Tauseef FayyazA to Z
Glossary
Every concept in this sheet, plus the smaller terms it uses. Select a concept to open its card.
A
- Agent loop
- A loop where the model asks for a tool call, code runs it, the result returns to the context, and the model decides again.
- Authentication and authorisation
- Authentication checks who someone is; authorisation checks what they may do.
C
- Classic web weaknesses in AI apps
- Injection, cross-site scripting and broken access control, now often arriving through model output instead of a form field.
- Context assembly
- The text an app builds for the model: system prompt, history, retrieved documents, tool descriptions and results, and the user's message.
D
- Defence in depth
- Stacking independent controls so one failure does not become a breach: identity, scoped data, narrow tools, encoding, guards, limits, logs and a kill switch.
I
- Instructions and data in one channel
- A model reads instructions and data as the same stream of text and decides by probability which parts to follow.
L
- Least privilege
- Each person, service, agent and tool gets only the access its job needs, for only as long as it needs it.
- Lethal trifecta
- Simon Willison's name for three capabilities that together let an injection steal data: private data, untrusted content and a way to communicate out.
N
- Non-determinism
- The same input can give different outputs across runs and model versions.
P
- Practice target app
- A small LLM app you own: a local or spend-capped model, a system prompt, retrieval over your own documents and two harmless tools.
R
- Retrieval permissions
- Filtering retrieval by who is asking, in the query itself, and controlling who can write to indexed sources.
- Rules of engagement
- Written permission and scope for a test: which systems, methods, harm types, rates, cost limits, data handling, times and escalation contacts.
S
- Secrets management
- Keeping keys, passwords and tokens in a secrets manager or server-side environment, narrowly scoped, rotated and out of code, prompts and logs.
- Server-side request forgery
- Tricking a server into fetching an address the attacker chooses, such as an internal service or a cloud metadata endpoint.
T
- Threat modelling (four questions)
- A structured way to find risks early by answering four questions: what are we working on, what can go wrong, what are we going to do about it, and did we do a good job?
- Trust boundary
- A line where data or control passes between parts that deserve different trust, such as the internet and your server.