Glossary, Shadow AI Blue Team Manual

This glossary starts with the terms the manual needs from the outset and expands as later chapters introduce more. Where a term has two common meanings in security, both are given, because the ambiguity is a frequent source of confusion.

access token: A short-lived bearer credential a client presents to an API to act for the user, listing the granted scopes and an expiry. Whoever holds it can use it until it expires, so a stolen access token is usable by a thief the resource server cannot tell apart from the user.
activity explorer: The view in Microsoft Purview where individual data-related activities can be examined: who did what, to what, with which policy match. It is where a data loss prevention alert stops being a number on a dashboard and becomes a specific event, and where prompt content appears when a collection policy has been configured to capture it.
adaptive protection: A mechanism that varies enforcement by the risk level Insider Risk Management has computed for an individual, so that most staff experience an audit posture while a small elevated-risk group is blocked with an option to override. It currently applies to Exchange, Teams and devices. It is powerful and it makes the control a person experiences depend on a machine's judgement about them, which is a governance question as much as a technical one.
admin consent: An administrator's approval, on behalf of the tenant, for an application to receive permissions, required for tenant-wide access or for scopes too sensitive for user consent. Once granted for delegated permissions, users can use the application without their own consent screen.
agent (AI): Software that lets a model call tools and reach data sources on a user's behalf, so the model issues its own requests rather than answering inside a chat box. Agents are a growing shadow AI surface because the traffic they generate is API calls from a script or a service, not a person typing into a browser, so browser-resident controls see none of it.
analytics tier: The interactive, high-performance storage tier in a log platform, where recent data is held and queried without a per-query charge. In Microsoft Sentinel it holds ninety days by default and can be extended to two years. Data beyond it moves to cheaper storage that is charged when read.
API Application Programming Interface: A defined way for one piece of software to ask another for data or an action, without a human in the loop. When an AI vendor and a company connect "server to server", they are using an API, and that traffic never touches the staff member's browser or device.
API connector: A server-to-server integration that reads a cloud application's own records through its interface, rather than inferring activity from network traffic. It produces real events instead of guesses, and it works only for applications that expose an interface and that somebody has connected. There is no connector for a consumer AI service used with a personal account, because there is no tenant to connect to.
API key: A long secret string a user generates in a vendor's dashboard and places in code, an environment variable or a configuration file so that a program can authenticate to an API. It is a bearer credential belonging to the individual who created it, not to the organisation, which is why a staff member calling a model's API with their own key leaves no trace in the corporate identity layer.
APP Australian Privacy Principles: The thirteen principles in the Privacy Act 1988 (Cth) that govern how covered organisations collect, use, store and disclose personal information. They set the baseline a monitoring program must work within, including openness about what is collected and the requirement to collect only what is reasonably necessary.
app catalogue: The vendor-maintained directory that turns a discovered destination into a named application with attributes: what it is, who runs it, what certifications it holds, which category it belongs to. A generative AI category is what makes an AI-specific discovery report possible. An application the catalogue does not know is a destination without a name.
App Control for Business: The current name for Windows Defender Application Control, Windows' stronger form of application allowlisting. Policy is enforced close to the kernel and can be anchored to a hardware root of trust, which makes it considerably harder to circumvent than AppLocker. It is the mechanism that can stop a desktop AI client or a locally run model from launching at all, and it exists only on a managed device.
APP entity: The Privacy Act's term for a body it actually binds: an agency or an organisation. The point of the term is that a great many Australian bodies are neither. A university established under a State or Territory Act is a State or Territory authority, so it is not an organisation, and it was never an agency, so the Australian Privacy Principles do not apply to it and a State or Territory law does instead.
app governance: The capability in Microsoft Defender for Cloud Apps for reviewing and acting on applications that hold permissions against the tenant, including detection of risky or anomalous permission use. It is the control surface for the API-mediated path to shadow AI, and it functions as a queue that somebody has to work rather than as a sensor.
application object: The single global definition of an application, held in the tenant where it was registered, describing how tokens are issued to it, what it may access and what it can do. Each tenant that uses the application gets its own service principal derived from it. The distinction matters because permissions are recorded locally, per tenant, on the service principal.
application permission: A permission that lets an application act as itself, with no user, typically with tenant-wide reach; 'Mail.Read' as an application permission reads every user's mail. It always requires admin consent and its access survives any individual user's offboarding, so it needs explicit governance.
AppLocker: The older Windows application control mechanism, which allows or blocks programs from rules an administrator writes by publisher, file path or file hash. It still receives security fixes but no new features, and it has publicly documented bypasses, so it is best read as a hardening layer rather than a guarantee.
ASD Australian Signals Directorate: The Commonwealth agency responsible for signals intelligence and cyber security, and the publisher of the Information Security Manual (ISM) that many Australian government bodies align to. Its guidance often sets the practical bar for what "reasonable" security looks like in the public sector.
AUP Acceptable Use Policy: The document that tells staff what they may and may not do with an organisation's systems. It is the governance instrument that usually has to change first when an organisation decides how it will treat consumer AI tools.
authentication: Proving that the person making a request is who the account claims. It is answered by the identity provider, using factors such as a password, a code from a phone, or a passkey, and it is distinct from authorisation.
authorisation: Deciding what an authenticated user, or an application acting for them, is allowed to do. It can outlive authentication, because a token issued at sign-in keeps working until it expires or is revoked, which is where many identity-layer problems sit.
authorisation code flow: The dominant OAuth flow, in which the browser carries a one-time authorisation code that grants nothing until the client exchanges it, server to server, for tokens. It keeps long-lived credentials off the browser-visible front channel.
authoritative name server: A server that holds the definitive DNS records for a domain and answers for it. A recursive resolver works down the naming hierarchy to reach the authoritative servers for the name it is resolving.

back channel: The server-to-server, HTTPS path between an OAuth client and the authorisation server. It is confidential to the two endpoints and is where tokens and client secrets travel, unlike the browser-visible front channel.
bearer token: Any credential that grants access to whoever presents it, with no further proof that the presenter is the party it was issued to. Access tokens, refresh tokens and API keys are all bearer tokens, which is why a stolen one is usable by a thief the resource server cannot tell apart from the legitimate holder.
browser data security: Microsoft's name for data loss prevention built into Edge for Business and enforced by the browser itself, rather than by an agent below it. Because the control lives inside the browser it applies in the work profile without the device being onboarded, which makes it the only content-aware control in the Microsoft set that reaches an unmanaged machine. Also called inline DLP.
browser extension: A third-party program installed into a browser profile, running with a set of permissions declared at install time. An extension granted access to a site can read and change the pages it loads, which is the position both a corporate data loss control and an unvetted page-summarising AI tool occupy.
browser process: The trusted core of a modern browser: the process that talks to the network and the disk, draws the window, and holds the cookie and password stores. Every other part of the browser has to ask it for anything of consequence, which makes it the browser's own equivalent of an operating system kernel.
browser profile: The unit of identity and state inside a browser, holding one set of cookies, sessions, saved sign-ins, settings and installed extensions, isolated from other profiles in the same installed browser. Organisational browser policy attaches to a profile rather than to a person or an installation, so which profile a page is open in decides whether a control is present at all.
BYOD Bring Your Own Device: Staff using their own phones, laptops or home computers for work. BYOD is the recurring hard case in this manual, because most technical controls assume a device the organisation manages, and a personal device on home Wi-Fi sits outside almost all of them.

CA Conditional Access, or Certificate Authority: Two unrelated meanings that share initials. Conditional Access is Microsoft Entra's policy engine that decides, at sign-in, whether to allow access and on what conditions. A Certificate Authority is an organisation that issues the digital certificates used to prove a website's identity in TLS. The manual always says which it means.
CAE Continuous Access Evaluation: A mechanism that lets supporting services re-evaluate a session and revoke a token within a minute or two when risk rises or an admin revokes sessions, instead of waiting for the token to expire. Coverage is uneven across services.
CASB Cloud Access Security Broker: A category of tool that sits between users and cloud apps to discover which apps are in use and, sometimes, to control them. "Shadow IT discovery", the report that an organisation is quietly using forty AI tools nobody approved, is a classic CASB function.
CDN Content Delivery Network: A distributed set of servers that serve a website's content from a location near the user. CDNs matter here because many services, including AI front ends, share CDN addresses, so a block or an observation made purely on IP address can catch or miss the wrong thing.
certificate: A signed digital document that binds a server's name to its public key, so a client can confirm it is talking to the real server. It is signed by a Certificate Authority the client already trusts, and checked against the client's trust store during the TLS handshake.
certificate pinning: Building a client to accept only a specific certificate or authority for a service, and to refuse any other. Pinning defeats TLS inspection for that client, because the client rejects the organisation's substituted certificate.
CGNAT Carrier-Grade NAT: A second layer of Network Address Translation run by an internet provider, sharing one public address across many customers. It weakens attribution further, because even the public address seen from a home connection may belong to many households. The range 100.64.0.0/10 is reserved for it.
CIDR Classless Inter-Domain Routing: The notation and scheme for writing a network's size as a slash and a number, such as /24, marking how many leading bits of an address are the network part. It replaced the older fixed address classes and is how subnets are described today.
client (OAuth): In OAuth, the application requesting access to a user's data, such as an AI service, not the user's browser. The browser is the user agent through which the flow runs.
clipboard: A shared buffer the operating system maintains, which any running program can write to and any running program can read from. It is the ordinary route by which text crosses from one application to another, and because it is managed by the operating system it is a real place that a sufficiently privileged control can watch, which is what makes 'block pasting into AI tools' a coherent control rather than an aspiration.
cloud discovery: The process of working out which cloud services an organisation's people are using, by inferring it from traffic rather than by asking anyone. It draws on endpoint agent telemetry, on logs from firewalls and proxies, and on gateway integrations. Every feed has a coverage boundary, so the resulting count is always a lower bound.
cloud service model: The conventional description of how far up the stack a provider operates, and therefore where the customer's responsibility begins. Infrastructure, platform and software as a service are three common cut points. The model matters to a defender because the layers below the cut cannot be instrumented by the customer at all.
collection notice: The notice a privacy principle requires an organisation to give when it collects personal information: who it is, why it is collecting, what happens if you do not provide the information, who it usually discloses to, and how to access, correct and complain. It is not the same document as a workplace surveillance notice, which describes the watching rather than the handling. An organisation running staff monitoring needs both.
collection policy: The Microsoft Purview policy that determines what is gathered about interactions with AI applications. The default position for third-party AI sites detects that sensitive information was shared and does not retain the text; capturing prompt and response content is a separate setting that has to be turned on deliberately. Retention, eDiscovery and communication compliance for those applications all depend on it.
compliance budget: The idea, from security usability research, that an employee's willingness to comply with security rules is a finite resource that gets spent. A control that is disproportionate does not just fail on its own terms; it consumes willingness that is then unavailable for the controls that matter more. Ten rules that staff follow beat forty that they do not.
compliant device: A device that has reported to a management service such as Intune within its policy window and is currently passing the compliance policy. 'Require compliant device' is the most leveraged single Conditional Access control at the device boundary.
computer surveillance: Defined in s 3 of the Workplace Surveillance Act 2005 (NSW) as surveillance by means of software or other equipment that monitors or records the information input or output, or other use, of a computer. Endpoint agents, browser extensions, data loss prevention policies and proxy logs are all inside that definition without argument. In New South Wales it may only be carried out under a notified policy, and the Australian Capital Territory has an equivalent for data surveillance devices.
confidence level: The measure of how much supporting evidence a classifier found alongside a pattern match, used with an instance count to decide whether a policy fires. Raising the threshold reduces false positives and increases false negatives, and there is no setting that avoids both.
configuration profile: A signed document that expresses macOS or iOS policy: settings, restrictions, certificates and permission grants. Delivered by an MDM, it is the Apple equivalent of a protected registry value or a Group Policy setting. A profile installed by the MDM a device is enrolled in cannot be casually removed by the user.
CONNECT method: An HTTP method a client uses to ask a forward proxy to open a tunnel to a destination. In a pass-through proxy the CONNECT names the destination, but the tunnel's contents stay encrypted and unreadable to the proxy.
connector: The component that brings data from a source system into a central platform such as a SIEM. The phrase worth remembering is that a platform can only show what its connectors receive, which is why a mature deployment with poor connector coverage produces confident and empty answers.
consent: A user's or administrator's approval for an application to receive specific permissions against an account or tenant. A consent grant persists as tenant state until revoked, which is why it can outlive the user who granted it.
consent screen: The screen an authorisation server shows during sign-in, listing the scopes an application is requesting. It is the point at which a user authorises an AI vendor's access, and a user trained to read it is a cheap, effective control.
consultation term: A clause that s 205 of the Fair Work Act 2009 (Cth) requires every enterprise agreement to contain, obliging the employer to consult employees about major workplace changes likely to have a significant effect on them. Where an agreement lacks a compliant clause, a model term prescribed by regulation applies instead. Introducing staff monitoring is a change in technology capable of triggering it, which is why deployment plans in unionised workplaces start with a consultation date.
container: A process, or small group of processes, running on a host's shared Linux kernel but given its own isolated filesystem, network and process tree, so that it behaves like a separate machine without being one. Containers are how nearly every AI service is actually run, and how a staff member can run a model locally without installing anything that looks like an application.
containment: The first step of a data breach response, normally meaning stop the spread: isolate the host, revoke the token, restore the file. When the disclosure was a staff member pasting text into someone else's AI service, containment in that sense is unavailable, because the text cannot be recalled. It comes to mean four other things: stop the behaviour, preserve the evidence before it ages out, reconstruct what was actually sent, and record honestly what cannot be undone.
content script: The part of a browser extension that the browser injects into the process rendering a page, so it executes in the context of that page and can read and change the document. It runs in a separate execution context from the page's own scripts but sees the same content, which is precisely the position from which a prompt can be read before TLS encrypts anything.
control groups (cgroups): The Linux kernel feature that limits and accounts for the resources a process may use, such as memory and processor time. Paired with namespaces, it is one of the two kernel mechanisms that containers are built from.
control plane: The administrative surface of a system: where configuration is set, identities are managed and policy is written. Distinguished from the data plane, which is where the actual work and the actual data live. In software as a service the customer usually has a control plane and no access to the data plane at all.
cookie: A small piece of data a server asks a browser to store and send back on later requests, used to keep a user signed in across an otherwise stateless HTTP session.
correlation rule: A hypothesis about what a pattern of events means, written so that a machine can evaluate it continuously and raise an alert. Writing, testing, tuning and retiring rules is an ongoing engineering practice rather than a one-off configuration step.
covert surveillance: In the Workplace Surveillance Act 2005 (NSW), surveillance of an employee at work carried out by the employer and not in compliance with Part 2 of the Act. The definition matters more than it looks. Because Part 2 contains the notice and policy requirements, monitoring deployed without them is not merely non-compliant; it becomes covert surveillance, which is an offence unless a Magistrate has issued an authority.
CSPM Cloud Security Posture Management: The original posture management category, created to answer whether cloud infrastructure is configured the way the organisation believes it is. It reads configuration continuously and compares it to a baseline, producing findings to fix rather than alerts to investigate. Data security posture management, and its AI variant, apply the same method to different objects.
custom indicator: An organisation-supplied instruction to allow, warn on or block a specific address, domain or URL at the endpoint. In a Microsoft estate it is enforced by SmartScreen in Microsoft's own browsers and by network protection elsewhere, which is why the granularity and the browser dependencies differ between the two.

daemon: A background program that runs system-wide under a system account, started before and independently of any user logging in. A security agent on a Mac runs as a daemon, which is the macOS form of a Windows service running as LocalSystem. Contrast a launch agent, which runs only inside a logged-in user's session and has that user's reach, no more.
data controller: The party that decides why and how personal information is handled. In an AI context the distinction from a processor is the whole question about a vendor: a processor handles data on your instructions and under your contract, a controller decides for itself. Free consumer AI services are generally not acting as your processor, which is what the enterprise data protection commitment in a work-account service is designed to change.
data lake: A storage tier designed to hold large volumes of security data cheaply for long periods, with the cost moved from ingestion and retention to query time. It suits exactly the shadow AI case, where the question is rare, specific and historical, and it does not make retention free; it changes where the bill falls.
data minimisation: Collecting the least information that will do the job, and keeping it no longer than needed. Australian regulator guidance treats it as implicit in the statutory requirement that collection be reasonably necessary, and describes the standard as relevant, minimal and not excessive. In monitoring design it is the principle that argues for metadata over content.
data plane: The part of a system where the actual data lives and the actual work happens, as distinct from the control plane where it is administered. The distinction explains why a customer can hold every administrative right in a software service and still be unable to inspect the machine holding the data.
data processor: A party that handles personal information on another party's instructions rather than for its own purposes. Whether a cloud AI service is acting as a processor is a contractual question, not a technical one, and it is the difference between a governed tool and an ungoverned one. See also data controller and enterprise data protection.
data surveillance device: A device, and in some statutes expressly a program, capable of recording or monitoring the input to or output from a computer. Most Australian surveillance devices Acts either do not regulate one at all or restrict the prohibition to law enforcement officers. South Australia is the exception: its Act prohibits anyone from using one without the consent of the person with lawful control of the computer, which is why a monitoring agent on a personal device is a live question there.
decision record: A short written document setting out what an organisation has decided to do, what it has decided not to do and why, and what risk it therefore accepts. In shadow AI governance the second and third sections are the ones almost always missing, and their absence is what turns a reference architecture into a checklist.
default gateway: The router a device sends traffic to when the destination is outside its own subnet. It is the first hop out of the local network, and a natural place to apply egress control.
delegated permission: A permission that lets an application act as the signed-in user, limited to what that user may do; 'Mail.Read' as a delegated permission reads only the signed-in user's mail and stops working when the user is offboarded. It is the dominant pattern for shadow AI grants.
detection engineering: The discipline of building, testing, tuning and retiring the logic a security platform uses to find things. Treating detection content as a product bought once leaves an organisation defending against the threat landscape of whenever it was purchased.
device enrolment: The act of placing a device under management by an MDM such as Intune, after which the organisation can push configuration, deploy software and evaluate compliance. Enrolment is often confused with onboarding; Microsoft uses the two words for two different things, and enrolling a device does not by itself onboard it to any security service.
device onboarding: The act of switching on a security service's sensor on a device and connecting it to that service. In a Microsoft estate, onboarding activates the Defender for Endpoint sensor, and the same act onboards the device for Microsoft Purview, so Endpoint DLP and the Purview browser extension become available. It is the rung at which the whole device-side control set appears, and it requires an administrative action on a machine the organisation controls.
DHCP Dynamic Host Configuration Protocol: The service that automatically leases an IP address, and settings such as the gateway and DNS resolver, to a device when it joins a network. The lease record is what later maps an internal address back to a device at a given time, so whether it is retained decides whether attribution is possible.
DLP Data Loss Prevention: Controls that detect or block sensitive information leaving a boundary, whether that is a file at rest, an email in motion, or text pasted into a web page. DLP is a family of quite different problems depending on where it operates, which is why the manual treats "at rest", "in motion" and "at the endpoint" separately.
DMZ Demilitarised Zone: A network segment that holds internet-facing services while being walled off from the internal network, so that a compromise of a public service does not immediately reach internal systems.
DNS Domain Name System: The system that turns a human-readable name such as chat.openai.com into the numeric IP address a computer needs to connect. Because the lookup happens before the connection, DNS is a common and cheap place to block a site; it is also easy to bypass, which is a running theme in Part One.
DoH DNS over HTTPS: A way of sending DNS lookups inside an encrypted HTTPS connection so that the network cannot read or tamper with them. DoH improves privacy for the user and also defeats DNS-based blocking, which is why it appears repeatedly as an evasion path.
DoT DNS over TLS: Like DoH, it encrypts DNS lookups to a chosen resolver, so the organisation's resolver is bypassed and DNS-based blocking does not apply. It uses its own dedicated port rather than blending into ordinary web traffic.
DSPM for AI Data Security Posture Management for AI: A newer product category that aggregates signals about how staff use AI tools and what data reaches them. It is an orchestration surface rather than a sensor of its own; what it can actually see depends entirely on the underlying network, endpoint and identity controls feeding it.

ECH Encrypted Client Hello: An extension to TLS that encrypts the first message of a connection, including the site name that was previously visible as the SNI. Where ECH is in use, a network device can no longer read which site a user is visiting from the handshake alone. It is still being rolled out and is not universal.
Edge for Business: Microsoft Edge running under a work profile signed in with the organisation's Entra identity, carrying the organisation's policy and managed extensions. It is not a separate browser download. In a Microsoft shop it is the only device-side control surface that reaches an unmanaged personal device, because its data loss features live inside the browser rather than in a privileged agent below it.
EDR Endpoint Detection and Response: An agent installed on a managed device that reports detailed telemetry, process launches, network connections, file activity, back to a central console, and can respond to threats. EDR only exists on devices the organisation has onboarded, which is the boundary of much of its visibility.
eligible data breach: The trigger for mandatory notification under the Privacy Act 1988 (Cth) s 26WE(2): unauthorised access to, or unauthorised disclosure of, personal information, or its loss, where a reasonable person would conclude serious harm is likely. A staff member pasting client information into a consumer AI service is a disclosure, not an access event and not a loss, and naming it correctly changes how the harm assessment reads. Several states run their own equivalent schemes.
employee record: Defined in the Privacy Act 1988 (Cth) s 6(1) as a record of personal information relating to the employment of an employee, with an inclusive list running from health information and performance to leave and banking details. The definition matters because the employee records exemption attaches to it. Information about somebody who is not the employee is not in it, however it was collected.
employee records exemption: Section 7B(3) of the Privacy Act 1988 (Cth), which exempts an organisation's handling of an employee record where the act is directly related to a current or former employment relationship. Three limits are routinely missed: it is available to organisations only, so no public sector body can use it; it reaches only information about the employee; and reform proposals to narrow it have been made and not enacted.
endpoint DLP: Data loss prevention enforced on the device itself, acting on activities rather than files: copy to clipboard, copy to removable media, print, upload to a site, paste into a browser. It sees content before encryption, which is why it can act at all, and it requires the device to be onboarded, which is why it reaches no personal machine.
Endpoint Security framework: The Apple-defined interface through which a macOS security agent subscribes, from user space, to a curated stream of process, file and network events. It replaced reading system calls from inside the kernel, and it requires both an Apple entitlement and the relevant TCC grants, so what an agent can observe on a Mac is what Apple chooses to expose.
enterprise agreement: A collective industrial instrument made between an employer and its employees under the Fair Work Act 2009 (Cth). It matters to monitoring for two reasons: it must contain a consultation term about major workplace change, and in the higher education sector it often contains its own clauses about surveillance and monitoring that are more restrictive than any statute. It is the first document to read, not the last.
enterprise application: In Entra, the per-tenant object representing a third-party application granted access to the tenant, carrying its consents, permissions, assigned users and sign-in history. A consumer AI tool becomes one the moment a staff member completes 'Continue with Microsoft'.
enterprise data protection: Microsoft's term for the contractual and technical commitments applying to prompts and responses in Microsoft 365 Copilot and Copilot Chat for users signed in with a work account: Microsoft acts as a data processor, and the content is not used to train foundation models. It is a change in the legal relationship rather than an increase in what the organisation can inspect.
Event Tracing for Windows: The supported Windows mechanism through which software can observe system activity without writing kernel code of its own. It is one instance of a wider pattern in which platform vendors mediate what security agents may see, which improves stability and puts a ceiling on what any vendor can promise.
exact data match: A classification technique that matches against the organisation's own values rather than against a pattern: a table of student or patient identifiers, hashed with a salt before upload so the service never holds them in the clear. Precision rises sharply and false positives fall, at the cost of building and refreshing the table.
Microsoft Entra hybrid joined: A device joined to an on-premises Active Directory domain in the traditional way and also registered with Entra, so it carries both identities. It is the common state in institutions with a long Windows history, and it inherits the on-premises constraint that the device needs a line of sight to a domain controller for initial sign-in and password changes.
Entra ID: Microsoft's cloud identity service, formerly Azure Active Directory. It holds the work accounts that staff sign in with, and it is the point at which Conditional Access and much of the identity-layer control in this manual is applied.
Microsoft Entra joined: A device joined to the directory itself, signed in to with a work account, and owned by the organisation. Joining ordinarily enrols the device in Intune as part of the same process. It is a stronger state than registration, and it is no longer Windows-only; current documentation lists recent macOS and several Linux distributions as capable of it.
Microsoft Entra registered: Also called workplace join. The state a personal device reaches when a user adds their work account to it, creating a device object and an identity footprint in the directory. Registration lets Conditional Access tell a known device from an unknown one; it does not enrol the device in management, onboard any sensor, or make the device compliant, and it adds no device-side shadow AI control whatsoever.

false positive: A match a classifier reports that is not what the policy was looking for. In data loss prevention it is not merely noise, because reviewing the alert means a person reads content the programme did not intend to collect, which makes a high false-positive rate a privacy problem as well as an operational one.
FIDO2: A set of open standards for strong, passwordless authentication using a physical or built-in security key. It matters to defenders because it resists phishing in a way that passwords and even many multi-factor methods do not.
forward proxy: A proxy in front of clients that mediates their outbound connections to the internet. It is the proxy type used to filter and inspect staff web traffic, including access to AI services.
forward secrecy: A property of a key exchange where each session uses fresh keys, so that later compromise of a server's long-term private key does not decrypt past sessions. It is standard in TLS 1.3.
FQDN Fully Qualified Domain Name: The complete name of a host, such as chat.openai.com, spelled out from the specific machine up to the top-level domain. Filtering and blocking often operate on FQDNs, so the distinction between a full name and a bare domain can decide whether a control fires.
front channel: The part of an OAuth exchange that runs through the user's browser via redirects. It is visible to anyone who can see the URL or the network in between, so by design it carries only short-lived identifiers, never secrets.

Gatekeeper: The macOS mechanism that checks software is signed and notarised by Apple before allowing it to run for the first time. It is a baseline integrity check rather than an enterprise allowlist, so it is a weaker analogue of AppLocker or App Control for Business and will not stop a staff member running a legitimately signed AI client.
GPO Group Policy Object: The traditional Windows mechanism for pushing configuration and restrictions to domain-joined machines. It is one of the older ways an organisation shapes what a managed device can do, and it has cloud-era successors in Intune policy.
Group Policy: The on-premises Active Directory mechanism for defining configuration centrally and having domain-joined machines pull and apply it, mostly by writing values into protected parts of the registry. Its unit of configuration is the Group Policy Object. Intune is its cloud equivalent for devices joined to Entra.

HTTP and HTTPS Hypertext Transfer Protocol, Secure: The application-layer protocol the web runs on, and its encrypted form. HTTP describes the requests and responses between a browser and a server; HTTPS wraps that exchange in TLS so that only the two endpoints can read the contents. The "S" is the reason a network device can see that you reached a site but not what you sent to it.
HTTP/2: A version of HTTP that carries several requests and responses over one connection at once. It changes how requests are framed, not what they contain, so the same headers and bodies are present.
HTTP/3: The version of HTTP carried over QUIC rather than TCP. It delivers the same requests and responses as earlier versions while inheriting QUIC's encryption and connection behaviour, which reduces what on-path devices can observe.

IaaS Infrastructure as a Service: A cloud service model in which the provider runs the building, the hardware, the network and the virtualisation, and the customer runs the operating system upward. The customer can install an agent and observe the system, because the operating system is theirs.
ID token: An OpenID Connect token, a signed JWT, that tells the client who the user is. It is not a credential for calling an API; that is the access token's job, and confusing the two is a common error.
IdP Identity Provider: The service that authenticates a user and vouches for them to other applications. In a Microsoft organisation the IdP is usually Entra ID; when a third-party AI tool offers "sign in with Microsoft", it is trusting that IdP to say who you are.
ingestion: Bringing data into a log platform, and the point at which most of the cost is incurred, since it is normally priced per gigabyte. Because ingestion is expensive, agents and pipelines filter at the source, which means the questions answerable later were decided before anyone asked them.
inline DLP: Data loss prevention performed inside the browser's own view of a page, reading typed or pasted text at the point of submission and before TLS encrypts it. In Edge for Business it can audit or block prompts containing sensitive information sent to a defined set of consumer AI sites, and it applies without the device being onboarded, which is what distinguishes it from Endpoint DLP.
intelligent enablement: The argument that providing a governed tool that is easier to reach than an ungoverned one does more to reduce risk than blocking does. It is widely asserted by vendors and is consistent with the research on security workarounds, though no study has measured the effect for generative AI specifically. Its dependency is uncomfortable: the sanctioned tool has to be good enough at the task.
interception: Under the Telecommunications (Interception and Access) Act 1979 (Cth), listening to or recording a communication in its passage over a telecommunications system without the knowledge of the person making it. Both elements do work. Reading content before it is sent or after it arrives is not interception in passage, which is much of why enterprise controls instrument the browser rather than the wire, and proper notice can defeat the knowledge element.
Intune: Microsoft's cloud device management service, the modern equivalent of Group Policy for devices joined to Entra and enrolled in management. Policy is defined in the cloud and applied on the device by its management agent. Intune also evaluates devices against compliance policy and reports the verdict to Entra for Conditional Access to act on.
invasiveness ladder: A way of naming how far a monitoring proposal goes, from aggregate metadata, through user-attributed telemetry and sensitive-information matching with metadata logging, to prompt content capture and then continuous behavioural analytics. It is a vocabulary rather than a maturity model; nothing about the ladder implies climbing it. The rule underneath it is that capability is not justification.
IP address Internet Protocol address: The numeric address that identifies a device or service on a network, so that packets can be routed to it. Controls that work purely on IP address are imprecise, because many services share addresses behind CDNs and load balancers.
IPP Information Privacy Principles: The privacy principles used by several state and territory public-sector regimes, including the Northern Territory, as distinct from the Commonwealth Australian Privacy Principles. A defender in the public sector often has to reason about both.
IPv6 Internet Protocol version 6: The 128-bit successor to IPv4, created to solve address exhaustion. It often removes the need for NAT, so devices can hold globally routable addresses, which changes both attribution and address-based blocking. Many networks run IPv4 and IPv6 together.
IRM Insider Risk Management: A set of controls that watch for risky behaviour by people inside the organisation and can raise a user's risk level. In the AI context, IRM can flag a user who repeatedly pastes sensitive text into a chatbot, provided the signal reaches it in the first place.

kernel: The core of an operating system: the part that runs with full hardware privilege, manages memory and devices, and polices every other program on the machine. Software running in the kernel can see and touch everything, which is why a control placed there is powerful and why placing one there is an administrative act that happens only on a managed device.

launchd: The first user-space process macOS starts at boot and the ancestor of every other process. It starts, stops and supervises background programs, restarting them if they fail. It is the macOS counterpart of the Windows Service Control Manager, and it is how a security agent on a Mac gets running and stays running.
LocalSystem: The most privileged built-in Windows system account. A service running as LocalSystem has effectively unrestricted access to the machine, which is why privileged security agents run under it. Seeing a process running as LocalSystem tells you it is on the privileged side of the boundary.
log collector: A component that receives logs from firewalls, proxies and gateways and forwards them for cloud discovery analysis. It needs no agent and no device state, so it covers personal devices on the organisation's network; it usually cannot attribute activity to a named person, because the record is a source address and a destination.

MAM Mobile Application Management: Managing an organisation's data inside specific apps rather than managing the whole device. MAM-WE, "without enrolment", is the version that protects work data on a personal phone without the organisation taking control of the device, which makes it one of the few controls that reaches BYOD.
MDCA Microsoft Defender for Cloud Apps: Microsoft's CASB. It discovers and can help control cloud app usage, drawing on endpoint telemetry or on network logs. What it sees about AI usage depends on which of those feeds is in place.
MDE Microsoft Defender for Endpoint: Microsoft's EDR product. It provides endpoint telemetry, custom blocking indicators, network protection and web content filtering, but only on devices that have been explicitly onboarded to it; identity registration alone does not onboard a device.
MDM Mobile Device Management: Managing a whole device: pushing configuration, compliance rules and apps to it. Full MDM enrolment is the state most technical controls quietly assume, and the state a personal device usually is not in.
MFA Multi-Factor Authentication: Requiring more than one kind of evidence to sign in, typically a password plus a code or an approval on a second device. It is a sign-in-time control, so it can gate access to an AI service that uses the work identity, but it says nothing about what the user does afterwards.
Microsoft Compliance Extension: The Microsoft Purview browser extension for Google Chrome and Mozilla Firefox, which brings data loss detection on uploads and pastes, plus Insider Risk Management browser signals. It is a front end only: its detection engine is the local Endpoint DLP service, so the device must be onboarded, which means it does nothing on an unmanaged personal device.
Microsoft Graph: The API through which applications read and write Microsoft 365 data such as mail, files and calendar. The scopes an AI tool is granted, such as Mail.Read, are Graph permissions, and Graph is the resource server those tokens call.
Model Context Protocol (MCP): An open standard for connecting models to external tools and data sources, now the common way agentic tooling is wired together. For a defender it matters because an MCP server is a program with access to data, reachable by a model, that no browser or identity control is watching.
multi-tenancy: One running system serving many customers at once, with separation enforced logically by the provider's code rather than physically by separate hardware. The separation is strong in practice and cannot be independently verified by the customer.

namespaces: The Linux kernel feature that partitions what a process can see: its own view of the filesystem, the process tree, and network interfaces. Namespaces are the mechanism containers are built from, paired with control groups.
NAT Network Address Translation: The technique that lets many devices behind one public IP address share it, rewriting addresses as traffic crosses the boundary. NAT is why traffic seen at a firewall may show one shared address for a whole office, which complicates attributing activity to a person.
NDB Notifiable Data Breach: The Commonwealth scheme in Part IIIC of the Privacy Act 1988 (Cth) requiring an entity to assess a suspected eligible data breach within thirty calendar days, notify the Commissioner, and notify affected individuals. New South Wales, Queensland and, from 2027, Western Australia run their own schemes for their public sectors, so a state body notifies its own regulator rather than the OAIC.
network protection: The Microsoft Defender for Endpoint component that enforces address, domain and URL blocking outside Microsoft's own browsers. It works out the destination of an HTTPS connection by reading the TLS handshake, which is why blocking in third-party browsers depends on QUIC and Encrypted Client Hello being disabled in those browsers.
network protection duties: A defined term in s 5 of the Telecommunications (Interception and Access) Act 1979 (Cth), covering duties relating to the operation, protection or maintenance of a computer network, and, only where the network is operated by or on behalf of a government agency, ensuring the network is appropriately used by employees. Note the asymmetry: checking whether staff are using tools appropriately is network protection for a government network and not for a private one. Not to be confused with Network Protection, the Microsoft Defender for Endpoint feature.
normalisation: Converting events from many sources into a common schema so that they can be compared and joined. The hard part is identity resolution, because the same person appears differently in every source, and a join that fails silently returns an empty result that reads like a clean bill of health.

OAuth 2.0: The standard by which a user grants one application limited access to their account on another, without handing over their password. When you click "allow" on a third-party AI tool's request to read your files, an OAuth grant is what you have created.
OIDC OpenID Connect: A thin identity layer built on top of OAuth 2.0 that lets an application confirm who the user is, not just what they may access. "Sign in with Microsoft" and "sign in with Google" are OIDC in practice.
one-click policy: A preconfigured policy offered by a posture management surface, deployable without authoring it. Useful because it names controls the organisation already owns and has not enabled; worth reading as a description of the mechanism underneath rather than as a feature in its own right.
OSI model Open Systems Interconnection: A seven-layer reference model for how network communication is structured, from the physical wire up to the application. It is a teaching and design tool rather than a description of any real protocol, and it is paired in practice with the four-layer TCP/IP model.

PaaS Platform as a Service: A cloud service model in which the provider runs everything up to and including the runtime, and the customer brings application code and data. Nobody patches an operating system, because the customer never sees one, and nobody instruments it either.
PAC file Proxy Auto-Configuration file: A file that tells a browser which proxy to use for which destinations. It is one way an organisation directs traffic to an explicit forward proxy.
packet: A unit of data sent across a network, carrying a payload wrapped in headers that tell the network where it is going and how to handle it. Understanding what is in a packet's headers, and what is hidden inside its encrypted payload, is much of what decides where a control can see.
penalty unit: The unit in which statutory maximum fines are expressed, so that the amount can be adjusted without amending every Act. Each jurisdiction sets its own value; in New South Wales it is $110, which makes the fifty penalty unit maximum for covert surveillance $5,500. The dollar figure is rarely the point; the characterisation of the conduct usually is.
personal information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether it is true or not and whether or not it is recorded. Two limbs matter for AI. 'Reasonably identifiable' means a username in a log qualifies. 'Whether true or not' means a model's fabricated statement about a named person is personal information the organisation now holds, which brings the accuracy principle into play.
phishing-resistant MFA: A class of multi-factor authentication, such as a passkey or FIDO2 key, that cannot be relayed by an adversary-in-the-middle page because it is bound to the legitimate site. Conditional Access can require it through authentication strength.
PIA Privacy Impact Assessment: A written assessment of how a project handles personal information and what the privacy risks are. It is mandatory only for Australian Government agencies, and only for high privacy risk projects, under the agencies privacy code; for everyone else it is good practice. Its real value is that it is the written reasoning a proportionality argument needs, produced before deployment rather than reconstructed afterwards under pressure.
PII Personally Identifiable Information: Information that identifies a person, or that could when combined with other data. In Australian law the operative term is usually "personal information", which is defined broadly; the distinction matters when reasoning about what monitoring is lawful.
PKCE Proof Key for Code Exchange: A safeguard that binds an OAuth authorisation code to a secret the client generates, so an attacker who intercepts the code cannot exchange it for tokens. It is now expected of all clients, public and confidential.
PKI Public Key Infrastructure: The system of Certificate Authorities, certificates and trust stores that lets a client verify a server's identity. TLS relies on it, and TLS inspection works by inserting an authority the managed device is made to trust.
post-incident review: The final step of an incident response, examining what happened and what should change. For a shadow AI disclosure the useful version widens past the individual: whether a sanctioned alternative existed and was reachable, whether training named the data class involved, what the discovery data had been showing, and how many other people were doing the same thing. A review whose only output is a training module has not finished.
posture management: The activity of continuously comparing a configuration against what was intended and reporting the gap. It is distinct from detection, which consumes events and produces alerts. Its characteristic finding is that a control the organisation already owns has never been switched on.
prevented delivery notice: The notice s 17 of the Workplace Surveillance Act 2005 (NSW) requires an employer to give when it blocks an email or access to a website, unless a narrow exception applies. It is the provision that catches a shadow AI programme by surprise, because unsanctioning a consumer AI service and pushing a block indicator is preventing access to a website, and a consumer AI service is not spam, malware or offensive content.
private address space: The IPv4 ranges reserved for internal use, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, which are not routed on the public internet. Internal devices use these addresses and rely on NAT to reach external services.
privilege boundary: The line between the kernel and userland, enforced by the processor in hardware rather than by policy or convention. A program on the unprivileged side cannot touch hardware or another program's memory and must ask the kernel for anything beyond its own address space. Where a security control sits relative to this line sets the ceiling on what it can possibly see.
process: A program in execution, given its own private view of memory by the kernel. One process cannot read or write another's memory, which is why a curious program cannot simply reach into the browser and read what is being typed, and why a control that wants to read a prompt must either be inside the browser or privileged enough to override the isolation.
proportionality: The requirement that a control be no more intrusive than the harm it addresses warrants. Australian regulator guidance treats it as implicit in the statutory 'reasonably necessary' test rather than as a separate principle, which makes it a regulatory expectation and not just an ethical preference. In practice it is a short list of questions with written answers, not a score.
Protective DNS: A managed, filtering DNS resolver used to block resolution of malicious or disallowed names and to log lookups. It is a cheap first control and a source of intent data, but only for devices that use it.
protocol: An agreed set of rules for how two parties communicate: what messages mean, in what order they come, and how errors are handled. Almost everything in Part One is a protocol, and each one exposes a different amount of information to a watcher.
proxy: A server that traffic is routed through on its way to its destination, so that it can be logged, filtered or inspected. A proxy can only act on what it can see; with HTTPS that is often just the destination name, not the contents.
PRT Primary Refresh Token: A credential Entra issues to a registered or joined Windows device that lets the user sign in to work apps smoothly. Its presence is part of what "registering" a device actually produces, and it is one reason adding a work account changes a device's identity footprint even without full management.
public IP address: An internet-routable address, as opposed to a private internal one. Through NAT, many internal devices share one public address, so a remote service records the organisation's public address rather than the specific device that connected.
Purview: Microsoft's compliance and data security suite, covering classification, data loss prevention, insider risk, audit, retention and eDiscovery, and the posture management surface for AI. Much of Part Four's Microsoft-specific detail sits here rather than in the security products.

QUIC: A modern transport protocol, carried over UDP, that builds encryption in from the start and now underlies much web traffic including HTTP/3. QUIC collapses several traditional layers together, which changes what older network tools can observe.

RBAC Role-Based Access Control: Granting permissions to roles rather than to individuals, then assigning people to roles. It is the common model for deciding who can see the monitoring data this manual describes, which is itself a governance question.
recursive resolver: A DNS server that takes a name from a client and does the work of walking the hierarchy to return a final address. On a corporate network it is usually run by the organisation, and it is the point where DNS filtering and logging are applied.
reference architecture: A described arrangement of controls that an organisation can adopt and adapt, rather than a product list. A useful one states, for every layer, what the layer depends on and what it cannot see; one that omits those is a checklist, and a checklist encourages the belief that the problem is handled.
refresh token: A long-lived credential a client holds to obtain new access tokens without prompting the user. Disabling the user's account does not, by itself, invalidate it, so it must be revoked explicitly during offboarding.
registry: The hierarchical database Windows and its applications read their configuration from. Its machine-wide section, HKEY_LOCAL_MACHINE, is writable only by an administrator; the per-user section, HKEY_CURRENT_USER, the signed-in person can change freely. It is the lever most Windows controls pull, and the split between the two sections is why a policy set machine-wide holds and a setting written per-user does not.
relying party (RP): In federation, the application that defers authentication to an identity provider and accepts its assertions. SAML calls the same role the service provider.
renderer process: The browser process in which a web page actually runs: it parses the page, executes its scripts, and holds the page's content in memory, including the text in a prompt box. It is sandboxed, because everything in it came from a stranger, and it is the one place on a device where a prompt exists as plaintext long enough for anything to read it.
residual risk: What is left after the controls are in place, stated deliberately rather than left implicit. In shadow AI the residual is specific and known: a staff member on a device the organisation does not manage, with an account it did not issue, on a network it does not control, using a service it has no contract with. Writing that in a sentence somebody would accept being read back to them is the point of the exercise.
retention tier: A storage class within a log platform, distinguished by cost, query performance and how long data is held. The practical consequence is that the horizon of what can be investigated is set by a finance decision made in advance of any incident.
reverse proxy: A proxy in front of servers that mediates inbound connections to them. It protects and load-balances services, and is a separate tool from the forward proxy used to control outbound staff traffic.
risk score: The number a cloud application catalogue assigns to an application from its security, compliance and legal attributes. It is useful for sorting a long list into a working order. It is a vendor's opinion rendered as a number, comparable within one catalogue and to nothing outside it.
root (superuser): The Linux account with no privilege restrictions, able to read or change anything on the machine. It is the rough counterpart of a Windows administrator, but absolute. On a developer's own Linux workstation the user is usually root, which is the same problem as the personal laptop stated in different vocabulary.

SaaS Software as a Service: Software delivered over the internet as a subscription, run on the vendor's infrastructure rather than the customer's. Consumer AI tools are SaaS, which is why the data a staff member enters leaves the organisation's control the moment it is submitted.
SAML assertion: The signed XML document a SAML identity provider issues about a user, carrying statements about how they authenticated and their attributes. A service provider validates its signature, validity window and audience before creating a session.
SAML Security Assertion Markup Language: An older but still common standard for federated sign-on, especially between enterprises and business applications. It does the same broad job as OIDC and is still widely deployed, so a defender meets both.
sanctioned alternative: A governed tool provided so that staff have somewhere legitimate to go. In a Microsoft estate the usual instance is the free work-account chat service with enterprise data protection. It functions as a control rather than a message only if it is good enough at the task and easier to reach than the ungoverned option, and staff grade it accurately within about a week.
sanctioned application: An application the organisation has approved, marked as such in the cloud application catalogue. The tag is a governance statement; on its own it changes nothing on any device.
sandbox: A deliberately impoverished execution context, stripped of capabilities the operating system would ordinarily grant, so that even entirely hostile code inside it has very little to reach. Browsers run each page's renderer in a sandbox, which is the design choice that makes running strangers' code millions of times a day survivable.
SASE Secure Access Service Edge: An architecture that delivers networking and security from the cloud, so that a device's traffic is inspected by a cloud service wherever the device is. SASE is one of the few ways to extend network-layer control to a device that is off the corporate network.
SCIM System for Cross-domain Identity Management: A protocol that lets an identity provider push user create, update and deactivate events to an application automatically, so an offboarded user is removed without manual cleanup. Support is uneven across SaaS.
scope: A named permission an application requests and a user or admin grants, such as reading mail or files. The scopes on a token define exactly what the holder can reach, regardless of how the application is marketed.
sensitive information: A narrower category within personal information, enumerated in the Privacy Act 1988 (Cth) s 6(1): racial or ethnic origin, political and religious and philosophical beliefs, association and union membership, sexual orientation, criminal record, health, genetic and biometric information. It attracts a higher collection threshold, generally requiring consent. Not the same thing as a sensitive information type, which is a pattern a data loss prevention engine matches on.
sensitive information type: A definition used to recognise a class of sensitive content, typically a pattern with a checksum where one exists, supporting keywords within a proximity window, a confidence level and an instance count. It is the workhorse of data classification and it is at its weakest on short unstructured text, which is exactly what a prompt is.
sensitivity label: A classification applied to a document or message, usually by a person, which travels with the item and can be acted on by other controls. It sidesteps the classification problem by having a human answer the question once, at the cost of depending on labelling discipline.
sensor: The component that actually observes something: an agent on a device, a collector reading logs, a browser-resident control watching a page. The question worth asking of any dashboard is which sensor produced the number and where that sensor runs, because a surface with no sensor of its own inherits the coverage of whatever is beneath it.
serious harm: The threshold in the notifiable data breach schemes: notification is required where a reasonable person would conclude the breach is likely to result in serious harm to an affected individual. The assessment weighs the kind and sensitivity of the information, whether it was protected, who could obtain it and what harm could follow. It is harder for an AI disclosure than for a hack, because the recipient is a commercial service rather than an adversary.
service principal: The per-tenant instance of an application in Entra, created when a user first consents or an admin registers it. It holds the tenant's consents and audit data and persists on a tenant lifecycle, so disabling the user who created it does not remove it.
session: Cached state that lets an application, or an identity provider, treat a user as authenticated for a period after a successful sign-in, so they are not asked again on every request. Once a session exists, stealing it no longer requires the password.
shadow IT: Technology in use inside an organisation that the organisation did not procure or approve. Shadow AI is a specific and unusually widespread instance of it, and the discovery tooling built for the general problem is what most organisations reach for first.
shadow security: A term from security usability research for the workarounds that security-conscious staff invent when they cannot comply effectively: the best compromise the person can find between getting the work done and managing the risk as they understand it. The design lesson is to study the workaround as the starting point for a workable control rather than treat it as a discipline problem.
shared responsibility model: The division of security obligations between a cloud provider and its customer, which shifts with the service model. The part usually left out is that visibility moves with responsibility: an organisation cannot instrument a layer it does not operate, which is what makes software as a service opaque by construction.
SIEM Security Information and Event Management: A system that collects logs and events from across an organisation and lets analysts search and correlate them. A SIEM can only show what its connectors feed it, so its view of AI usage inherits every blind spot of the tools upstream.
sign-in risk: A real-time score Entra ID Protection attaches to a single sign-in, from signals such as impossible travel, an anonymous IP or an atypical pattern. Conditional Access can require extra verification or block when it is high; it needs the higher Entra licensing tier.
site isolation: The practice of putting content from different sites in different renderer processes, so one site's data is never resident in a process running another site's code. It was hardened broadly after the Spectre class of processor vulnerabilities, and it means an in-browser observer's view is naturally partitioned by site: useful for scoping a control, and a limit on how much any one control can see.
situation report: A short structured update issued during an incident, recording what is known, what is being done and what is needed. National incident response guidance provides a template. In a shadow AI disclosure the most valuable field is usually the one recording what the organisation cannot establish, because on a personal account that is most of it.
SmartScreen: The Microsoft reputation and blocking service used by Microsoft's own browsers. In a Defender for Endpoint estate it enforces indicators and web content filtering inside Edge, while network protection does the same job for everything else, which is the source of several differences in what can be blocked and how precisely.
SNI Server Name Indication: A field sent early in a TLS handshake that tells the server which site the client wants, so that one address can host many sites. Historically it was sent in the clear, which is how a network device can often see which site you visited even when it cannot read the contents. ECH is the effort to close that gap.
SOAR Security Orchestration, Automation and Response: Tooling that automates the routine parts of responding to an alert: gathering context, taking a contained action, opening and closing a case. It sits on top of a SIEM and inherits whatever coverage the SIEM has.
SOE Standard Operating Environment: The organisation's managed, standardised build of a device: joined to the corporate identity, enrolled in management, and carrying the security agents. It is the state in which nearly every control in this manual applies, and the yardstick the BYOD cases are measured against.
SP Service Provider: In federated sign-on, the application a user is trying to reach, which trusts an identity provider to authenticate them. The AI tool a staff member signs in to is the service provider in that exchange.
SSE Security Service Edge: The security half of SASE: the cloud-delivered filtering, inspection and access control, considered on its own. The term appears when the networking and security pieces are bought separately.
SSO Single Sign-On: Signing in once and gaining access to many applications without re-entering credentials. SSO is convenient and also a control point, because the identity provider that grants it can also refuse it.
statutory tort of serious invasion of privacy: A cause of action inserted as Schedule 2 to the Privacy Act 1988 (Cth) and commenced on 10 June 2025, covering intrusion upon seclusion and misuse of information. It requires a reasonable expectation of privacy and that the privacy interest outweighs any countervailing public interest. Its significance for monitoring is that it binds defendants generally, so a body outside the Australian Privacy Principles is still a potential defendant.
subnet: A block of addresses treated as one local network, its size defined by a mask. Organisations divide their address space into subnets to route between them and to separate classes of device.
subnet mask: The value that marks how many leading bits of an address are the network part and how many are the host part, thereby defining a subnet's size. Written today in CIDR form, such as /24.
supervision: The stronger enrolment state for an Apple device, established through Apple Business Manager and automated device enrolment, indicating that the organisation owns the device. Supervision unlocks management capabilities a user-enrolled device does not get, including pre-granting an agent its TCC permissions so the user is never prompted and cannot decline.
surveillance record: A record or report of surveillance information. Workplace surveillance statutes restrict what may be done with one: in New South Wales the permitted uses are enumerated, and there are separate rules for records made under a covert surveillance authority. This is the provision to check before handing monitoring telemetry gathered for security purposes to a disciplinary process.
SWG Secure Web Gateway: A control point, on-premises or in the cloud, that a device's web traffic passes through to be filtered and logged. Like any network control, its reach ends where the device stops sending traffic through it.
system call: The single controlled doorway from an unprivileged program into the kernel. Opening a file, sending bytes to a network socket and reading the clipboard are all system calls. Because almost everything a program does to the world outside itself passes through this interface, software positioned to observe system calls sees what a program is actually doing, which is the architectural basis of endpoint detection.
system extension: User-space software that extends macOS with capabilities that once required a kernel extension, running through Apple-defined frameworks rather than inside the kernel. Apple deprecated kernel extensions and moved security vendors onto system extensions, which narrows what any Mac agent can observe to what Apple has chosen to expose.
systemd: The init system on most modern Linux distributions, responsible for starting and supervising background programs. It is the Linux counterpart of Windows services and macOS launchd daemons.

tabletop exercise: A discussion-based rehearsal of an incident, run against a scenario, with the people who would actually be involved. It surfaces the decisions nobody has made and the assumptions nobody has tested, which is cheaper than discovering them during the incident. For shadow AI the scenario worth running is a disclosure from a personal account on a personal device, because it is the one where the usual response steps do not work.
TCC Transparency, Consent and Control: The macOS framework that governs which apps may reach sensitive resources such as the microphone, the screen or a folder, prompting the user to consent. It is part of why a control that works on Windows may behave differently on a Mac.
TCP Transmission Control Protocol: The transport protocol that provides a reliable, ordered stream of data between two endpoints, used for most traditional web traffic. It is one of the two main transport protocols, alongside UDP.
TCP/IP model: The four-layer model, link, internet, transport and application, that describes how the actual internet is built, in contrast to the seven-layer OSI reference model. When the two disagree, the internet follows TCP/IP.
telemetry: The stream of observations a sensor produces and sends somewhere else. The word conceals a design decision: an agent that sent everything would be unaffordable, so somebody chose in advance what to carry, and that choice bounds every question anyone can ask later.
tenant: An organisation's own compartment inside a shared cloud service. It is three boundaries at once: whose accounts these are, whose data this is, and whose audit trail this is. Where there is no tenant there is no administrator, and therefore no console, no audit log and no export.
threat hunting: A person asking a question of security data that the automated rules did not anticipate. It complements detection engineering: rules answer the questions somebody already thought of, and hunting is how the next rule is found.
TLS Transport Layer Security: The protocol that encrypts most internet traffic, proving the server's identity and hiding the contents of the exchange from anyone in between. TLS is the main reason a network observer can see that a connection happened but not its contents. Its predecessor was called SSL, and people still say "SSL" loosely.
TLS inspection: Also called break-and-inspect. An arrangement where the organisation terminates and decrypts a TLS connection at a proxy, inspects the contents, then re-encrypts it. It reveals prompt content, and works only on managed devices that trust the organisation's authority.
trainable classifier: A model trained on examples of a category of content, returning a probability that new content belongs to it. It handles material that has no pattern at all, such as a contract or a research proposal, and it produces a likelihood rather than a verdict.
TTL time to live: The period for which a DNS answer may be cached before it must be looked up again. It makes DNS fast, and it delays the effect of a change such as a new block.

UDP User Datagram Protocol: A transport protocol that sends packets without the connection setup and delivery guarantees of TCP, favouring speed. It underlies QUIC and much real-time traffic, and it behaves differently from TCP at a firewall.
UEBA User and Entity Behaviour Analytics: Techniques that learn what normal behaviour looks like for a user or system and flag departures from it. In the AI context, UEBA is one way an unusual spike in data leaving for an AI service might surface, if the data reaches the analytics in the first place.
unified audit log: The central record of activity across Microsoft 365 services. For AI interactions it captures metadata, including who, when, in which application and which resources were referenced; the text of prompts and responses is not in the audit record and is reached through other paths, under a retention policy.
unified log: The system-wide structured logging facility on macOS, into which the operating system and applications write. It is a useful detection and forensic source, and its limit is that it records what the system chooses to log, not whatever an agent might wish to capture.
unsanctioned application: An application the organisation has marked as prohibited in the cloud application catalogue. Where the catalogue is integrated with the endpoint agent, the tag propagates as block indicators to onboarded devices, which is how a governance label becomes an enforcement action, up to three hours later.
user consent: An individual user's approval, through the consent screen, for an application to receive scopes for that user only. It is the path most consumer AI tools use, and it creates a service principal in the tenant automatically.
userland: The unprivileged territory where ordinary programs run, walled off from the hardware and from each other. The browser, the office suite and a desktop AI client are all userland programs. A security control that runs in userland has the powers of any other ordinary program and no more.

virtual machine: A complete emulated computer running its own operating system and its own kernel on top of a host. It is more heavily separated than a container and slower to start, and from the host organisation's point of view it is another machine on which nothing of theirs is installed.
VLAN Virtual LAN: A way to run several separate logical networks over the same physical switching hardware, so that staff, guest, server and building-system traffic can be isolated on distinct segments, each with its own policy.
VPN Virtual Private Network: An encrypted tunnel that carries a device's traffic to a chosen network, often the corporate one, so that it appears to originate there. A VPN can pull a remote device back inside the reach of network controls, or, in the wrong hands, route around them.

WDAC Windows Defender Application Control: A Windows feature that allows only approved software to run, by policy. On a managed device it can prevent the installation of local AI clients; on an unmanaged device it is simply not present.
web content filtering: Category-based blocking of websites through the endpoint agent. Its categories at the time of writing cover adult content, high bandwidth, legal liability, leisure and uncategorised, and there is no generative AI category among them, so blocking AI services in a Defender for Endpoint estate runs through indicators or through unsanctioning instead.
Windows service: A program that runs in the background on Windows, started and managed by the operating system rather than by a user opening it, and usually running under a system account rather than as the signed-in person. Endpoint agents, including the Defender sensor and the Intune management component, all take this form.
Windows Subsystem for Linux: A feature that gives a Windows user a real Linux environment on the same machine, with its own way of launching programs. It is a control-surface gap, because Windows-native mechanisms such as application allowlisting do not fully cover what runs inside it.
work profile: A browser profile signed in with the organisation's identity, to which the organisation's policy and managed extensions attach, kept separate from the user's personal profile in the same installed browser. Both Edge for Business and Chrome Enterprise use the term. Policy applies only while the user is in this profile, which is why 'sign in to the work profile' is the instruction the whole browser-side control depends on.
workplace surveillance: An employer watching employees, regulated in Australia by a patchwork rather than a national statute. Only New South Wales and the Australian Capital Territory have a dedicated Act covering computer surveillance, and both work by requiring notice and a policy in advance rather than consent. Elsewhere the constraints come from privacy principles, surveillance devices legislation and enterprise agreements.

XDR Extended Detection and Response: An approach that correlates signals across endpoints, identity, email and cloud into one detection surface. Like a SIEM, it is only as complete as the sources it draws on, so its picture of shadow AI is bounded by the upstream controls.

ZTNA Zero Trust Network Access: An approach that grants access to specific applications after checking identity and device state on each request, replacing the broad network access a traditional VPN gives. It governs reaching internal applications more than reaching public AI services.

Last updated 9 August 2026