« Track Overview

Glossary — Enterprise AI & Agentic Platform

Every term used anywhere in this track, defined so that no entry depends on a term you have not already met. Entries are grouped by layer; within a group they build on each other. Where a term is easy to confuse with a neighbour, the entry says so explicitly.

Table of Contents

Platform shape & operating model

AI & Agentic Platform — the shared substrate on which many teams build and run agents: runtime, model access, tools, knowledge, identity, policy, observability, and the operational model around them. Contrast with an agent application, which is one product built on top.

Five-layer stack — this platform's reference architecture: Users & Channels → Control Plane → Agent Kernel + Knowledge Foundation → Action Gateway → bank estate. Each layer owns one class of decision; the layering exists so that a bad action can be stopped at a layer that does not trust the layer above it.

Control plane / data plane — the control plane holds policy, configuration and identity and changes slowly; the data plane serves requests and changes per request. The classic platform failure is a control-plane outage taking the data plane down with it; the fix is cached, fail-static policy in the data plane.

Platform primitive — a capability the platform offers as a contract (a tool, a model route, a retrieval index, a policy, a trace). Teams compose primitives; they do not fork them.

Tenant — an isolation unit. Here, a business function (Wholesale, Retail, Group Risk) or a product team. Everything the platform meters, isolates, or attributes is per-tenant.

Noisy neighbour — one tenant's load degrading another's. Prevented with per-tenant quotas, fair-share scheduling, and bulkheads, never with "please be reasonable."

Blast radius — the set of consumers affected when a component fails. A principal-level design states the blast radius of every dependency before discussing its happy path.

Two-in-a-box — an operating model where two owners (here: senior engineer + product owner) hold joint, non-divided accountability for the same surface: shared on-call, shared roadmap, shared architectural decisions. Distinct from a manager/tech-lead split, where accountability is partitioned.

Operational Readiness Review (ORR) — a gate before a service (or an agent) may run in production: SLOs defined, runbooks written, alerts tested, rollback rehearsed, dependencies mapped, on-call trained. See Phase 16.

Architecture Decision Record (ADR) — a short, immutable document capturing one decision: the context, the options, the choice, and the consequences. The unit of architectural memory.

Golden path — the opinionated, supported way to do a common thing on the platform. The platform's job is to make the golden path the easiest path, not the only one.

The agent kernel

Agent — a system that, given a goal, repeatedly (a) asks a model what to do next, (b) executes the proposed action against a tool, and (c) feeds the result back, until it stops. Everything hard about agents comes from the fact that step (a) is probabilistic and step (b) has real-world effects.

Agent kernel — the runtime that hosts agents: lifecycle management, the reasoning loop, memory, state, sessions, execution chains. The "kernel" analogy is deliberate — like an OS kernel, it mediates between an untrusted program (the model's plan) and privileged resources (tools, data, money).

Reasoning / planning loop — the shape of step (a)→(c). Variants: ReAct (interleave reason and act, one step at a time), ReWOO (plan all steps up front, then execute, then solve), plan-execute-replan (plan, execute, revise the plan on surprise).

Step budget / max_steps — the hard cap on loop iterations. Without it a confused agent loops forever and bills you for it. The cap is a platform concern, not an agent-author concern.

Scratchpad — the accumulating record of thought/action/observation that is fed back to the model each turn. Its growth is the dominant cost driver in a long agent run.

Short-term memory — the working context for the current task: the scratchpad, the last N turns. Bounded, volatile, cheap.

Long-term memory — durable facts about a user or domain that persist across sessions ("this relationship manager covers portfolio X"). Usually a store plus a retrieval step.

Episodic memory — memory of what happened: prior task episodes, their outcomes, and what was learned. Distinguished from long-term semantic memory (facts) by being indexed by event.

Session — a conversational or task-scoped container with an identity, a state, and a lifetime. The platform's unit of continuity.

Session affinity (sticky sessions) — routing a session's requests back to the replica that holds its in-memory state. Cheap and fast; it also makes deploys and failures harder, which is why the mature answer is externalized state with affinity as an optimization, not a requirement.

Execution chain — the ordered record of steps an agent actually performed, with inputs, outputs, identities, and timings. It is simultaneously the debugging artifact and the audit artifact.

Checkpoint — a persisted snapshot of agent state from which execution can resume. Makes a crash survivable and a human-in-the-loop pause possible.

Context engineering — deciding what goes into the model's context window and in what order: instructions, tool schemas, retrieved chunks, memory, history. It is the highest-leverage and least-glamorous knob in the whole platform.

Protocols: MCP, A2A, ACP

Model Context Protocol (MCP) — an open protocol standardizing how an application exposes tools, resources, and prompts to a model-driven client. JSON-RPC 2.0 over stdio or streamable HTTP. It solves the agent-to-tool problem: one integration surface instead of N bespoke ones.

MCP host / client / server — the host is the application (the agent runtime); it creates one client per connection; each client talks to one server, which owns some tools. One host, many clients, many servers.

Tool (MCP) — a named, schema-described, model-invocable function. Defined by a name, a description (the model reads it — it is prompt surface), and a JSON Schema for its input.

Resource (MCP) — read-only context a server can expose by URI (a document, a record). Not invoked; read. Application-controlled rather than model-controlled.

Prompt (MCP) — a reusable, parameterized prompt template a server offers, typically user-selected.

Capability negotiation — the initialization handshake in which client and server declare what they support (tools, resources, sampling, subscriptions). It is what makes version skew survivable.

tools/list, tools/call, notifications/tools/list_changed — the core MCP tool methods: discover the tool set, invoke one, be told the set changed.

Elicitation / sampling (MCP) — server-initiated requests back to the client: ask the user for input (elicitation), or ask the client's model for a completion (sampling). Both invert the usual direction and both are security-relevant.

Agent-to-Agent (A2A) — an open protocol for agents to discover, delegate to, and coordinate with other agents across organizational and vendor boundaries. Where MCP answers "what tools do I have," A2A answers "who else can do this, and how do I hand it to them."

Agent Card — A2A's discovery document: a JSON description of an agent's identity, skills, endpoints, supported modalities, and authentication requirements. The A2A analogue of an OpenAPI document plus a capability manifest.

A2A task — the unit of delegated work, with an explicit lifecycle: submitted → working → (input-required) → completed | failed | canceled. Long-running by design.

Message / Part / Artifact (A2A) — a message is one turn of communication; it contains parts (text, file, structured data); an artifact is a durable output the task produced.

Agent Communication Protocol (ACP) — a REST-shaped protocol for agent interoperability with multipart messages and both synchronous and asynchronous execution, developed under the Linux Foundation umbrella alongside A2A. Treat it in design as a sibling envelope format: the platform's internal representation should be protocol-agnostic and adapters should translate.

Agent fabric — a hyperscaler's managed agent runtime plus its discovery/registry surface (Azure AI Foundry Agent Service, AWS Bedrock Agents/AgentCore, Google ADK + Agent Engine). A bank platform must interoperate with, not be captured by, these.

Protocol-agnostic core — the design rule that follows: the agent kernel speaks an internal model (task, message, part, artifact, identity); MCP/A2A/ACP are edge adapters. Otherwise every protocol revision is a kernel rewrite.

Model layer: gateway, routing, capacity

LLM gateway (AI gateway) — a single ingress in front of all model providers that owns authentication, routing, retries, caching, rate limiting, metering, and policy. It is the platform's choke point, in the good sense: one place to enforce, one place to observe, one place to change providers.

Model abstraction layer — the normalized request/response schema the gateway exposes so callers do not encode provider quirks. Its hardest job is not the happy path; it is normalizing errors, finish reasons, tool-call formats, and token accounting.

Routing policy — the rule that maps a request to a model/deployment: by capability, cost, latency, tenant, data classification, or sovereignty. Static tables, weighted splits, and learned routers are all "routing policy."

Fallback chain — an ordered list of alternates tried when the primary fails. Its two hard parts are budget (the fallback must fit inside the caller's latency budget) and idempotency (a retried tool-executing request can double-execute).

Semantic cache — a cache keyed by embedding similarity of the prompt rather than exact bytes. Enormous cost lever, and a correctness hazard: near-duplicate prompts with different intent collide. Always tenant-scoped, always with a similarity floor.

Prompt cache / prefix cache — provider-side reuse of the KV-cache for a shared prompt prefix, billed at a discount. Rewards putting stable content (system prompt, tool schemas) first and volatile content last.

Token accounting — attributing input/output/cached tokens to a tenant, agent, user, and request, at the gateway. Without it there is no cost attribution, no quota, and no chargeback.

Cost attribution / showback / chargeback — reporting spend by tenant (showback) or actually billing it (chargeback). The behavioral difference is enormous.

Rate limit vs quota — a rate limit bounds requests per unit time (protects the system); a quota bounds consumption per period (protects the budget). Different windows, different enforcement points, different error codes.

Token bucket — the standard rate-limiting algorithm: a bucket of capacity C refills at r tokens/second; a request costs k tokens and is admitted if the bucket holds k. Allows bursts up to C while bounding the long-run rate at r.

Provisioned Throughput Unit (PTU) — Azure OpenAI's unit of dedicated model capacity, purchased in advance, providing predictable latency and throughput independent of shared-pool congestion. AWS Bedrock's analogue is Provisioned Throughput (model units). The engineering question is always the break-even utilization against pay-as-you-go.

Pay-as-you-go (PAYG) / on-demand — per-token billing on shared capacity. Cheap at low utilization, variable in latency, subject to provider-side throttling (HTTP 429).

Spillover — routing overflow traffic from exhausted dedicated capacity to PAYG so the platform degrades in cost rather than in availability.

Time to first token (TTFT) — latency from request to first output token; dominated by prefill (processing the input). The number a chat UI feels.

Inter-token latency (ITL) / time per output token (TPOT) — the steady-state gap between output tokens; dominated by decode, which is memory-bandwidth-bound.

Prefill vs decode — prefill processes all input tokens in parallel (compute-bound); decode generates one token at a time (memory-bound). Their different bottlenecks drive every serving decision, including why batching helps decode far more than prefill.

KV cache — the stored key/value tensors for already-processed tokens, so each new token attends to history without recomputing it. Its size grows linearly with sequence length × batch size, and it is the binding constraint on concurrency in self-hosted serving.

Continuous (in-flight) batching — admitting and retiring requests from a running batch every decode step instead of waiting for a whole batch to finish. The single biggest throughput win in modern LLM serving (vLLM, TGI).

PagedAttention — vLLM's technique of storing the KV cache in fixed-size non-contiguous blocks (like OS virtual-memory pages), largely eliminating fragmentation and enabling prefix sharing.

vLLM / TGI / Triton — self-hosted serving stacks. vLLM (PagedAttention, continuous batching), Hugging Face TGI (Text Generation Inference), NVIDIA Triton Inference Server (multi- framework serving; often fronting TensorRT-LLM).

Open-weight model — a model whose weights you can download and run yourself. The sovereignty/compliance answer when data may not leave a boundary — at the cost of owning GPUs, scaling, and evaluation.

Sovereignty (data / AI) — the requirement that data (and often inference) remain within a legal jurisdiction and under specified operational control. Drives region pinning, self-hosting, and contractual controls on provider processing.

Knowledge foundation

Retrieval-Augmented Generation (RAG) — retrieve relevant context, put it in the prompt, generate a grounded answer. The default fix for staleness and hallucination; not a fix for authorization (see retrieval leakage).

Chunking — splitting documents into retrievable units. The dominant quality lever in RAG and the one most teams under-invest in. Structure-aware beats fixed-size; overlap trades index size for boundary recall.

Embedding — a vector representation of text such that semantically similar text is geometrically close. Embedding strategy = which model, what dimensionality, what normalization, and what you do when you need to change it (the re-embedding migration).

Vector store — an index supporting approximate nearest-neighbour search over embeddings. Candidates in this JD: pgvector (Postgres extension), Azure AI Search, Pinecone, Weaviate, Qdrant.

ANN (approximate nearest neighbour) — sublinear similarity search accepting imperfect recall. HNSW (hierarchical navigable small world graphs) and IVF-PQ (inverted file with product quantization) are the two families you will be asked to compare.

Topology (vector store) — how indexes are physically arranged across tenants and domains: one index per tenant (silo), one shared index with a tenant filter or namespace (pool), or a hybrid (bridge). Determines isolation strength, cost, and the filtering cliff.

Filtering cliff — the recall collapse that happens when a highly selective metadata filter is applied after ANN search: the graph returns 100 neighbours, the filter keeps 2. Fixed with pre-filtering, partitioned indexes, or namespaces.

BM25 — the classical lexical ranking function (a refined TF-IDF with document-length normalization). Complementary to dense retrieval: exact identifiers, rare terms, and product codes are BM25's strength and embeddings' weakness.

Hybrid retrieval — running lexical and dense (and sometimes graph) retrieval and merging.

Reciprocal Rank Fusion (RRF) — the standard score-free merge: an item's fused score is \( \sum_i 1/(k + \mathrm{rank}_i) \), typically \( k = 60 \). Score-free means you never have to calibrate incomparable scoring scales.

Reranking / cross-encoder — a second-stage model that scores (query, document) jointly rather than embedding them independently. Much more accurate, much more expensive; run over the top-k only.

Grounding — constraining the answer to the retrieved evidence, and being able to point at which span supports which claim. Contextual grounding checks score an answer for faithfulness to sources and relevance to the query.

Citation / attribution — emitting the source spans behind an answer. In a bank this is not a UX nicety; it is the evidence trail.

Retrieval leakage — the #1 multi-tenant AI data breach: a shared index returns the nearest chunk regardless of who owns it. Retrieval must be authorized, not just relevant.

Freshness / staleness — the lag between a source changing and the index reflecting it, and the platform's contract about it. Every knowledge product needs a stated freshness SLO.

Knowledge graphs & ontology

Knowledge graph — data modelled as entities and typed relationships, queryable as a graph. Complements vectors: vectors find similar text; graphs answer structural questions ("which counterparties are ultimately owned by X").

RDF (Resource Description Framework) — the W3C data model where everything is a triple: (subject, predicate, object). Subjects and predicates are IRIs; objects are IRIs or literals.

IRI / URI / CURIE — the global identifier for a resource; a CURIE is its compact form (fibo-fnd:hasLegalName for a long IRI with a declared prefix).

Triple store — a database of triples with SPARQL query support. Apache Jena and Neo4j (via n10s, or as a labelled property graph) are the two named in the JD.

Labelled property graph (LPG) — Neo4j's native model: nodes and relationships with key/value properties. Easier to write, weaker at formal semantics than RDF. Knowing when each fits is the interview question.

RDFS / OWL — schema and ontology languages layered on RDF. RDFS gives classes, properties, subClassOf, domain, range. OWL 2 adds richer semantics: inverse, transitive and symmetric properties, cardinality, disjointness, equivalence.

Entailment / inference / reasoning — deriving triples not explicitly stated. If :Acme a :Bank and :Bank rdfs:subClassOf :FinancialInstitution, then :Acme a :FinancialInstitution is entailed.

Open-world assumption (OWA) — in OWL, what is not stated is unknown, not false. This is why OWL cannot validate data ("this record is missing an LEI" is not an OWL error) — which is exactly why SHACL exists.

SHACL (Shapes Constraint Language) — the W3C language for validating RDF against shapes: required properties, datatypes, cardinality, value ranges, patterns. Closed-world validation for an open-world model. Produces a validation report of violations.

SPARQL — the W3C query language for RDF. Its core is the basic graph pattern (BGP): a set of triple patterns with variables, solved by matching and joining bindings.

FIBO (Financial Industry Business Ontology) — the EDM Council's OWL ontology of financial concepts: legal entities, contracts, instruments, agreements, ownership and control. The bank's lingua franca for what a "counterparty" or "obligation" actually is.

GraphRAG / graph-grounded retrieval — using graph structure to select or expand retrieval context (neighbourhood expansion, path-constrained retrieval, community summaries), rather than similarity alone.

Ontology governance — who may extend the ontology, how versions are released, and how downstream queries survive change. An ontology without governance becomes a second, worse schema.

Identity & access

Authentication (AuthN) vs authorization (AuthZ) — AuthN answers who is this; AuthZ answers may they do this. Different failure modes; conflating them is a classic breach.

Principal — the verified identity a decision is made about: a human, a workload, or an agent.

Non-human identity (NHI) — any identity that is not a person: service accounts, workloads, bots, and now agents. NHIs already outnumber human identities in most enterprises by a large multiple, and they are typically over-privileged, long-lived, and unmanaged — which is why this JD calls them out.

Workload identity — an identity issued to a running workload based on its verified platform attributes (which cluster, which namespace, which service account), rather than a shared secret.

SPIFFE / SPIRE — SPIFFE is the standard (SPIFFE ID: spiffe://trust-domain/path; SVID: the credential carrying it, as X.509 or JWT); SPIRE is the reference implementation that attests workloads and issues short-lived SVIDs. Secret-less identity, by construction.

Trust domain — the boundary within which SVIDs are issued by one authority. Cross-domain trust is explicit federation, not a default.

Agent identity — an identity for an agent as an actor, distinct from the user it serves and from the workload it runs on. Requires a lifecycle (register → approve → issue → rotate → suspend → retire) and an owner.

Blended (user + agent) identity — the composite principal for a delegated action: "agent A, acting on behalf of user U." Both must appear in the token, the policy decision, and the audit record, because both constrain what is allowed.

Delegation vs impersonation — in delegation the resulting token records both the agent and the user (the chain is visible); in impersonation the agent simply becomes the user (the chain is erased). Regulated environments want delegation.

Identity propagation chain — the ordered record of principals a request passed through (user → agent A → agent B → tool). Bounded in depth, verified at each hop, and carried in the token so the last hop can enforce on it.

Confused deputy — the attack where a privileged intermediary is tricked into using its own authority on an attacker's behalf. The canonical agent-platform risk: an agent with broad tool access acting on instructions injected into a document.

OAuth 2.0 / OAuth 2.1 — the delegated-authorization framework and its consolidating revision (PKCE required for all clients, implicit and password grants removed, exact redirect-URI matching, refresh-token rotation or sender-constraint).

OIDC (OpenID Connect) — the identity layer on top of OAuth 2.0. Adds the ID token (a JWT about who the user is, for the client) as distinct from the access token (for the API).

JWT / JWS / claims — a JSON Web Token is header.payload.signature, signed (JWS). Key claims: iss (issuer), sub (subject), aud (audience), exp/nbf/iat (validity), scope, azp, act (actor — the delegation chain), cnf (confirmation — proof-of-possession binding).

Audience (aud) — who the token is for. Accepting a token whose audience is another service is a textbook vulnerability; every resource server must validate it.

Scope vs permission vs entitlement — scope is what the client asked for; permission is what the identity holds; the effective entitlement is their intersection, further narrowed by policy. Agents should be granted the task's scope, not the user's scope.

Client credentials grant — machine-to-machine OAuth with no user. Simple, and the wrong default for agents acting for users, because it erases the user from the chain.

Authorization code + PKCE — the interactive flow; PKCE (RFC 7636) binds the code to the client that requested it via a code_verifier/code_challenge pair, defeating code interception. Mandatory in OAuth 2.1.

Token exchange (RFC 8693) — the standard mechanism to trade one token for another with a different audience, scope, or actor, recording delegation in the act claim. The backbone of multi-hop agent identity.

On-behalf-of (OBO) — Microsoft Entra's flow implementing the same idea for a middle-tier service calling a downstream API with the user's identity.

Just-in-time (JIT) credential — a credential minted at the moment of use, for a narrow audience and a short lifetime (seconds to minutes), and never stored. Replaces the long-lived secret.

Sender-constrained / proof-of-possession token — a token usable only by the party that holds a key: mTLS-bound (RFC 8705) or DPoP. Defeats simple token theft, because stealing the bearer string is not enough.

mTLS (mutual TLS) — both sides present certificates. In an agent mesh it gives per-workload authentication and encryption without any shared secret.

Secret-less architecture — no long-lived secrets in code, config, or images; every credential is derived from a verified platform identity at runtime (managed identity, SVID, federated credential).

Microsoft Entra ID — Microsoft's enterprise identity platform (formerly Azure AD): the bank's authoritative issuer for humans and workloads. Managed identity and workload identity federation are its secret-less mechanisms.

PAM (Privileged Access Management) — the system that brokers, records, and time-bounds privileged access. Agents that touch privileged systems must go through it, not around it.

Least privilege / just-enough access — grant only what the current task needs, for only as long as it needs it. For agents this means per-task scoping, not per-agent scoping.

Policy, control plane & zero trust

Zero trust — never trust based on network position; authenticate and authorize every request, continuously, with least privilege, assuming breach.

Continuous authorization — re-evaluating the authorization decision during a long-running session or task, not only at the start. Necessary because agent tasks live for minutes to hours while risk signals change.

Know Your Agent (KYA) — by analogy to KYC: the discipline of knowing, for every agent in production, who owns it, what it may do, what data it may touch, what model it uses, what it has been evaluated against, and what its current posture is. Enforced at runtime, not just at onboarding.

Agent registry — the authoritative inventory of agents: identity, owner, version, permitted tools, data classifications, evaluation status, environment. The KYA database.

Tool registry — the authoritative inventory of tools: schema, version, owner, side-effect class, required scopes, data classification, rate limits, and approval requirements.

Capability discovery — how an agent finds out what it may use right now: the registry filtered by policy for this agent, this user, this tenant, this context. Discovery must be authorization-aware, or you leak the existence of capabilities.

Policy Decision Point / Policy Enforcement Point (PDP/PEP) — the PDP decides (a policy engine); the PEP enforces (the gateway). Separating them lets one policy govern many enforcement points.

Policy-as-code — policy expressed in a versioned, testable language rather than a console. OPA/Rego (general-purpose), Cedar (AWS's authorization language), Azure Policy (ARM resource governance), Kyverno (Kubernetes-native).

Deny-overrides / default-deny — combining algorithms. Default-deny: no matching rule means denied. Deny-overrides: any deny beats any allow. The only safe defaults in a bank.

ABAC / RBAC / ReBAC — authorization by attributes (subject/resource/action/environment), by roles, or by relationships (Zanzibar-style graph). Agent platforms usually need ABAC with a relationship component.

Posture check — a runtime signal about the state of an identity or workload (evaluation freshness, anomaly score, patch level, recent behaviour) fed into the policy decision.

Evaluation pipeline — the automated harness that scores an agent against golden sets, trajectories, safety suites, and regressions, gating promotion. RAGAS, Opik, LangSmith, Promptfoo are named tools in the JD.

Trace / span / lineage — a trace is one request's causal tree; a span is one unit of work inside it; lineage is the record of which data and which model produced which output. "Tracing at agent and tool granularity" means each agent step and each tool call is its own span with identity attached.

Action gateway & transactional safety

Action gateway — the mediation layer every agent-initiated action must pass through before it reaches a bank system. It is a policy enforcement point with transactional responsibilities.

Contract enforcement — validating a proposed call against the tool's declared schema and semantics before dispatch: types, ranges, enumerations, required fields, and business invariants (currency matches account, amount within limit).

Side-effect class — the classification every tool carries: read (safe), write-idempotent (safe to retry), write-non-idempotent (money moves; must not be retried blindly), irreversible (cannot be compensated). Retry, approval, and audit policy all key off it.

Idempotency key — a caller-supplied unique key for a mutating operation. The server stores key → (status, response) and returns the stored response on replay, so a retry cannot double-execute. The single most important primitive in the action gateway.

Exactly-once effects — the achievable goal (as opposed to exactly-once delivery, which is not achievable in a distributed system): at-least-once delivery plus idempotent handling produces one effect.

Saga — a long-lived transaction expressed as a sequence of local transactions, each with a compensating action to undo it. The distributed-transaction pattern for systems that cannot hold a two-phase-commit lock (i.e., all of them).

Compensation — the semantic inverse of a step (refund, reverse, cancel), which is not a rollback: the intermediate state was visible.

Circuit breaker — a wrapper that stops calling a failing dependency (open), periodically probes it (half-open), and resumes when healthy (closed). Protects the dependency from retry storms and the caller from tail latency.

Bulkhead — isolating resource pools per dependency or tenant so one saturating dependency cannot exhaust shared threads/connections.

Dual control / four-eyes — requiring two distinct principals to authorize an action. In an agentic platform, an agent can never be both approvers, and the approving human must be authenticated at the moment of approval.

Human-in-the-loop (HITL) — a deliberate pause for human judgment on a sensitive action, with the agent's proposal, evidence, and the reviewer's decision all recorded.

Audit-grade log — an append-only, tamper-evident record sufficient to reconstruct what happened and who authorized it: actor chain, action, parameters (redacted), decision, policy version, model version, evidence, timestamps. Hash-chained so any modification is detectable.

Redaction vs masking vs tokenization — redaction removes; masking replaces with a placeholder preserving shape; tokenization substitutes a reversible surrogate stored in a vault. Logs mask; data pipelines tokenize.

Safety, guardrails & adversarial

Guardrail — a deterministic (or model-based) check applied to input, retrieved context, or output, that can allow, mask, or block. Guardrails are controls; prompts are requests.

Prompt injection — untrusted content that the model treats as instruction. Direct (the user types it) or indirect (it arrives inside a retrieved document, email, or web page). The defining vulnerability of agentic systems, and not solvable by prompting alone.

Trust boundary (agentic) — the line between content that may instruct and content that may only inform. Everything retrieved, fetched, or returned by a tool is data, never instruction.

Exfiltration channel — any path by which an injected instruction can move data out: a URL the agent fetches, an email tool, a markdown image, a webhook. Egress allow-listing is the control.

OWASP LLM Top 10 — the standard risk taxonomy for LLM applications (prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system-prompt leakage, vector and embedding weaknesses, misinformation, unbounded consumption). The bank will ask you to map controls to it line by line.

Excessive agency — granting an agent more capability, permission, or autonomy than the task requires. The category most action-gateway design exists to close.

PII / PHI / MNPI — personally identifiable information; protected health information; material non-public information — the finance-specific one. MNPI leakage across an information barrier (a "Chinese wall") is a regulatory event, and an agent that retrieves across desks creates one silently.

Information barrier — the enforced separation between businesses that must not share information (e.g., advisory and trading). In an agent platform it becomes a retrieval and tool authorization constraint.

Red-teaming (AI) — adversarial evaluation of the deployed system: injection suites, jailbreaks, data-exfiltration attempts, tool-abuse chains. A release gate, run continuously.

Model supply chain — everything a model brings with it: weights provenance, tokenizer, serialization format (safetensors vs pickle), fine-tune lineage, and the third party's processing terms.

Banking integration

Core banking system — the system of record for accounts, balances, and postings. Slow to change, high-blast-radius, usually accessed through a mediation layer, never directly by an agent.

ESB (Enterprise Service Bus) — the older centralized integration layer (routing, transformation, protocol bridging). Still load-bearing in most banks; the AI platform integrates through it as often as around it.

ISO 20022 — the international standard for financial messaging: an XML (and increasingly JSON) message catalogue with a shared business model. Message names encode the family: pain.001 (customer credit transfer initiation), pacs.008 (FI-to-FI customer credit transfer), camt.053 (bank-to-customer statement).

Payment rail — the network a payment travels (domestic ACH/RTGS, SWIFT, card networks, instant-payment schemes). Each has its own cut-off times, finality semantics, and reversal rules — all of which constrain what an agent may safely do.

Finality — the point after which a payment cannot be unilaterally reversed. Agents must know which side of finality an action sits on; irreversibility is a side-effect class.

Event streaming (Kafka / Azure Event Hubs) — an append-only partitioned log with consumer offsets. The platform's asynchronous integration substrate.

Consumer group / offset / partition — parallelism and progress-tracking primitives: a partition is an ordered shard, an offset is a position in it, a consumer group divides partitions among consumers.

Transactional outbox — writing a domain change and its outbound event in the same local transaction to an outbox table, then relaying the event asynchronously. Removes the dual-write problem without distributed transactions.

Change Data Capture (CDC) — deriving an event stream from a database's transaction log (Debezium being the canonical implementation). How a core banking system becomes an event source without being modified.

Schema registry / compatibility — the contract store for event schemas, with evolution rules: backward (new schema reads old data), forward (old schema reads new data), full (both). The rule you choose determines whether producers or consumers must deploy first.

Data product — a curated, owned, documented, SLO-backed dataset published for reuse (the data-mesh unit). The AI platform is a consumer of data products and should be a producer of its own (traces, evaluations, agent outcomes).

Data contract — the machine-checkable agreement about a data product's schema, semantics, quality, freshness, and ownership.

Cloud & infrastructure

Infrastructure as Code (IaC) — infrastructure defined in versioned, reviewable code. Terraform is the JD's named tool; its model is a resource graph, a state file, a plan (diff of desired vs actual), and an apply.

Drift — divergence between the state file and reality (someone changed it in the portal). Detecting and either reverting or absorbing drift is a run-state responsibility.

Kubernetes / AKS / EKS — container orchestration and its Azure/AWS managed forms. The platform's compute substrate for agent runtimes, MCP servers, and self-hosted inference.

Reconciliation loop — Kubernetes' core idea: controllers continuously drive actual state toward declared state. The same idea underpins GitOps and drift correction.

Helm — the Kubernetes package manager: templated manifests (charts) with values, releases, and rollbacks.

Service mesh (Istio / Linkerd) — a sidecar/ambient layer providing mTLS, retries, timeouts, traffic shifting, and telemetry without application changes. The natural home for agent-to-agent mTLS and per-workload identity.

API gateway (APIM / Kong / Envoy) — the north-south ingress enforcing authentication, rate limits, transformation, and routing. Azure API Management is the bank-standard one here; Envoy is the data plane inside most meshes; Kong has an AI-gateway plugin family.

Private endpoint / Private Link — a private IP for a PaaS service inside your VNet, so traffic never traverses the public internet. The default for model endpoints, vector stores, and key vaults in a bank.

Egress control — restricting outbound traffic to an allow-list (firewall, NAT gateway, proxy). The control that turns "the agent fetched a URL" from an exfiltration channel into a logged, policy-checked event.

Network segmentation — dividing the network into zones with controlled crossings, so a compromise in one zone does not imply reach into another.

Landing zone — a pre-governed cloud environment (subscriptions, networking, identity, policy, logging) into which workloads deploy. The AI platform lives in one.

GPU node pool / scheduling — dedicated GPU nodes with taints/tolerations, device plugins, and often MIG (multi-instance GPU) partitioning; scheduling is about packing expensive scarce resources without starving anyone.

CI/CD with OIDC federation — pipelines authenticating to the cloud with short-lived federated tokens instead of stored secrets. The secret-less pattern applied to deployment.

Supply-chain security — SBOMs, image signing (Sigstore/Notary), provenance attestation (SLSA), and admission policies that refuse unsigned artifacts.

SRE, observability & FinOps

SLI / SLO / SLA — an indicator is a measured signal (success rate, latency); an objective is the target for it (99.5% over 30 days); an agreement is the contractual promise with consequences. You design SLIs and SLOs; legal owns SLAs.

Error budget — the allowed unreliability: \( 1 - \text{SLO} \). At 99.9% over 30 days that is 43.2 minutes. It converts reliability from an argument into arithmetic, and it is the currency of the two-in-a-box relationship.

Burn rate — how fast the error budget is being consumed relative to uniform consumption. A burn rate of 14.4 exhausts a 30-day budget in ~2 days. Multi-window multi-burn-rate alerting (fast window for urgency, slow window for confirmation) is the standard page/ticket policy.

Toil — manual, repetitive, automatable operational work that scales with load. Measured, budgeted, and attacked.

OpenTelemetry (OTel) — the vendor-neutral standard for traces, metrics, and logs, with semantic conventions — including an evolving set for GenAI (model name, token counts, operation name) that make agent telemetry comparable across tools.

Cardinality — the number of distinct label combinations in a metric. The thing that silently destroys a metrics backend; agent_id × tool × tenant × model is a cardinality bomb if you are not deliberate.

Golden signals — latency, traffic, errors, saturation. For AI workloads, add cost, quality, and safety-block rate — the JD's "non-deterministic workloads" phrase means exactly this.

Non-determinism (operational) — the same input can produce different outputs, so "correct" is a distribution, not a predicate. Consequences: SLIs must be about system behaviour (availability, latency, budget) plus sampled quality, and regressions are detected statistically.

Capacity planning — forecasting demand and provisioning ahead of it. For AI: PTUs, GPU nodes, vector-index memory, and token throughput — with lead times measured in weeks.

Degradation ladder — the pre-agreed ordered list of what you turn off first under pressure (rerank → cheaper model → cached-only → read-only → queue). Decided in daylight, executed at 3 a.m.

FinOps — the practice of cost accountability: attribution, budgets, forecasting, unit economics. The unit economic here is cost per successful action, not cost per token.

Post-mortem (blameless) — the written analysis after an incident: timeline, contributing factors, what worked, action items with owners. Blameless because you want the truth, not a defendant.

Governance, risk & regulation

CBUAE — the Central Bank of the UAE, this platform's primary prudential regulator. Expect requirements on outsourcing/cloud, data residency, operational resilience, and model risk.

Model risk — the risk of adverse consequences from decisions based on incorrect or misused model output. The framework language most banks inherit from SR 11-7: models must be inventoried, validated independently, monitored, and governed through a lifecycle.

Model inventory — the authoritative register of every model in use, its owner, purpose, risk tier, validation status, and monitoring. For an agentic platform this must include prompts, agents, and retrieval configurations, not only weights.

Risk tiering — classifying a model/agent by impact (financial, customer, regulatory) to decide the depth of validation and control. A tiering scheme is the first thing model risk asks for.

Independent validation — review by a function that did not build the model, with authority to block. The organizational analogue of a second pair of eyes in code review.

Lineage — the traceable record of what produced an output: model + version, prompt + version, retrieved documents + versions, tool results, policy decisions, and identities. Reproducibility is a regulatory requirement, not an engineering nicety.

Evidence pack — the bundle you hand an examiner for a specific decision or period: the lineage, the approvals, the policy versions, the evaluation results, and the audit records. Designing so this can be generated rather than assembled is a principal-level move.

Data residency — the requirement that data be stored (and often processed) in a specific jurisdiction. Drives region selection, model-endpoint selection, and sometimes self-hosting.

Third-party / vendor model governance — due diligence and ongoing oversight of externally provided models: contractual data-use terms, sub-processor lists, region guarantees, deprecation notice periods, and an exit plan.

Model deprecation risk — a provider retiring or silently updating a model version under you. The controls are version pinning, evaluation on every version change, and a tested fallback.

Concentration risk — over-dependence on one provider, region, or model family. The regulator will ask; the answer must be an architecture (the gateway), not an intention.

Auditability — the property that an independent party can reconstruct what happened, from records you already produce, without your help.

NIST AI RMF — the Govern / Map / Measure / Manage risk framework, widely used as the structuring vocabulary for AI governance programmes even where not mandated.

EU AI Act — risk-tiered AI regulation. Useful as the strictest reference regime: designing to it usually satisfies looser ones.