A

Agentic AI

An AI system capable of taking autonomous, multi-step actions in the real world — browsing the web, calling APIs, writing and executing code, managing files, or sending communications — without requiring a human to approve each individual step.

Core Concepts

Agentic AI Containment

The practice of intercepting, verifying, and enforcing policy on every action an AI agent attempts before that action executes. A containment layer sits between the agent's decision-making and the outside world, blocking unauthorized actions and logging all activity to a tamper-evident audit trail.

Core Concepts

AI Agent

A software system that uses a large language model (LLM) as its reasoning engine to plan and execute tasks. Unlike a chatbot, an AI agent has access to tools — functions it can call to interact with external systems — and can chain multiple tool calls together to complete complex goals.

Core Concepts

AI Governance

The policies, accountability structures, technical controls, and observability mechanisms that organizations use to ensure autonomous AI systems operate within authorized boundaries. Effective AI governance rests on four pillars: policy (what the agent is allowed to do), accountability (who is responsible), controls (technical enforcement), and observability (knowing what the agent did).

Compliance & Governance

AI Governance Framework

A structured approach to managing AI risk across an organization. Major frameworks include the NIST AI Risk Management Framework (AI RMF), the EU AI Act, and ISO/IEC 42001. Each provides a different lens on governance — risk-based, regulatory, and management-system respectively.

Compliance & Governance

Audit Log (Tamper-Evident)

A structured, append-only record of every action an AI agent takes, linked by cryptographic hash chains so any modification or deletion is detectable. A tamper-evident audit log is the foundation of accountability for agentic systems and a requirement for compliance in regulated industries.

Compliance & Governance

Audit Mode

A CfAM policy mode that allows all actions but logs everything. Audit mode provides full observability without blocking, making it ideal for understanding an agent's behavior in staging before locking it down for production.

Policy & Enforcement

Autonomous Agent

An AI agent that operates without human approval for individual actions. Autonomy exists on a spectrum: a fully autonomous agent acts entirely on its own; a human-in-the-loop agent pauses for approval at defined checkpoints. Containment middleware enables safe autonomy by enforcing policy at the action boundary.

Core Concepts

B

Blast Radius

The maximum potential damage from a single compromised or misbehaving AI agent, determined by the scope of its tool access and permissions. An agent with access to a shell, email client, and production database has an enormous blast radius. Least-privilege access and containment policies minimize blast radius.

Attack Vectors

C

CfAM (Containment for Agentic Middleware)

GALXEE's open-source middleware library that implements agentic AI containment. CfAM wraps AI agent functions with a policy enforcement engine, rate limiter, payload inspector, and tamper-evident audit logger. Available as a Python package and a Node.js/TypeScript module.

Core Concepts

ContainmentVerdict

The structured response returned by CfAM's policy engine after evaluating an agent action. A verdict includes the decision (ALLOWED, BLOCKED, RATE_LIMITED, or ESCALATED), the reason for the decision, and metadata about which policy check triggered it. The agent can use the verdict to adjust its behavior or surface an error.

Policy & Enforcement

D

Data Exfiltration (AI)

An attack in which a compromised or manipulated AI agent sends sensitive data — PII, credentials, proprietary content — to an unauthorized external endpoint. Containment middleware prevents exfiltration by enforcing domain allowlists and payload size limits on all outbound agent requests.

Attack Vectors

Domain Allowlist

An explicit list of domains an agent is permitted to make requests to. Any request to a domain not on the allowlist is blocked by the containment middleware. Domain allowlists are the primary control against data exfiltration and unauthorized API access.

Policy & Enforcement

E

Egress Filtering

Network-level controls that restrict what external endpoints an agent can reach. Egress filtering enforces the agent's domain allowlist at the infrastructure layer — even if the application-level containment is bypassed, the network will not route the request.

Architecture

Ephemeral Context

A containment mode that wipes an agent's working memory at the end of each session, preventing sensitive information from one session leaking into another through the model's context window or external memory stores. Required for agents handling PII, health records, or financial data.

Compliance & Governance

Escalation

A containment verdict that routes an agent action to a human reviewer rather than blocking or allowing it outright. Escalation is used for high-stakes actions that exceed a defined threshold — large data operations, external communications, financial transactions — where automated policy is insufficient.

Policy & Enforcement

EU AI Act

The European Union's binding regulation for AI systems, which classifies AI by risk level and imposes requirements on "high-risk" systems — including autonomous agents making consequential decisions in regulated domains. Key requirements include risk management, technical documentation, transparency, and human oversight mechanisms.

Compliance & Governance

H

Hash Chain

A cryptographic technique used in CfAM's audit log where each log entry includes a SHA-256 hash of its own content combined with the hash of the previous entry. This creates a chain: if any entry is modified or deleted, the chain breaks and the tampering is immediately detectable.

Compliance & Governance

Human-in-the-Loop

An architecture pattern where an AI agent pauses and requests human approval before taking high-stakes actions — deleting records, sending external communications, making financial transactions above a threshold. Human-in-the-loop is a governance control, not a security substitute; containment middleware enforces policy even when humans are not in the loop.

Policy & Enforcement

I

Indirect Prompt Injection

A variant of prompt injection where the malicious payload is not in the user's direct input but in external content the agent retrieves — a web page it browses, a document it reads, or a database record it queries. Indirect injection is harder to detect because the attack surface is the entire internet, not just the user interface.

Attack Vectors

Input Validation (AI)

The process of sanitizing and validating all inputs to an AI agent — including user messages, retrieved documents, and API responses — before they are passed to the model. Input validation is the primary defense against indirect prompt injection and RAG poisoning.

Architecture

J

Jailbreak

A prompt crafted to bypass an LLM's safety training or system prompt instructions, causing it to produce outputs or take actions it was designed to refuse. Jailbreaks target the model layer; containment middleware provides a defense-in-depth layer that enforces policy regardless of what the model decides.

Attack Vectors

L

Least Privilege (AI)

The principle that an AI agent should have exactly the access it needs for its defined task — no more. Applied to agentic systems, least privilege means scoping tool access, API credentials, and data permissions to the minimum required. It is the most effective way to minimize blast radius.

Policy & Enforcement

LLM (Large Language Model)

A deep learning model trained on large text corpora that can generate, summarize, translate, and reason about text. In agentic systems, the LLM acts as the reasoning engine that decides which tools to call and in what order. Examples include GPT-4, Claude, and Gemini.

Core Concepts

M

Multi-Agent System

An architecture in which multiple AI agents collaborate to complete a task, often with one orchestrator agent delegating subtasks to specialized worker agents. Multi-agent systems amplify both capability and risk: a compromised worker agent can affect the entire pipeline.

Core Concepts

N

NIST AI RMF

The National Institute of Standards and Technology's AI Risk Management Framework. Organizes AI governance around four functions: Govern (establish policies and accountability), Map (identify risks), Measure (define and monitor metrics), and Manage (respond to risks with controls). Framework-agnostic and designed to integrate with existing enterprise risk management.

Compliance & Governance

P

Permissive Mode

A CfAM policy mode that allows all agent actions not explicitly blocked. Permissive mode is useful during development when you are still mapping out what your agent needs to do — you get observability without friction. It should not be used in production.

Policy & Enforcement

Policy Enforcement

The technical mechanism that makes an agent policy binding rather than advisory. In CfAM, policy enforcement intercepts every agent action at runtime, evaluates it against the configured policy, and blocks or allows it before execution. Enforcement at the middleware layer cannot be overridden by prompt injection.

Policy & Enforcement

Prompt Injection

An attack in which malicious instructions embedded in data the agent processes — a webpage, document, email, or API response — override the agent's original instructions and redirect its behavior. The agent cannot distinguish between legitimate instructions and injected ones; only external enforcement can catch the resulting unauthorized actions.

Attack Vectors

R

RAG (Retrieval-Augmented Generation)

An architecture pattern where an LLM's responses are grounded by retrieving relevant documents from an external knowledge base at query time. RAG improves factual accuracy and allows agents to work with up-to-date or proprietary information. It also introduces the RAG poisoning attack surface.

Architecture

RAG Poisoning

An attack targeting Retrieval-Augmented Generation (RAG) systems, where malicious content is injected into the knowledge base or document store. When the agent retrieves and processes the poisoned document, the embedded instructions hijack its behavior — a form of indirect prompt injection at the retrieval layer.

Attack Vectors

Rate Limiting (AI Agents)

A control that limits how many actions an agent can take per unit time or per session. Rate limits prevent both runaway behavior (an agent stuck in a loop) and denial-of-service from prompt injection attacks that cause the agent to make excessive requests.

Policy & Enforcement

Runtime Policy

A policy that is evaluated and enforced at the moment an agent attempts an action, as opposed to a policy that is only checked at deployment time. Runtime policies can respond to dynamic context — the current rate of requests, the content of a payload, the target domain — in ways that static configuration cannot.

Policy & Enforcement

S

Sandboxed Execution

Running agent code execution, file operations, and other high-risk actions in isolated environments with no access to production systems or sensitive data. Sandboxing limits blast radius by ensuring that even if an agent is compromised, it cannot reach production infrastructure.

Architecture

Strict Mode

A CfAM policy mode that blocks all agent actions not explicitly permitted by the policy. In strict mode, if a domain is not on the allowlist, the request is blocked — period. Strict mode is the recommended default for production agents that interact with real users, real data, or real money.

Policy & Enforcement

T

Tamper Evidence

A property of a system or record that makes unauthorized modification detectable. In CfAM's audit log, tamper evidence is achieved through hash chaining: the integrity of the entire log can be verified cryptographically at any time.

Compliance & Governance

Tool Use

The ability of an LLM to call external functions — APIs, databases, code interpreters, file systems — as part of completing a task. Tool use is what transforms a language model from a text generator into an agent that can take real-world actions. It is also the primary attack surface that containment middleware protects.

Core Concepts

Trust Boundary

A defined perimeter between components with different trust levels. In agentic systems, the LLM is the least trusted component — it is the most susceptible to manipulation. The containment middleware sits at the trust boundary between the LLM's decisions and the tools it can invoke.

Architecture

Z

Zero-Trust AI

The application of zero-trust security principles to AI systems: never trust, always verify. In agentic AI, zero-trust means treating the LLM as an untrusted component whose outputs must be verified against policy before execution — regardless of how the model was trained or what its system prompt says.

Architecture