AI security product pages use shorthand that hides what is being sold. This glossary defines twelve common terms in plain words, with the question each one should prompt when you see it on a vendor page. Keep it next to your evaluation notes.
The twelve terms
| Term | Plain meaning | Question to ask |
|---|---|---|
| Agent | Software that uses a model to decide steps and calls tools | What tools can it call? |
| Tool | A function an agent can invoke, such as search or file write | What does it change? |
| MCP | Model Context Protocol, a standard way for models to use tools and data | Client or server, and which transport? |
| Prompt injection | Input that changes model behaviour in ways not intended | Where does untrusted text enter? |
| Excessive agency | A system doing damaging things because it has too much functionality, permission or autonomy | Which of the three is the problem? |
| Guardrail | A control that limits what an agent or model can do | Does it block or only advise? |
| Gate | A check that must pass before a change moves forward | What happens on failure? |
| Policy | A written rule a tool can enforce | Can it be exported? |
| Agent identity | A distinct credential for each agent | Can it be revoked alone? |
| Tool poisoning | Malicious instructions hidden in a tool's description or output | Are tool changes surfaced? |
| SBOM | A list of the components in software | Does it include model files and AI libraries? |
| Human in the loop | A person can approve or deny an action | What does the approver see? |
Notes on a few terms
Excessive agency. OWASP defines it as a vulnerability that lets a model-based system take damaging actions in response to unexpected, ambiguous or manipulated output. Its three root causes are excessive functionality, excessive permissions and excessive autonomy.
Human in the loop. The MCP specification says there should always be a human in the loop with the ability to deny tool invocations, and that applications should show which tools are exposed and when they are invoked.
Guardrail and gate. People use these loosely. A useful split: a guardrail limits behaviour during operation, while a gate stops a change from moving to the next stage. See the longer gate versus guardrail comparison.
Prompt injection. It is the first entry in the OWASP Top 10 for LLM Applications 2025, which describes user inputs altering model behaviour in unintended ways.
Reading a page with the glossary
Pick any product page and underline each term. For every one, write the question from the table beside it. If you cannot find the answer on the page or in the docs, add it to your vendor question list. The terms with the largest gap between meaning and marketing are usually guardrail and human in the loop, because both can describe very different things.
Add your own
Your team will invent terms too. Keep a short shared document and agree meanings, so a meeting that says "approved agent" means the same thing to everyone.
Quick check
Is an agent the same as a chatbot?
No. A chatbot answers. An agent can also decide steps and take actions through tools.
Is MCP a security product?
No. It is a protocol. Security depends on how it is implemented and controlled.
Safeguard covers several of these as GA capabilities, including guardrails, gates, agent identity and SBOM scanning, and the free scan is an easy way to see an SBOM.
Sources
- OWASP, LLM06:2025 Excessive Agency
- OWASP, Top 10 for LLM Applications 2025
- Model Context Protocol, Tools specification
Last reviewed: 19 October 2026.
