AI & vibe coding glossary

AI systems that take actions in the world over multiple steps, not just produce a single response.

Software development where an AI agent autonomously plans, writes, tests and ships code with minimal human keystrokes.

The practical knowledge and judgement needed to use AI tools effectively and safely in a workplace context.

A structured assessment of how prepared an organisation is to adopt, govern and get value from AI tools and systems.

The maximum amount of text (measured in tokens) a language model can process in a single request, covering both input and output.

Numerical vector representations of text (or other content) that capture semantic meaning, enabling similarity search and retrieval.

A large AI model pre-trained on broad data that can be adapted to many downstream tasks.

A part-time or contract executive who provides AI strategy, governance and implementation leadership without the cost of a full-time hire.

Controls applied around or inside an AI system to constrain its outputs and prevent harmful, incorrect or out-of-scope responses.

When an AI model generates output that is plausible but factually incorrect or fabricated.

A neural network trained on large volumes of text that can generate, summarise, translate and reason about language.

An open standard from Anthropic that lets AI assistants connect to external tools and data sources securely.

An AI architecture that retrieves relevant documents from a knowledge base and feeds them to a model so the model answers from your data.

The hidden instructions sent to a language model before any user input, defining its role, rules and behaviour.

A specialised database that stores text or other content as numeric embeddings and supports similarity search.

Building software primarily by prompting an AI in plain English rather than writing the code yourself.

A secret credential string used to authenticate a calling application to an API, granting it access to that service's resources.

A browser security mechanism that controls which origins are permitted to make requests to an API or resource from client-side JavaScript.

An attack where malicious script is injected into a trusted website and runs in other users' browsers.

Technology and policy controls that detect and prevent sensitive data from being sent to unauthorised destinations, including AI tools.

A login security control requiring two or more verification factors so a stolen password alone is not sufficient to compromise an account.

A list of the most critical web application security risks, maintained by the Open Web Application Security Project.

An authorised simulated attack on a system to find vulnerabilities before a real attacker does.

An attack where untrusted input contains instructions that the AI model follows, overriding the developer's intent.

A model where permissions are granted to roles, and users are assigned to roles, rather than permissions being assigned per user.

The accidental exposure of a credential, API key, private key or password in source code, a git repository or a public-facing file.

The use of AI tools by staff without IT or management knowledge or approval, often involving personal data sent to consumer AI products.

Postgres feature, exposed in Supabase, that enforces per-row access rules so the database itself decides who can see or modify each row.

A security model where no user, device or service is trusted by default, including those inside the network perimeter.

An HTTP response header that tells browsers which sources of script, style, image and other content the page is allowed to load.

A named value injected into an application at runtime, used to configure behaviour and inject secrets without committing them to code.