cn-5 test — faster is better.

The percentage of actions in a representative action trace with a recorded pre-execution reversibility classification. The primary Cn-6 test — higher is better.

A Cn-6 test that injects a bounded-irreversible hop into an otherwise bounded-reversible chain and checks that the chain's classification is governed by the injected hop. Lower is better.

The fraction of applicable resource and execution classes with a declared, configured, enforced, and tested aggregate boundary. Higher is better.

The fraction of boundary-saturation trials in which resource use exceeds the enforced limit. Lower is better.

The fraction of recursive planning, retry, delegation, or fan-out trials that fail to terminate within the declared boundary. Lower is better.

The fraction of forced exhaustion or dependency-pressure trials that preserve safe service behavior without silent policy bypass. Higher is better.

The fraction of pre-registered canary tasks the system still passes at attestation time. A Behavioral Attestation Battery pass requires CTPR ≥ 0.95 — a lower rate means behavior has drifted.

How often the system violates its pre-registered behavioral invariants — scope, schema, budget, and communication-whitelist classes. A Behavioral Attestation Battery pass requires zero critical violations.

The fraction of live agent-pair × message-type channels and tool-action categories with invariant monitors attached, computed against the re-attestation artifact inventory (tool manifests, permission scopes, agent rosters, orchestration configs). Feeds the C_behavior band.

A memory-integrity probe: assessors inject tagged poisoning writes and measure the fraction the system detects and quarantines. A Behavioral Attestation Battery pass requires ≥ 0.90 over the pre-registered probe set.

The share of the deployed inventory (from the AIBOM, tool/MCP manifests, and network configuration) present in the System Dependency Graph. DGC < 0.90 makes the graph inadmissible and forces Cp = 1.00.

The fraction of the four stack layers reachable from a compromise origin by transitive closure over the System Dependency Graph — the structural reach of a cascade.

The maximum ordinal climb on the P1–P4 privilege ladder along any reachable path — how far above its origin privilege a compromise can end up.

The share of graph-predicted reachable nodes that injected taint markers actually reached across the trial set — measured propagation rather than modeled propagation.

The fraction of injection trials in which observed reach was a subset of predicted reach. Any failure invalidates the System Dependency Graph, and Cp reverts to 1.00 until the graph is re-documented.

The fraction of injected propagation attempts halted at a declared gate. A gate may be claimed on a path only at CBR ≥ 0.95, and every declared gate must be exercised by at least one canary trial.

The fraction of detected boundary crossings that triggered the required quarantine response. Reported as a diagnostic alongside Cn-5's MTTQ — reported, not scored.

A reported diagnostic, mirroring the Compound Risk Alert, that fires whenever any GDCP indicator triggers the 1.00 anchor — surfacing the graph finding as an actionable driver line. It does not change the score.