Glossary

AI-DLP — Data-loss prevention scoped specifically to data flowing into or through AI tools (assistants, IDE copilots, autonomous agents), as distinct from classic network/email/USB-focused DLP.

Argon2id — A memory-hard password-hashing algorithm resistant to GPU/ASIC-accelerated brute force; used here for operator credential storage.

CASB (Cloud Access Security Broker) — A network-perimeter control that inspects traffic to cloud services.

Ed25519 — An elliptic-curve digital signature scheme used here to sign policy snapshots and update artifacts.

ESF (Endpoint Security Framework) — Apple's macOS API for subscribing to and authorizing system-level events (including file opens), used for kernel-adjacent access mediation on macOS.

Excessive agency — The risk that an AI agent granted multiple, individually reasonable capabilities (e.g. read a file, call a tool) can chain them into an unintended and unauthorized data flow, without any single capability grant being the mistake.

Fail-closed — A design principle where any failure to establish trust, health, or integrity results in denial by default.

fanotify — A Linux kernel API for filesystem-wide event notification and, with FAN_OPEN_PERM, synchronous permission-based file-access mediation.

JWKS (JSON Web Key Set) — The published set of public keys an OIDC identity provider uses to sign tokens; consumers cache and periodically refresh it to verify token signatures.

MCP (Model Context Protocol) — A protocol (typically JSON-RPC over stdio or HTTP) that lets an AI agent invoke external tools/servers; a common vector for both legitimate tool use and unintended data exfiltration if unmediated.

NER (Named-Entity Recognition) — Traditionally a statistical/ML technique for identifying entities (names, locations) in text; used loosely in this space to describe personal-data detection. In this product, implemented as dictionary- and checksum-based recognition plus entropy analysis — see Detection Engine.

OIDC (OpenID Connect) — A standard identity/authentication protocol layered on OAuth2, used here for control-plane operator login.

PTY (Pseudo-terminal) — The OS mechanism that lets one process present a terminal interface to another; shell interception mediates commands at this layer.

RBAC (Role-Based Access Control) — Authorization based on a user's assigned role.

Shadow AI — Use of AI tools within an organization that is unmanaged, unaudited, or unknown to the security team.

Shannon entropy — A measure of randomness/information density in a string, used as a statistical signal that a value may be a secret or key.

SIEM (Security Information and Event Management) — A centralized system for collecting and analyzing security events; this product exports to one via direct push.

strict_fallback — This product's fail-closed runtime mode, entered when policy integrity or a required health check cannot be established.

TOCTOU (Time-of-Check to Time-of-Use) — A race condition where the state checked by a security control differs from the state at the moment the control's decision is acted upon.

Zero-knowledge (telemetry) — The property that raw sensitive content never leaves the workstation; outbound telemetry carries only hashes, lengths, and classifications.

Return to Executive Technical Overview.