GLOSSARY

Agentic terms: agentic endpoint security definitions

Actor trail

A record of each agent action that shows who started the session, whether a person approved the step, and the chain from prompt to system action. It lets an investigator tell a person's act from an agent's.

Related: Lesson 10

Agent hook

A point an AI agent exposes where outside code can run before or after a step, for example before each tool call. Pre-execution controls often depend on hooks.

Source: Lasso Security: AI coding assistants · Read 27 Sep 2026

Agentic endpoint security

The control layer for AI agents that act with a person's access on laptops, desktops and cloud workspaces: finding them, setting rules on what they may do, and deciding on single actions before they run.

Related: Lesson 1

Agentless deployment

Deployment that leaves no new resident software on the device, for example a short-lived binary pushed through existing EDR or MDM.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

AI agent

Software that takes a goal in plain language and acts on it in steps, such as reading files, running commands and calling tools, with the access of the person or service that runs it.

AI-BOM

An AI bill of materials: an inventory of the models, agents, MCP servers, datasets and AI components in use.

Source: Lasso Security homepage · Read 27 Sep 2026

AI-SPM

AI security posture management: finding misconfigurations and excessive permissions in AI systems before they are exploited.

Source: Noma Security homepage · Read 27 Sep 2026

Allow, Ask, Deny

A set of three verdicts on an agent action: let it run, pause and ask a person, or stop it. Bay uses this wording.

Source: Bay homepage · Read 27 Sep 2026

Ask a person

A verdict that pauses an agent action and asks the user or an approver whether it should run.

Related: Lesson 3

Capability rule

A rule about what an agent may do, such as run a shell, install a package, call a cloud CLI or connect to an MCP server, rather than about the words in a prompt.

Related: Lesson 9

Cloud CLI

A command line tool for a cloud provider, such as the AWS, Google Cloud or Azure CLI, or kubectl for Kubernetes. An agent on a laptop can change cloud infrastructure through one.

Cloud workspace

A development or work environment that runs in the cloud rather than on the user's own device, where an agent may run without a company laptop in the path.

Related: Lesson 4

Coding agent

An AI agent that writes and changes code and usually runs commands in a terminal or IDE, such as Claude Code, Cursor, GitHub Copilot, OpenAI Codex or Windsurf.

Desktop agent

An AI agent that works across desktop applications and files on a user's computer, such as Claude Desktop.

EDR

Endpoint detection and response: software that watches processes, files and network activity on devices for malware and intrusion. Agentic endpoint products work alongside it.

Ephemeral binary

A program that runs on a device for a short task and exits, leaving nothing resident. Bay describes its Wave component this way.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

Excessive Agency

An entry in the OWASP Top 10 for LLM Applications covering AI systems that are given more capability, permission or autonomy than they need. It ranks third in the 2026 edition.

Source: OWASP GenAI Security Project: 2026 Top 10 for LLM Applications (1 September 2026) · Read 27 Sep 2026

Ghostjacking

Bay's name for indirect prompt injection that turns a trusted agent's legitimate permissions into the attack path.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

Indirect prompt injection

An attack in which instructions hidden in content an agent reads, such as a web page, a file or a tool response, change what the agent does.

Managed settings

Configuration for an agent that an administrator sets centrally and the user cannot change, such as permission rules, allowed MCP servers and plugin sources.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

MCP (Model Context Protocol)

An open protocol that lets AI agents connect to tools and data sources through MCP servers.

Source: Model Context Protocol blog: specification 2026-07-28 · Read 27 Sep 2026

MCP gateway

A proxy that MCP traffic passes through, where a product can inspect, allow, block or change tool calls.

Source: Lasso Security: MCP security · Read 27 Sep 2026

MCP server

A program that exposes tools or data to AI agents over the Model Context Protocol, for example access to a code repository, a database or a ticketing system.

Named agent coverage

Our criterion that counts how many of six tracked agents a vendor names on its own pages. It carries 5% of the score.

Related: Our scoring

Post-tool response

The result a tool returns to the agent, which can itself carry injected instructions and can be inspected before the model sees it.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

Pre-execution control

A decision on an agent action made before the action runs, as opposed to detection after it has run.

Related: Lesson 2

Pre-tool call

The moment after a model proposes a tool call and before the tool runs; the main point where agent actions can be stopped.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

Session context

Information about the agent session used in a decision: who started it, what the agent did before, and what data it has touched.

Shadow AI

AI tools, agents and MCP servers in use without the knowledge or approval of the security or IT team.

Source: SentinelOne: Prompt Security, securing AI · Read 27 Sep 2026

Simulation mode

A way to run a rule that records what it would have decided without enforcing it, used to find false positives before people are blocked.

Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026

Tool call

A structured request from a model to run a tool, such as a shell command, a file read or an MCP tool, with arguments.

Verdict

The decision a control returns on an agent action. Our census tracks six types: block, ask a person, alert or warn, mask or modify, simulate first, and remove or scale back.

Related: Verdict census