Glossary

ARGUS lease

Authority that must keep being re-proven; agents cannot self-renew.

Action boundary

The single point every consequential agent action must cross before it executes.

Blast radius

Everything a compromised entity could reach and affect.

Byzantine fault

A replica that may crash, lie or send conflicting messages.

Canonical JSON (RFC 8785)

A deterministic JSON serialisation so the same data hashes identically everywhere.

Capability token

A signed, short-lived (30 s default), single-use permission for one action.

EU AI Act

Regulation (EU) 2024/1689; high-risk duties include record-keeping, transparency, oversight, robustness.

Ed25519

A digital signature scheme used for CAIN evidence records.

Execution channel

Tool calls, shell commands, database writes, payments and messages an agent performs.

Fact layers

OBSERVED, VERIFIED, DERIVED, UNVERIFIED, COUNTERFACTUAL.

Fail-closed

UNKNOWN and ERROR never become ALLOW; doubt is a refusal.

Hash chain

Records whose hashes each cover the previous hash, so an edit breaks every later link.

ISO/IEC 42001

AI management system standard; organisations are certified against it.

Inclusion proof

Sibling hashes from a leaf to the root, about log2(n) of them.

Key pinning

Requiring an expected public key obtained out of band, defeating key-swap forgeries.

Memory poisoning

A planted instruction in agent memory that steers later tasks.

Merkle tree

A tree of hashes up to one root; RFC 6962 prefixes leaves with 0x00 and nodes with 0x01.

Monotonic attenuation

Delegated authority can stay the same or shrink, never grow.

NIST AI RMF

Risk framework with four functions: Govern, Map, Measure, Manage.

NOT_ASSESSED

Fail-closed insurance result when there is no evidence to score.

OWASP Agentic Top 10

OWASP's 2026 list of the most critical risks for agentic applications.

PBFT

Practical Byzantine Fault Tolerance: pre-prepare, prepare, commit; N = 3f + 1, quorum 2f + 1.

Quorum certificate

2f + 1 signed votes on the same digest; verifiable offline.

REQUIRE_APPROVAL

A verdict that pauses an action until a person decides.

SHA-256

A cryptographic hash producing a 32-byte digest; the same input always gives the same output.

Salami attack

Many small actions under per-action limits that add up to large harm.

Tombstone

A deletion record that erases content but keeps the chain verifiable.

Tool poisoning

Hidden instructions in an MCP tool's description.

Tool shadowing

A malicious server's description steering how the agent uses another tool.

Trust decay

Trust not refreshed by evidence falls with a half-life: T(t) = T0·2^(−Δt/half-life).

UNSAT

Solver result meaning no counterexample exists: the property is proven.

WORM

Write once, read many: append-only evidence storage.