Glossary

Terms

Action proposal

A request by an AI system to take an action, made before the action has any effect.

Admission

In the control gap record, a fact stated by the organization itself, for example in a filing, a public statement, or a settlement. It is one of the kinds of evidence that each entry names for each gap. See the kinds of evidence.

Admit

In ECL-1, the decision that permits the exact action requested, under the stated policy and obligations. The architecture page calls this decision a permit.

AI hazard

In the OECD’s definition, an event, circumstance, or series of events in which the development, use, or malfunction of an AI system could plausibly lead to an AI incident. The control gap record follows the OECD definition and counts hazards separately from incidents. See what goes into the record.

AI incident

In the OECD definition, an event in which the development, use, or malfunction of an AI system directly or indirectly leads to harm to people, critical infrastructure, rights, property, communities, or the environment.

Authority

A person or role given the power, in a recorded delegation, to permit a class of actions or to decide actions that are on hold.

Automation bias

The tendency to rely, or over-rely, on an automated system’s output without enough scrutiny. Article 14(4)(b) of the EU AI Act requires that the people assigned to oversee a high-risk AI system be enabled to remain aware of it.

Autonomous action

In AARM, a decision by an AI system that produces a real-world consequence without continuous human intervention, such as an API call, a file write, a shell command, or a network request. AARM distinguishes it from advisory or informational output. See AARM.

Challenge

In ECL-1, a decision that evaluation cannot finish until specified evidence or input is supplied. A challenge names the evidence needed, a deadline, and what happens if the deadline passes.

Claim boundary

The part of a system that a conformance claim covers. In ECL-1, the claim class states whether a claim covers all reachable consequential actions of the system of interest, only named action classes, or one component or profile.

Complete mediation

The principle that every access to a protected resource is checked (Saltzer and Schroeder, 1975). In an external control layer, this means that every action with effects outside the AI system passes through the layer. See P1.

Consequential action

An action that changes state outside the AI system, discloses data, produces effects in other systems or the physical world, expands the system’s own authority, or invokes an external service at material cost.

Consequential Action Register

In ECL-1, the part of a claim that lists each action class in scope and classifies it as consequential or non-consequential, with the rationale, the resources, identities, and data it affects, its enforcement class, and any human-approval threshold. It also declares the inputs that decisions on each class may use, with the class of each under the one-way rule, and the largest effect each class could cause in an hour and in a day.

Control gap

A missing or ineffective control that let an automated system’s action go through. The control gap classification defines 13, from G1 to G13, in four groups.

Control plane

The infrastructure that makes and enforces decisions about actions, kept separate from the system being controlled.

Decision record

See receipt.

Default admission

The unstated assumption that a capable system may act unless someone stops it in time. See the problem.

Deny

A decision that stops a proposed action from taking effect.

Drift

Gradual change, over a sequence of actions, in a system’s behavior or in how policy is applied to it.

Evidence

The typed inputs a decision relies on, such as identity, system state, sensor readings, approvals, and documents. In ECL-1 these are decision inputs, and the signed record of each mediated action is its evidence bundle.

External control layer

Infrastructure outside an AI system that decides whether an action proposed by the system may take effect outside it. The layer records each decision in a form that others can verify.

Fail-closed

A mode in which missing proof, an integrity failure, an ambiguous policy, or uncertain enforcement stops the action instead of letting it through. In ECL-1 the result is denial, restricted mode, or halt, and a timeout applies the safe-state rule declared for the action class. See P3.

Fail-open

A mode in which an action goes ahead when the check cannot give a decision. The Agent Control Standard works this way by default, so that production does not stop when the Guardian cannot be reached, and it requires each such step to be recorded. See OWASP ACS.

Guardian agent

In the Agent Control Standard, the separate component that receives each hooked step from the agent and decides to allow, deny, modify, ask about, or defer it.

Hard and soft enforcement

In ECL-1, hard enforcement relies on an independent trust boundary that is materially harder to compromise than the AI system, such as a trusted execution environment or an out-of-band gateway. Soft enforcement runs in a layer of the host platform that the AI system cannot modify, disable, or bypass but that shares the platform’s trust root, such as the operating system or a gateway. The register records the reason and the residual risk for each action class that uses it. A component that the AI system can rewrite, disable, or bypass is an enforcement point of neither kind.

Hold

A decision that suspends an action until a person with authority permits or denies it.

Independence class

In ECL-1, one of three classes that state where control approval and evidence verification take place. Class A is separation under the same operator, Class B places both functions in a separately administered trust domain, and Class C adds an externally independent authority that holds both. Assessor independence is set separately for each level.

Mandate

In agent payment protocols such as AP2, a signed credential that records either the limits a user set in advance or the exact checkout they approved.

Near miss

An action that was set in motion and would have caused harm, where the harm was avoided by chance or late intervention. The OECD counts near misses as AI hazards; the control gap record labels them separately and marks the gaps that would have let the action go through.

Negative Boundary Annex

In ECL-1, the part of a claim that discloses the effect paths the claim does not cover. An undisclosed effect path makes a claim invalid.

Out-of-band confirmation

Confirmation through a different channel from the one the request came through, such as a call to a number already on file for a request made in chat.

Out-of-process control

Control decisions made by infrastructure that shares no process, state, identity, or credentials with the controlled system, the form of independence described on the architecture page. ECL-1 states its requirement as architectural independence: no single credential, role, privilege domain, or trust root may suffice to change both the AI system’s behavior and the control outcome.

Permit

A decision that lets a proposed action take effect.

Point of effect

The point at which an action takes effect, such as an API with write access, a payment rail, a record system, or a machine controller. Also called the actuator boundary.

Precedent

In the control gap record, an incident involving conventional automation rather than AI, included because the controls that failed are of the same kind, and counted separately from AI incidents.

Receipt

A signed record of one decision that binds the proposal, the policy version, the evidence, the decision, the authority, and the time, and names the record before it by digest. The procurement clauses call it a decision record. In ECL-1 the decision is a DCMP-2 decision response, recorded as an EBMP-2 decision event in the evidence bundle for the action.

Reference monitor

A mechanism that mediates every access, is tamperproof, and is small enough to be analyzed and tested (Anderson, 1972). See also NIST SP 800-53, control AC-25.

Register

The list of actions an AI system can take that have effects outside it, each with the rule that applies. See clause C-1.

Safe state

The defined condition a system stays in, or moves to, when an action is denied or control is lost.

Self-reported record

An account of what a system did that comes only from the system itself or from the party that ran it. The control gap record marks G13 when such an account was the only one available and was wrong or incomplete.

Shadow mode

A mode in which the layer decides and records without blocking anything, so that rules can be tuned before they are enforced.

Signer independence

The principle, set out on the architecture page, that no party issues, validates, and consumes its own attestation, so that the party that makes a claim, the party that checks it, and the party that relies on it are different. See P6. ECL-1 does not use the term, but it separates the issuing of authority from its use and the generation of evidence from its verification, and lets no signing key sign for more than one role.

Split purchase

One purchase broken into several smaller ones that each fall under an approval limit, a pattern that sequence rules catch. See P8.

Step-up authentication

An additional check of a person’s identity before a higher-risk action, such as a biometric confirmation in a banking app.

System of interest

The system that a claim or an assessment describes, with its boundary stated.

Tamper-evident

Built so that any modification, deletion, or reordering can be detected.

Trigger

In the control gap record, what started an incident, such as a model error or a manipulated input. It is recorded separately from the gaps, so that the same gap can be counted across different causes. See other fields in each entry.