Appendix GGlossary of Sovereign AI Engineering Terms

Terms as this book uses them. Where the industry uses a word loosely, the entry says what it means here.

Agent. A model running inside a harness: it reads its situation, decides one step, acts through a tool or answers, and repeats. The capability is mostly the harness.

Agent memory. What one agent remembers about one person, filed by category, extracted from conversations when permitted and editable by the person and an administrator. One of the three memory scopes.

Air-gapped deployment. The platform running on a network with no route to the public internet: local models, local embeddings, local identity, updates by signed bundle. The strictest deployment tier and the proof that no hidden dependencies exist.

Approval mode. A harness setting that decides whether consequential actions, a submit, a send, a payment, a delete, proceed automatically or pause for a human's approve-or-deny.

Audit line. The record the broker writes for every tool call: who, which agent, which tool, what scope, allowed or denied, what came back, which model later saw it.

Broker. The institution-run service every tool call passes through. It holds connector credentials, evaluates the deny-by-default policy table, scopes calls to the person, and writes the audit log. The component most AI products lack.

Budget cap. A ceiling on model spend the institution sets, after which the platform stops spending rather than invoicing. The financial shape that replaces per-seat pricing.

Classification routing. A router rule that confines data of a given classification, restricted, privileged, regulated, to an approved list of models, typically local ones.

Connector. A small service that exposes a system of record to agents as a set of tools, over the Model Context Protocol, translating between the model's world and the system's API. Runs inside the institution's perimeter.

Deny by default. The policy posture in which a tool call no rule explicitly allows is refused. The opposite of allow-with-exceptions.

Deployment tier. One of four ways to run the same codebase: the vendor's cloud, the institution's cloud account, on-premise, or air-gapped. A business decision, provided the architecture supports all four.

Embedding. A numeric representation of text used for retrieval by similarity. In a sovereign deployment, produced by a model the institution runs.

Evaluation set. A collection of representative prompts with the properties of a good answer, run against a model before an agent reaches users and whenever the model or a skill changes.

Exit verification. The quarterly check of the four sovereignty questions: can we build and deploy from source; are connectors and skills in our repositories; can we switch the model today; does the air-gapped build start.

Fallback chain. An ordered list of models the router tries when the preferred one fails, ending in a local model so services never stop.

Forward-deployed engineering. The vendor's engineers working inside the institution's team on a real problem, with everything built belonging to the institution.

Framework (the five properties). You own the code; you own the data, in place; you choose the model, and can change it; your clients share one identity; your agents run inside a harness you can inspect.

Global memory. What the platform remembers about a person across every agent in their organization. One of the three memory scopes.

Harness. The loop an agent runs in, and everything around the model: tools, memory, budgets, approvals, sandbox, stop, audit. Where the institution's control lives.

Headless application. An agent, a skill set and an API, with a user interface only where a human needs one. The post-SaaSpocalypse shape of departmental software.

Identity hand-off. The sign-in pattern in which an application redirects to the platform's hosted sign-in service and receives user-scoped session tokens back, never seeing a password or holding an organization credential.

Lock-in (four kinds). Model, identity, connector, and format-and-memory. Each defeated by a specific decision at a specific layer.

Model Context Protocol (MCP). The open standard for how an agent discovers and calls tools, introduced by Anthropic in 2024, adopted across the industry in 2025, and stewarded by the Linux Foundation. The reason connectors are portable.

Model-agnostic. The property that the model behind any agent is a setting, reachable through one standard interface, switchable without touching an integration.

Ontology. A description of the institution's concepts, their relationships, and the system and tool that answers for each. A pass-through: it stores mappings, never records.

Open-weight model. A model whose weights are published and can be downloaded and run on the institution's own hardware. The basis for local inference and the restricted-data model list.

Organization credential. A key with administrative authority over an organization. Lives only on a server the institution controls; never in a client.

Per-seat pricing. A fixed monthly fee per person regardless of use. The pricing shape this book argues is structurally wrong above a hundred users.

Reading in place. Reaching a system of record at the moment of the question, through a connector, as the asking person, instead of ingesting a copy in advance.

Router. The component every model call passes through, which selects the provider or local model by cost, latency, capability and classification, attaches the provider credential, applies the fallback chain, and records the decision.

SaaSpocalypse. The trade-press name for the question of what happens to software subscriptions when AI lets enterprises build applications themselves. This book's reading: the application becomes headless; data access, identity and agents remain scarce.

Sandbox. An isolated environment, on institution infrastructure, in which code an agent writes runs, with an explicit network boundary that is empty by default.

Session token. A short-lived credential representing one signed-in person with exactly their permissions in exactly their organization. Lives with the person, in the client.

Shared component. A library every client and every institution-built application mounts: sign-in, chat, memory, approval card, embed. The mechanism by which governance becomes behaviour.

Shared memory. Standing facts and rules an agent carries into every conversation, written by hand, never extracted, visible to everyone who talks to the agent. One of the three memory scopes.

Signed bundle. A release package of images, model weights, dependencies and a manifest, cryptographically signed, by which an air-gapped deployment is updated.

Skill. A plain-language document that tells an agent how to accomplish a task with the tools it has. The unit of institutional knowledge in a headless estate, and the way a coding agent learns to build on the platform.

Sovereign. Four yeses: readable source, movable data, switchable model, and a system that runs with the cable unplugged.

Three gates. The organization's memory switch, the agent's, and the person's own; a level that is off stops everything beneath it.

Tier (hardware). Department (Apple silicon desktops), team (NVIDIA desk-side systems), institution (data-centre GPUs). Sized by memory and bandwidth first.

Usage pricing. Paying for tokens consumed, or for electricity on owned hardware, under a cap the institution sets. The shape that captures the falling price of models for the institution rather than the vendor.