Glossary

This glossary defines the vocabulary of AI Operations, from the five operations functions and the degrees of delegation to the artefacts, roles, practices, regulations and frameworks that the chapters use. Each entry gives the book's own usage in one to three sentences and names the chapter where the term is introduced or defined. Where a term is used in a sense the chapters do not support, it is left out rather than defined.

How to use this glossary

Entries are in alphabetical order, with identifiers in code formatting (SVC-*, RST-*) sorted by their letters. An identifier such as SLO-* names a pattern: the wildcard stands for the number the organisation assigns to each record, and the book's examples use NR for Nordvik Region and HM for Hansa Mutual.

Levels, modes and action classes are defined in sets, so read an entry for one of them together with the entries it refers to. The book sets ceilings and not single values: where an entry gives a default, a delegation profile may set a lower level, and the lowest ceiling that applies governs. Legal entries follow the instrument and attribute each statement to its article as the chapters cite it; they describe organisational and architectural implications and are not legal advice. "DORA" always means Regulation (EU) 2022/2554 (Chapter 20 names the research programme of the same abbreviation "the four key metrics").

A

Abort criteria. The conditions, expressed in measures that an independent probe reads, under which a rollout or an experiment is stopped, together with the authority to stop it (Chapter 9).

Action class. A kind of effect on the estate, not a tool. The book names eleven: read, annotate, notify, scale, restart, reconfigure, deploy, roll back, fail over, delete and restore-overwrite, each with a default ceiling (Chapter 4).

Actual state. What is running in the estate, as opposed to declared state, which is what the repository says should run. The gap between them is drift (Chapter 8).

Admission policy. A rule evaluated by the cluster's API server before an object is stored, so that a request is accepted or refused whatever its author or its path; one of the gates, independent of the author, that stands in front of a state engine (Chapter 18).

Agent. A system in which a model directs its own sequence of tool calls towards a goal. It proposes, drafts or executes within a mandate; it does not intend or understand (Chapter 16).

Agent operator. The person on each shift in which an agent acts who can stop it (Chapter 16).

Agent owner. The named person who answers for an agent's mandate and record (Chapter 16).

AI Act. Regulation (EU) 2024/1689, as amended, which the book reads for the operator's AI systems (Chapters 13 and 14) and tests against the operator's own agents (Chapter 23). The terms provider, deployer, high-risk AI system and general-purpose AI model are used as the Act uses them.

AI Decision Record (AIDR). The record of a decision about an AI capability, numbered AIDR-0900 to AIDR-0999 in this book: Nordvik Region AIDR-0900 to AIDR-0949 and Hansa Mutual AIDR-0950 to AIDR-0999 (Chapter 1).

AI gateway. The routing layer through which an organisation's applications call models, where model versions are pinned and fallbacks are configured (Chapter 13).

AI incident. The book's working definition: an unplanned event in which an AI system, as operated or as operating, degrades a service level objective, acts outside its mandate, produces output at a scale or of a kind that harms or could harm a person, or exposes data it should not. It is wider than the legal terms, so that the legal question is answered by a person at a defined step (Chapter 14).

AI literacy. The measures that providers and deployers take under Article 4 of the AI Act, as replaced by the Digital Omnibus on AI, to support the AI literacy of staff who operate and use AI on their behalf, without a guarantee of any level for any individual (Chapter 23).

Alert. A page or notification that calls a person because a signal or a budget burn warrants attention. A suppressed alert is still recorded on the incident (Chapters 5 and 6).

Alert-correlation policy (ACP-*). The policy that sets what a correlation or noise-reduction feature may group, hold or suppress for a service, including the suppression ceiling (Chapter 6).

Algorithmic management. Directing, evaluating, rewarding and disciplining people by means of AI, the subject of AI Boss. In this book it bounds what an operations agent may do about a named person's access to work (Chapter 4).

Analysis template. In Argo Rollouts and Kargo, the definition of the metrics, their frequency and the values that count as success or failure for a rollout or a promotion; it is a stop condition and so falls under the rules for abort criteria (Chapter 9).

Annotate. The action class that adds notes, tags, links or timeline entries; it is reversible, has no effect on service and has a default ceiling of Level 4 (Chapter 4).

Anti-pattern (AP-*). A recurring failure whose first step looks reasonable. The book records eight, AP-NR-OPS-* and AP-HM-OPS-*, each with the public cases that show it and the control that changes the outcome (Chapter 28).

ApplicationSet. In Argo CD, the object that generates one Application per target (for example one per cell) from a template; changing it changes every generated sync policy, so it is a protected path (Chapter 8 and Appendix A).

Architecture Decision Record (ADR). A formal record of a significant architectural decision (Chapter 21).

Asserted. The status of a claim that rests on a statement in a plan or a contract, or on an attestation that is not independent, and not on a test; it follows the distinction of AI Threat, Chapter 30, between declared and verified controls (Chapters 4 and 19).

Automation bias. The tendency to over-rely on an automated suggestion and to under-check it, found in reviewers of machine proposals and persisting after instruction (Chapters 2, 12 and 26).

Autonomy budget. The tolerance for faulty actions that a Level 3 class has in a window, consumed by autonomy errors in the way an SRE error budget is consumed by failures. A review is held at 70 per cent consumed; at 100 per cent the class falls one level until a named authority decides otherwise; the default window is 28 days (Chapter 4).

Autonomy error. An action of a class that had to be reversed, whose intended effect the independent observer did not find, that the policy decision point refused as outside the mandate, or that had a customer-visible or regulator-visible effect. The observer counts them, not the agent (Chapter 4).

B

Backup (immutable, segregated). A copy of data from which a service can be restored. DORA Article 12 requires backup policies and periodic testing, and Article 12(3) requires that, when backup data is restored on the entity's own systems, those systems are physically and logically segregated from the source (2, European Union, 2022); the book adds immutability as a design property (Chapters 4, 10 and 19).

Blameless review. A review that concentrates on the contributing conditions of an incident without indicting an individual or team, on the assumption that those involved had good intentions and decided on the information they had (Chapters 2 and 12).

Blast radius. How far a mistake spreads, from one instance to a cell, a region, a provider or the group. It is one of the four answers that set a ceiling, and a class whose wrong use reaches a Tier 1 service in several markets is capped at Level 2 (Chapters 4 and 9).

Blast-radius budget. The largest share of users, regions or services that a change may reach before a person must decide, with scope, rate, duration and authority stated (Chapter 9).

Break-glass. Emergency access to a Tier 0 control plane, with a record. It must not depend on what it is a remedy for, needs two named people by default and is itself a Tier 0 asset (Chapter 18).

C

Canary. A first stage of a rollout in which a small share of real traffic or a single cell runs the change, with the result compared to a control before the change spreads (Chapter 9).

Capacity record (CAP-*). The record of a capacity decision with its forecast, the forecast's error interval, the floor it protects and the cost (Chapter 11).

Change advisory board (CAB). The traditional forum that approves changes. The book compares it with the pipeline as a rival answer to the same risk and keeps a small authority forum for changes of a new kind (Chapters 2 and 22).

Change enablement. The ITIL 4 practice that the loop draws on for O3 Change (Chapter 4).

Change fail rate. One of the four key metrics: the ratio of deployments that require immediate intervention following a deployment, likely a rollback or a hotfix (268, DevOps Research and Assessment programme, n.d.) (Chapter 20).

Change record (CHG-NR-*, CHG-HM-*). The record of a change with provenance, reviewer, policy results, blast radius and rollback plan (Chapter 8).

Change request raised by the provider. A provider's notice of a model change or retirement, entered in the change system on the day it arrives with the retirement date as the deadline and a named service owner (Chapter 13).

Competence framework (OPS-CF). The framework that lists what the people of an operations function must be able to do, at which of four levels (Foundation, Practitioner, Advanced, Expert) and with what evidence. Hansa Mutual's version 2028.1 has five areas and thirteen identifiers (Chapter 26).

Competence record (CMP-*). The record of a person's competence in a stated area, with the test, the date and whether it was shown with or without the assistant. A competence shown only beside the assistant is a skill of the pair (Chapter 26).

Confused deputy. A service that holds authority of its own and cannot tell on whose behalf it is asked to use it. Named by Norm Hardy in 1988; the pattern applies to agents that act through tools (Chapter 18).

Contributing conditions. The several conditions, each with its evidence, that a post-incident review lists instead of naming one cause (Chapter 12).

Control loop. A loop that compares desired state with observed state and acts on the difference; Kubernetes describes its controllers this way. The operations loop of this book is one at a larger scale (Chapters 4 and 8).

Control plane. The systems through which the estate is configured and operated. For the operator's agents it is Tier 0 (Chapter 18).

Critical ICT third-party provider. A provider designated under DORA as critical. The three European Supervisory Authorities published the list on 18 November 2025 (7, EBA, 2025) (Chapters 3 and 24).

Critical or important function (CIF). The DORA category of function whose disruption would materially impair a financial entity. Services that support one carry the heaviest testing, exit and contract duties (Chapters 5 and 23).

CER Directive. Directive (EU) 2022/2557 on the resilience of critical entities. Critical entities assess risk, take measures including to recover from incidents (Article 13(1)(d)), keep a resilience plan and notify incidents that significantly disrupt essential services, with an initial notification within 24 hours (Article 15(1)) (Chapter 23).

CSIRT. The national computer security incident response team that receives NIS 2 reports and, where a Member State requires it, a copy of a DORA report (Chapter 23).

D

Dark day. A scheduled period in which a defined workload is operated without the operations agents, so that people do what the agents normally do (Chapter 26).

Data Act. Regulation (EU) 2023/2854. Its Chapter VI gives customers of data processing services rights to switch provider, with a transition of at most 30 calendar days, a data retrieval period of at least 30 calendar days and, from 12 January 2027, no switching charges (Chapters 23 and 24).

Dead-man's signal. A heartbeat that raises an alarm when it stops, not when a bad value arrives, so that the silence of an observer is read as a failure. Part of the dependence test (Chapters 4 and 17).

Declared state. The state that a repository or a record says the estate should be in; see desired state and drift (Chapter 8).

Degrees of delegation. The series' autonomy levels, Level 0 Advisory to Level 4 Autonomous, set per function and action class. See Level 0 to Level 4 (Chapter 4).

Delegation profile (DLG-*). The written statement, for one agent and one service, of the ceiling per function and action class, with the stop holders and the evidence for each level. Any class not listed is undelegated, and the lowest ceiling that applies governs (Chapter 4).

Delegation register. The register of delegation profiles that a CIO or head of operations can ask for, together with the budget report per runbook (Chapter 10).

Delete. The action class that removes resources or data; Level 3 only for temporary artefacts the agent created, Level 1 for production data, never Level 4 for production data (Chapter 4).

Deployer. As in the AI Act, the organisation that uses an AI system under its authority. For a high-risk AI system the deployer's duties include human oversight, monitoring, log retention of at least six months and informing the provider of a serious incident (Article 26) (Chapters 13, 14 and 23).

Deploy. The action class that releases a build or an infrastructure change; Level 2 by default, Level 3 for a pre-approved standard change in progressive delivery (Chapter 4).

Dependency map. The map of the services and providers on which a service depends, with the blast radius of each. It feeds the service record (Chapter 3).

Dependence test. The second observer test: the observer must be able to report when the platform it watches has failed (Chapter 4).

Desired state. The state a system should be in, expressed declaratively and stored versioned and immutable, as the OpenGitOps principles ask; the input of a reconciler (Chapter 8).

Desired-state repository. The repository from which a reconciler pulls desired state. Write access to it is write access to production, so it is protected like the reconciler itself (Chapters 8, 16 and 18).

Deskilling. The loss of a skill through disuse when automation does the work, for operators the loss of the ability to diagnose and restore manually. It is measured, not assumed (Chapter 26).

Deadline objective. An objective such as a settlement run complete by 06:00, which is binary per run day. A ratio-based budget degenerates, so the alert is written on the progress of the run (Chapter 5).

Decision-rights file (DRF-*). The file that states, for one organisation and one tier of service, who may decide what, including the incident command position (Chapter 22).

DORA. The Digital Operational Resilience Act, Regulation (EU) 2022/2554. It applies to Hansa Mutual as an insurance undertaking and not to Nordvik Region. The book maps Articles 5 to 16 (ICT risk management), 17 to 23 (incidents), 24 to 27 (testing), 28 to 44 (third parties) and 45 (information sharing) to the five functions (Chapters 4 and 23). See also Management body, Register of information, TLPT.

Drift. The divergence between declared state and actual state, for instance after a console edit during an incident, a provider change, a part-failed apply or a legitimate autoscaler change. It is classified before it is corrected (Chapter 8).

Durable execution. Running a multi-step procedure so that it completes across crashes, by recording an event history and replaying it on another worker; it does not make a step that was already run safe to run again (Chapters 10 and 16).

E

Error budget. 100 per cent minus the service level objective: the amount of unreliability a service may spend in a window. A written error budget policy says what happens when it is exhausted (Chapter 5).

Evidence age. The time since the test or measurement that supports a claim. Evidence expires by clock and by condition (Chapters 4 and 19).

Exit test. A test, with a record, that a service can leave a provider within the contract's terms. An exit never run is an asserted claim (Chapter 24).

Expected. The label for a statement about the future that follows from a decided instrument or a stated trend; with observable and speculation it labels every outlook (Chapter 3; AI Governance, Chapter 22).

Expired. The status of a claim whose last passing test is older than its clock (180 days by default for a Tier 1 restore or failover test) or has been followed by a listed change (Chapter 19).

F

Fail closed. A condition that treats missing data as a failure, so that a probe that reports nothing stops a rollout (Chapter 9).

Fail over. The action class that moves service to another site, region or provider; Level 2 by default and Level 1 across providers for a critical function. The incident commander decides (Chapter 4).

Fallback chain. The ordered list of what a service runs on when the pinned model version cannot be used (Chapter 13).

Feature flag. A runtime switch that separates deployment from exposure: the code is in production and the flag decides who runs it (Chapter 9).

FinOps. The practice of managing the cost and business value of technology, including cloud and AI consumption (59, FinOps Foundation, n.d.). The book separates decisions that change usage from those that change rate, which differ greatly in reversibility (Chapters 11 and 15).

Floor. A lower bound that an agent cannot cross, expressed in the unit of the claim it protects, such as the replicas and zones a Tier 1 service needs to meet its recovery time objective (Chapter 11).

Freeze. A period set by people during which production changes are not made; outside a window or inside a freeze every class that changes production has a ceiling of Level 2 (Chapters 4 and 9). The freeze calendar is a record, FRZ-*.

G

Game day. A rehearsed exercise in which a fault is introduced under written rules to test a hypothesis about resilience. A game day is not a TLPT and does not count as one (Chapter 19).

Game day with the agents off. A game day that tests a recovery claim when the remediation agent is unavailable, so that it is a claim about people and runbooks (Chapters 19 and 26).

GDPR. Regulation (EU) 2016/679. The chapters rely on Article 32(1) (security of processing, including the ability to restore availability and access to personal data), Article 33 (breach notification within 72 hours of awareness), Article 34 (communication to data subjects), Article 22 (decisions based solely on automated processing) and Article 88 (employment data) (Chapter 23).

General-purpose AI model. The AI Act term for a model that can serve many tasks. A provider's change to such a model inside a service is an operations change (Chapters 13 and 15).

GitOps. Operating a system by declaring its desired state in version control and letting software agents pull and continuously reconcile it, as the four OpenGitOps principles state. The reconciler is a change actor (Chapter 8).

Golden incident set. A set of past incidents with known answers, held outside the system under evaluation, used to measure the precision, recall and noise reduction of correlation and diagnosis (Chapter 6).

H

High-risk AI system. As in the AI Act. Nordvik Region's benefits-triage service SVC-NR-001 is one; an operations agent is not high-risk merely by being an operations agent, and the book tests it against Annex III, points 2 and 4(b) (Chapter 23).

Human oversight. The AI Act term (Article 14 for providers, Article 26 for deployers) for effective oversight by natural persons who understand an AI system's limits, remain aware of automation bias, can override it and can interrupt it through a stop button (Chapters 22 and 23).

I

ICT-related incident, major. The DORA term for an incident classified under Article 18 by clients and counterparts affected, duration, geographical spread, data losses, criticality of services and economic impact. A major incident opens the Article 19 reports (Chapters 14 and 23).

Incident commander. The human who holds command of an incident and authorises the runbook runner during it. Command needs a written handover, a living record and unity of command (Chapters 16 and 22).

Incident record (INC-NR-*, INC-HM-*). The record of one event: what degraded, when, for whom, what was done, which contributions came from an assistant and the reporting clocks. It carries the first signal and the awareness as separate timestamps (Chapters 7, 12 and 14).

Independence test. The first observer test: whether the verification shares its failure modes with the action. Independence has the dimensions of model, data, authorship, vendor and time (Chapter 4).

Independent observer. The probe or system that verifies the effect of what the loop did and reports to O2, drawn outside the loop and its agents (Chapters 4 and 17).

Infrastructure as code. Describing infrastructure in versioned code. A change to a dependency is then a change to the record that lives beside it (Chapter 8).

ITIL 4. The service management framework with 34 management practices. The book's mapping of the five functions to its practices is many to many and is its own (Chapter 4).

ISO/IEC 20000-1. The international standard for service management systems, part of the history of operations (Chapter 2).

K

Known error. A flag on a problem record, with a workaround, while the condition remains. The workaround is a runbook entry linked from the service record (Chapter 12).

L

Level 0 Advisory. The AI suggests and a person decides and acts. The ceiling for any agent change to an alert, threshold or monitor (Chapter 4).

Level 1 Assisted. The AI drafts and a person reviews and executes. The level for restore-overwrite, external messages and incident timelines (Chapters 4 and 12).

Level 2 Supervised. The AI executes after explicit approval of each action (Chapter 4).

Level 3 Bounded. The AI executes pre-approved, reversible actions within a codified runbook; a person is informed and can stop it. Level 3 is defined by a runbook manifest and a policy decision point outside the agent (Chapter 4).

Level 4 Autonomous. The AI selects and executes without per-action approval. It is never used for an irreversible action on production data, for an action outside an authorised change window or freeze on a critical function, for an action that disables the observation or the stop path itself, or for an action that decides about a named person's access to work (Chapter 4).

Level 4 prohibitions. The four cases above, stated as rules with a mechanism behind each (Chapter 4).

M

Management body. The body that approves and oversees ICT risk and cybersecurity measures. DORA Article 5 places the framework and its approval on the management body of the financial entity, and NIS 2 Article 20 places approval and oversight of the cybersecurity risk-management measures on the management bodies of essential and important entities; responsibility does not pass to a tool (Chapters 4 and 23).

Mandate manifest (MND-*, MND-NR-OPS-*, MND-HM-OPS-*). The written mandate of an AI agent: tasks, level, tools, data, approvals and the manual practice clause (Chapter 16).

Manual practice clause. The clause in a mandate under which, at stated intervals, a runbook that the agent normally runs is run by a person with the agent off (Chapters 16 and 26).

Market surveillance authority. The authority that receives an AI Act serious-incident report from the provider (Article 73) (Chapter 14).

Metric definition (MET-*). An entry of a metric catalogue with its intended use and misuse notes, such as MET-HM-0003 for failed deployment recovery time (Chapter 20).

MCP server. A server that exposes tools to an agent through the Model Context Protocol. An MCP server for a state engine acts with the permissions of the token or identity behind it, so the agent inherits that reach (Chapter 18).

Mode 0 Ambient AI. AI embedded in products and services whose behaviour the organisation does not choose, such as vendor-embedded correlation (Chapters 6 and 13).

Mode 1 Conversational assistants. Chat assistants used under a person's identity; governance sets the approved tier and data classes (Chapter 13).

Mode 2 Embedded workplace assistants. Assistants inside workplace tools, released by the vendor in rings that the tenant administrator selects (Chapter 13).

Mode 3 Agentic work tools. Tools that draft code, runbooks and changes under a person's identity. They draft and never apply (Chapters 13 and 17).

Mode 4 Built AI applications. Applications the organisation builds or procures around a model, governed through a full release manifest (Chapter 13).

Mode 5 Autonomous production agents. Agents that act with an identity and permissions of their own, and so become privileged machine insiders. The usage mode, not the model, sets the risk (Chapters 4, 16 and 18).

Usage modes. The series' Modes 0 to 5, used by their exact names (see above).

N

Named human decider. The identifiable person accountable for a change, failover, stop or risk-acceptance decision (Chapter 22).

NIS 2. Directive (EU) 2022/2555. Article 20 (management body), Article 21 (measures, with Article 21(2) listing incident handling, business continuity and supply chain security among the minimum) and Article 23 (reporting: early warning within 24 hours, notification within 72 hours, final report within one month) apply to Nordvik Region as national law transposes them and are displaced by DORA for Hansa Mutual (Article 4(1)) (Chapters 4 and 23).

NIST CSF 2.0. The NIST Cybersecurity Framework 2.0, a framework and not law. The loop maps to its Respond and Recover Functions and, for the other functions, to Categories such as DE.CM, PR.PS and PR.IR (Chapter 4).

Noise budget. The agreed amount of non-actionable alerts a correlation feature may leave, used with precision and recall to evaluate it (Chapter 6).

Notify. The action class that pages people or posts internal updates; Level 3 internal, Level 1 external (Chapter 4).

O

O1 Observe. The operations function of seeing the state of services: telemetry, indicators, objectives, anomalies and the cost of seeing (Chapters 4 to 6).

O2 Diagnose. The function of finding what is wrong and why: triage, correlation, what changed, root cause and incident command. It changes nothing in production (Chapters 4 and 7).

O3 Change. The function of altering the estate safely: releases, configuration and infrastructure as code, progressive delivery, freezes and the way back (Chapters 4, 8 and 9).

O4 Restore. The function of returning a service to an acceptable state by remediation, rollback, failover or recovery from backup, with independent verification (Chapters 4, 10 and 19).

O5 Sustain. The function of keeping the estate and the people fit over time: capacity, cost, energy, lifecycle, problem management, learning and the operator's craft. It ends when an action is closed with evidence (Chapters 4, 11, 12 and 26).

Observable. The label for a statement about the future that rests on something documented today (AI Governance, Chapter 22).

Observer manifest (OBS-*). The manifest that lists the independent probes, their failure domains and the stop path that verify an operations loop from outside it (Chapter 17).

Observer principle. What verifies an operations action must be independent of what performed it, the observer must not depend on the system observed, and the stop path must work when the platform does not. It applies the independence principle of AI Purple to operations (Chapters 4 and 17).

On-call charter (ONC-*). The reviewable file, agreed first with employee representatives, that sets scope, response, rest, load, agent clauses, metrics and review for a rota (Chapter 25).

Operations conductor. The accountable person for a loop over a defined set of services and window: knows what the agents may do, sees what they did, verifies proposals, keeps manual operation in practice and holds the right to stop (Chapter 21).

Operator. The person or team who runs services (Chapter 1).

Operating model. The answer to four questions about each service: who runs it, who owns it, who may act on it and who is called when it fails (Chapter 21).

Outage. A loss of service that reaches users. Public outage reports are the evidence base for dependency concentration (Chapter 3).

P

Permission manifest. The deny-by-default manifest, enforced at the policy decision point, that sets the ceiling of what an agent may do (Chapter 18).

Policy decision point. The component outside the agent that enforces the delegation profile, reads the freeze calendar and refuses what is outside the mandate. Level 3 without it is Level 4 with a misleading label (Chapters 4 and 18).

Post-incident review (PIR-*). The evidence-based account of what was learned from one or more incidents: the contributing conditions and the actions. An AI system may draft the timeline at Level 1; people write the analysis (Chapter 12).

Problem record (PRB-*). The record of a condition that has produced, or could produce, incidents, with a known-error flag and workaround while it remains (Chapter 12).

Progressive delivery. Limiting what a bad change can do by controlling who is exposed and for how long before it is judged, through rings, canaries, flags and abort criteria (Chapter 9).

Progressive-delivery controller. A controller, such as Argo Rollouts, Flagger or Kargo, that shifts traffic or promotes a release in stages against analysis and aborts it on failure. Its analysis is the releaser's check and not the independent probe (Chapter 9).

Provider (AI Act). The organisation that develops an AI system or has it developed and places it on the market or puts it into service. It reports serious incidents under Article 73. An organisation that builds its own high-risk system is both provider and deployer (Chapter 14).

Provider notice. A message from a model or platform provider about a change or retirement, treated as a change request (Chapter 13).

Prune. The sync option that deletes live resources that have left the declaration. It is off by default in Argo CD, and the book never uses Level 4 for a prune that would delete data (Chapter 8).

Q

Quality probe. A scheduled test of the output of an AI service against a sentinel set, since an error rate does not show a quality defect (Chapter 13).

R

Read. The action class that reads telemetry, configuration or tickets. Level 4 by default, falling to Level 3 with redaction where the data class requires it (Chapter 4).

Reconciler. A controller or engine that applies desired state and corrects drift, such as Argo CD, Flux or a Kubernetes controller. It is a change actor whose identity is its reach (Chapter 8).

Reconciliation. One pass of a control loop in which actual state is compared with desired state and a change is made or requested to close the gap (Chapters 4 and 8).

Reconfigure. The action class that changes settings or thresholds: Level 2, and Level 0 for any alert, threshold or monitor (Chapter 4).

Recovery point objective (RPO). The maximum tolerable loss of data, measured in time, for a service (Chapters 4 and 19).

Recovery time objective (RTO). The maximum tolerable time to restore a service (Chapters 4 and 19).

Register of information. The register of all ICT third-party contractual arrangements that DORA Article 28(3) requires, distinguishing those that support critical or important functions. The templates are in Implementing Regulation (EU) 2024/2956 (Chapters 23 and 24).

Regression case (REG-*). A test case written from a mechanism that tries to cross an agent's ceiling and is re-run to show that the control still holds (Chapter 18).

Release manifest. The list of everything whose change can change an AI service's behaviour (model, prompt, index, tools, parameters, evaluation set). A change to any line passes the change path (Chapter 13).

Resilience claim. A statement that a service is recoverable, with scope, objective, measured recovery time and point, date and result; untested is not recoverable (Chapters 4 and 19).

Resilience register. The register of resilience claims and their states, drawn outside the loop, whose denominator is every claim made (Chapters 4 and 19).

Restore. See O4 Restore. In the action classes, restore-overwrite is the class that restores data over existing data; it is irreversible for what is overwritten and held at Level 1 (Chapter 4).

Restore-test record (RST-NR-*, RST-HM-*). The measured result of a restore or failover test: scope, time and point against target, date, result and evidence expiry. Default evidence clocks are 90, 180 and 365 days by kind of test (Chapter 19).

Ring. A stage of a rollout, from a test tenant to a small share of traffic to wider shares (Chapter 9).

Role charter (ROLE-*). The charter that states a role's purpose, decision rights, duties and limits, such as that of an operations conductor (Chapter 21).

Rollback. The action class that reverts a release or configuration; Level 2, Level 3 for automatic rollback inside the change's own stop condition and only with a tested way back (Chapter 4).

Root cause. The term the regulations use; DORA Article 17(2) requires procedures that ensure root causes are identified, documented and addressed. The book's reviews list contributing conditions and meet the term without giving up the method (Chapter 12).

Rota. The on-call schedule. Standby rotas are negotiated with employee representatives (Chapter 25).

Runbook. A documented procedure for an operations task. In the book it is code, with an owner, a review date and a test (Chapter 10).

Runbook manifest (RBK-*). The runbook as code: action class, level, preconditions, verification by an independent probe, rollback and stop path (Chapter 10).

Runbook runner. The agent role that executes runbooks and is the only one that routinely touches production (Chapter 16).

S

Scale. The action class that changes capacity within quota; Level 3 within quota and cost cap (Chapter 4).

Scribe. The agent role that drafts the incident timeline and reviews (Chapter 16).

Seeded fault / seeded error. A known fault, alert or false entry deliberately introduced to measure whether observers and reviewers find it. Variants include the silent-failure, observer-loss and stop-path seeds (Chapters 12 and 17).

Self-heal. The sync option under which a reconciler re-applies the declaration when live state deviates. It is a reconfigure action, and a person's reversal of it counts against the budget of the drift class (Chapter 8).

Self-verification share. The share of actions whose only verification came from the executing agent or a system sharing its model family and failure domain; the target is zero for any class at Level 3 (Chapter 20).

Sentinel set. A fixed set of tasks run continuously against an AI service to detect a change in quality (Chapter 13).

Service level agreement (SLA). A contract with users that includes consequences for meeting or missing the objective (Chapter 5).

Service level indicator (SLI). A carefully defined quantitative measure of an aspect of the service, such as latency or error rate (Chapter 5).

Service level objective (SLO) and SLO record (SLO-NR-*, SLO-HM-*). A target value or range for a service level measured by an SLI, kept as a versioned record with its error budget and burn-rate alerts (Chapter 5).

Service owner. The person who accepts the residual risk of what an agent may do to the service (Chapter 16).

Service record (SVC-NR-*, SVC-HM-*). The unit of the service catalogue: identifier, tier, owner, on-call route, dependencies, objectives and recovery objectives (Chapter 5).

Service desk. The ITIL intake and fulfilment function. A request that changes nothing in the estate is not a function of the loop (Chapter 4).

Shadow mode. Running a new model or agent beside the live one without acting on its output, to compare results before release (Chapter 13).

Shared responsibility. The division of duty between customer and provider, made practical as a runbook class for provider outages (Chapter 24).

Site reliability engineering (SRE). The discipline that asks a software engineer to design an operations team, with SLOs, error budgets, toil limits and blameless review (Chapter 2).

Speculation. The label for a statement about the future that no source supports and the design rules may exclude (AI Governance, Chapter 22).

Standard change. A low-risk, well understood, pre-authorised kind of change that may be made without separate approval each time. A model, prompt or routing change is never a standard change in Hansa Mutual's rule (Chapters 8 and 13).

State engine. The book's term for a reconciling controller or a durable workflow engine that holds a declared state or procedure and acts on the gap without a person; a delegated actor under the autonomy budget (Chapters 2, 4, 8 and 10).

State file. The record that binds declared resources to real objects in Terraform and OpenTofu. It can hold secrets, so it is treated as sensitive, and write access to it is write access to the objects (Chapters 8 and 18).

Stop drill. A drill that stops a running agent while the platform is degraded, with the time measured against a target (STOP-*, SPT-*) (Chapters 4 and 17).

Stop path. The route by which named people halt an agent's grants without passing through the platform it stops. It is held by a person on every shift (Chapters 4 and 17).

Stop test. The third observer test: the stop path works when the platform does not (Chapter 4).

Stop-path time. The measured time for a person to stop an agent from outside its platform (Chapter 20).

Switching. Moving from one data processing service to another under Chapter VI of the Data Act (Chapter 24).

Sync policy. The settings of a reconciler for what it may do alone (automated sync, self-heal, prune, retry, windows, ignore rules). It is the reconciler's mandate and is reviewed as one (Chapter 8).

Sync window. In Argo CD, a cron-scheduled allow or deny period for syncs; deny overrides allow, and an application with no matching window is open. A second line behind the policy decision point (Chapter 8).

T

Threat-led penetration testing (TLPT). The testing that DORA Article 26 requires at least every three years of the entities identified, on live production systems supporting critical or important functions, with the participation of the providers in scope (Article 26(2) and (3)) (Chapters 19 and 23).

Tier 0. The assets that control the estate. The operator's agents, runbook libraries, observability pipeline and control plane are Tier 0 (Chapters 4 and 18).

Tier 1. The criticality tier of services whose failure the organisation cannot bear, such as identity and the claims core. Evidence for a Tier 1 service expires on its clock or on a substantive change, whichever comes first; the clock is 180 days for restore and failover tests by the book's default, inside the yearly legal floor (Chapters 4 and 19).

Toil. Work tied to running a production service that is manual, repetitive, automatable, tactical, without enduring value and that scales linearly as the service grows (Chapters 2 and 20).

Triager. The agent role that retrieves past incidents and runbooks, ranks hypotheses and proposes a route; it does not declare an incident or mark a cause established (Chapters 7 and 16).

U

Undelegated. The state of any action class not listed in a delegation profile: an agent with a technical permission has no authority to use it (Chapter 4).

Untested. The status of a claim for which no test has been run; it counts in the denominator of the register (Chapters 4 and 19).

V

Verified. The state of a claim for which a passing test exists, attested, not expired, with no listed change since. Only a verified claim may be written as recoverable (Chapters 4 and 19).

Veto. The right of the service owner, and of the incident commander during an incident, to block, reverse or suspend a proposal without giving a reason to the agent, held outside the agent's platform (Chapter 11).

W

Window. The time during which an agent may act: inside an authorised change window, outside a freeze, outside dates of scheduled tests and, for capacity reductions, outside forecast peaks (Chapters 4 and 11).

Workaround. The documented way to keep service running while a known error remains (Chapter 12).

Workflow engine. An engine, such as Temporal or Argo Workflows, that executes a procedure step by step and keeps its progress, used to run runbooks (Chapter 10).

Works council and co-determination. The employee representation rights that govern on-call, monitoring and performance measures (Swedish MBL; BetrVG § 87 in Germany). Tools that log engineers' commands are agreed before use (Chapters 23 and 25). In Germany section 87(1) number 6 covers technical devices designed to monitor behaviour or performance, which the Federal Labour Court reads as devices objectively suited to collect or record such information, whatever the employer intends (26, Germany, n.d.); (311, Bundesarbeitsgericht, 2024).