Appendix D — Glossary

A working vocabulary for the AI-aware administrator. Definitions are written plainly and kept consistent with the book’s fact brief (mid-2026 snapshot). Where a term names a fast-moving product, price, or date, treat the figure as a point-in-time snapshot and verify it before you quote it in production.

A2A (Agent2Agent) — An open protocol (v1.2) for one AI agent to talk to another agent. Complementary to MCP: A2A is agent-to-agent, MCP is agent-to-tool.

Agent2Agent — See A2A.

Agentic AI — AI that does not just answer but acts: it reads telemetry and runbooks, forms a plan, and uses tools to carry out multi-step work. In ops, agents are mostly gated to “recommend, not act” on production as of mid-2026.

Agent washing — Gartner’s term for vendors relabeling ordinary automation or chatbots as “agentic AI”; only a small fraction of the thousands of claimed agentic products are genuinely agentic.

AIBOM (AI Bill of Materials) — A machine-readable inventory of an AI system’s ingredients (weights, datasets, configs), expressed in formats like CycloneDX ML-BOM or SPDX 3.0. Think of it as an ingredients label for a model.

AIOps — Applying AI/ML to IT operations. The four classic pillars are anomaly detection, event/alert correlation, causal root-cause analysis, and prediction/forecasting — now wrapped in a fifth natural-language/agentic layer.

Anomaly detection — Flagging behavior that deviates from a learned baseline (a login from an impossible location, a sudden traffic spike) rather than from a fixed static threshold.

AWQ (Activation-aware Weight Quantization) — A weight-only quantization method. Note: the AutoAWQ tooling was archived in May 2025; current standard tooling is llm-compressor and GPTQModel.

Block storage — Storage presented as raw fixed-size blocks (like a virtual disk) that an OS formats with a filesystem. Contrast with file storage and object storage.

Champion/challenger — A deployment pattern where a new model (challenger) is promoted over the current one (champion) only if it scores significantly better on live or shadow traffic.

Concept drift — When the relationship between inputs and the correct output changes over time, so a model’s learned mapping goes stale. Distinct from data drift; detecting it requires labels/outcomes, not just input statistics.

Continuous batching — A serving technique (used by vLLM) that dynamically adds and removes requests from a running GPU batch to keep throughput high, instead of waiting for a fixed batch to finish.

Daemon — A background process that runs without direct user interaction, typically providing a service (web server, scheduler). On Linux managed by systemd; on Windows the equivalent is a service.

Data drift (feature drift) — When the distribution of input data shifts away from what a model was trained on. Detected with statistics like PSI (rules of thumb: <0.1 no shift, 0.1–0.2 moderate, >0.2 significant) or KS.

Deepfake — Synthetic AI-generated audio/video impersonating a real person. In the 2024 Arup case a worker paid out ~US$25.6M after a video call of deepfaked colleagues; “I recognized the voice/face” is no longer an authentication factor.

DRA (Dynamic Resource Allocation) — A Kubernetes mechanism (GA in v1.34) that replaces opaque integer GPU requests (nvidia.com/gpu: 1) with declarative ResourceClaim/DeviceClass objects for richer device selection.

Embedding — A numeric vector that captures the meaning of a piece of text/image so that similar items sit close together in vector space. The unit stored and searched in a vector database for RAG.

Error budget — The amount of unreliability an SLO permits (e.g., if the SLO is 99.9%, the budget is 0.1%). When it is spent, the team prioritizes reliability work over new features.

EU AI Act — The EU’s binding, risk-tiered AI regulation (prohibited / high-risk / limited / minimal, plus a GPAI regime). Timeline is volatile: prohibitions and AI-literacy applied Feb 2, 2025; GPAI/governance Aug 2, 2025; most high-risk obligations were statutorily due Aug 2, 2026 but the 2026 Digital Omnibus would defer Annex III high-risk to Dec 2, 2027 — not yet formally adopted as of mid-2026.

File storage — Storage accessed as a hierarchy of files and folders over a network protocol (NFS, SMB). Contrast with block and object storage.

FIDO2 / passkeys — Phishing-resistant authentication that uses public-key cryptography bound to the legitimate site, so credentials cannot be replayed or phished the way passwords and one-time codes can.

FP8 (E4M3) — An 8-bit floating-point format that is the 2026 production “near-lossless” workhorse for inference, native on NVIDIA Hopper and Blackwell GPUs.

GGUF — The file format used by llama.cpp (and Ollama) to package quantized model weights for local/CPU-friendly inference.

GPU passthrough (VFIO) — Assigning one whole physical GPU to one VM at near-bare-metal performance (low single-digit % overhead). It cannot share a single GPU across VMs; for that you need vGPU or SR-IOV.

GPUDirect RDMA — A technology that lets a network card DMA directly into GPU memory, bypassing the CPU bounce buffer — essential for fast multi-node GPU training and inference.

GQA (Grouped-Query Attention) — An attention design that shares key/value heads across query heads, shrinking the KV cache and the memory needed for long contexts.

HNSW (Hierarchical Navigable Small World) — The near-universal graph index for approximate nearest-neighbor search in vector databases. Fast queries, but the graph adds memory overhead and is expensive to rebuild.

Human-in-the-loop (HITL) — Requiring a human to review or approve an AI action before it takes effect. In 2026 ops this is shifting toward “governed autonomy” — selective approval gates rather than approving every action.

Hypervisor — Software that creates and runs virtual machines by abstracting physical hardware. Type 1 runs directly on hardware (bare-metal); Type 2 runs on top of a host OS.

Idempotency — A property of an operation that produces the same end state no matter how many times it is applied. Central to declarative IaC tools like Ansible and Terraform.

Impossible travel — An anomaly signal where one account logs in from two locations too far apart to travel between in the elapsed time, indicating compromised credentials.

InfiniBand — A high-bandwidth, low-latency interconnect used for GPU clusters and distributed training; an alternative is RoCEv2 (RDMA over Converged Ethernet).

INT4 / INT8 — 4-bit and 8-bit integer quantization. INT8 typically costs <1–3% quality; INT4 noticeably degrades hard reasoning/math while roughly halving memory again versus 8-bit.

IOMMU (Intel VT-d / AMD-Vi) — Hardware that remaps and isolates device memory access, making safe GPU passthrough to a VM possible.

ISO/IEC 42001 — The certifiable international standard for an AI Management System (AIMS); paired with ISO/IEC 23894 for AI risk guidance. One of the book’s three GRC pillars (with NIST AI RMF and the EU AI Act).

KV cache (key-value cache) — Memory that stores attention keys/values for tokens already processed so they need not be recomputed. At long contexts (32K–128K) it can exceed the weights themselves; real deployed VRAM is typically 15–40% above weights-only.

Least privilege — Granting an identity (human, service, or AI agent) only the permissions it needs. The direct mitigation for OWASP LLM06 Excessive Agency.

Lethal trifecta — The dangerous combination of (1) access to private data, (2) exposure to untrusted content, and (3) an exfiltration channel. Any tool-using agent with all three is exploitable via prompt injection.

Live migration — Moving a running VM from one physical host to another with little or no downtime.

Matryoshka Representation Learning — An embedding technique that lets you truncate a vector to fewer dimensions with minimal quality loss (often ~2–3% drop for a ~4× storage cut), now standard in modern embedding models.

MCP (Model Context Protocol) — An open standard (spec dated 2025-11-25, donated to the Linux Foundation’s Agentic AI Foundation) for connecting AI agents to tools and data — the “USB-C of ops agents.” It is agent-to-tool and requires user consent before invoking any tool. See also A2A.

MIG (Multi-Instance GPU) — Hardware partitioning that splits one GPU into isolated instances with true memory and fault isolation. The ceiling is 7 simultaneous instances (on A100/H100/H200/B200), even on a 180GB B200; profile syntax is [compute]g.[memory]gb.

MITRE ATLAS — An operational catalog of real-world adversarial-ML tactics and techniques (AML.T#### IDs), analogous to ATT&CK but for AI systems. Counts shift with each monthly release.

Model card — A short standardized document describing a model’s intended use, training data, metrics, limitations, and safety evaluations. Best practice requires one for every model promoted beyond development.

Model drift — The general degradation of a deployed model’s performance over time; encompasses both data drift and concept drift.

MPS (Multi-Process Service) — NVIDIA’s software GPU multiplexing with soft memory/compute caps but no hard fault isolation — a fatal fault can reset the GPU for all clients. Sits between time-slicing and MIG in isolation strength.

NAS (Network Attached Storage) — A device serving files over the network (file-level). Contrast with SAN.

NIST AI RMF (AI Risk Management Framework) — A voluntary US framework organized around four functions: Govern, Map, Measure, Manage; it has a Generative AI Profile (NIST AI 600-1). One of the book’s three GRC pillars.

Object storage — Storage that holds data as objects with metadata in a flat namespace, accessed over HTTP APIs (e.g., S3). Ideal for model weights, datasets, and backups; supports WORM/object-lock.

Observability — The ability to understand a system’s internal state from its outputs, built on three pillars: metrics, logs, and traces. Broader than monitoring, which watches predefined signals.

OCI artifact — Using container-registry tooling (signing, scanning, GitOps, P2P distribution) to store and distribute non-image assets such as model weights, so weights become first-class registry citizens.

OpenAI-compatible API — The de facto standard HTTP interface (/v1/chat/completions) that local and production serving engines all expose, so client code runs against any backend by changing only the base URL.

OpenTelemetry (OTel) — The vendor-neutral standard for emitting metrics, logs, and traces, now extended with GenAI semantic conventions so model telemetry rides the same backbone as app and infra telemetry.

OWASP LLM Top 10 — The current (2025) list of the most critical LLM-application risks: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption.

pgvector — A PostgreSQL extension adding vector types and similarity search; the recommended starting point for roughly under 5–10M vectors before teams migrate to purpose-built stores like Qdrant or Milvus.

Process — A running instance of a program with its own memory and execution context, managed by the OS scheduler and moving through states (running, ready, blocked).

Prompt injection — An attack that smuggles instructions into an LLM’s input — directly from a user or indirectly via untrusted content the model reads — to override its intended behavior. It is an architectural risk, not a single patchable bug; mitigation means trust boundaries, least privilege, and output verification.

PTU (Provisioned Throughput Unit) — Microsoft’s abstract unit for reserved, time-billed model capacity. Compare Amazon Bedrock “model units” and Google Vertex “GSUs” — each cloud invents its own opaque unit.

Q4_K_M — A GGUF K-quant that is the default “sweet spot” for local models — roughly 4.5–4.9 bits per weight, balancing size and quality. Around this point on a quant ladder is the usual quality-vs-size “knee.”

Quantization — Reducing the numeric precision of model weights (and sometimes activations) to shrink memory and speed up inference, trading some accuracy. Rough VRAM rules: ~2 GB/B at FP16, ~1 GB/B at 8-bit, ~0.5 GB/B at 4-bit.

RAG (Retrieval-Augmented Generation) — Grounding an LLM’s answer in documents fetched at query time — usually by embedding the query, retrieving similar vectors from a vector database, and feeding them as context — to reduce hallucination and add fresh/private knowledge.

RAID — Combining multiple physical disks into one logical unit for redundancy and/or performance (e.g., RAID 1 mirroring, RAID 5/6 parity, RAID 10 striped mirrors).

RBAC (Role-Based Access Control) — Granting permissions to roles rather than individuals, then assigning users to roles; a practical implementation of least privilege.

RDMA (Remote Direct Memory Access) — Letting one machine read/write another’s memory directly over the network without involving either CPU, enabling low-latency GPU-cluster communication (via InfiniBand or RoCEv2).

RPO (Recovery Point Objective) — The maximum acceptable amount of data loss, measured in time (e.g., “at most 15 minutes of data”). It drives backup/replication frequency.

RTO (Recovery Time Objective) — The maximum acceptable time to restore service after an outage. It drives DR architecture (hot vs warm vs cold standby).

Root-cause analysis (RCA) — Determining the underlying cause of an incident rather than its symptoms; one of the four classic AIOps pillars, increasingly assisted by agents that correlate telemetry.

SAN (Storage Area Network) — A dedicated high-speed network presenting block storage to servers as if local. Contrast with NAS (file-level).

Shadow deployment — Running a new model on live traffic where its predictions are only logged, never served, so it can be evaluated safely before promotion. See also canary and champion/challenger.

SIEM (Security Information and Event Management) — A platform that aggregates and correlates security logs/events across an environment to power detection and incident response in a SOC.

SLA (Service Level Agreement) — A contractual commitment about service quality, often with penalties. Built on internal SLOs, which are built on measured SLIs.

SLI (Service Level Indicator) — A measured signal of service quality (latency, error rate, availability) that an SLO is defined against.

SLO (Service Level Objective) — An internal target for an SLI (e.g., 99.9% of requests succeed). The gap between the SLO and 100% is the error budget.

SOAR (Security Orchestration, Automation, and Response) — Tooling that automates security workflows and responses (enrichment, containment) to reduce analyst toil in the SOC.

SOC (Security Operations Center) — The team/function responsible for monitoring, detecting, and responding to security threats, typically built around a SIEM.

SR-IOV (Single Root I/O Virtualization) — A hardware feature that lets one PCIe device present multiple virtual functions; required (on Ampere and later) for NVIDIA vGPU and used for high-performance VM networking.

SSO (Single Sign-On) — Authenticating once to gain access to many applications, typically via a central identity provider (e.g., Microsoft Entra ID).

Time-slicing — The weakest GPU sharing mode: clients take turns on the whole GPU with no memory or fault isolation. Cheap and simple, but one client can starve or crash others.

Toil — In SRE, manual, repetitive, automatable operational work that scales with service size and provides no lasting value; reducing it is a core SRE goal.

Trace — A record of a single request’s path across services, one of the three observability pillars; in AI systems, traces capture each model call, retrieval, and tool use.

UEBA (User and Entity Behavior Analytics) — Building per-identity and per-device behavioral baselines (now with deep learning) to flag anomalous action sequences such as impossible-travel logins or rapid mass file access. A 2026 theme is extending UEBA to AI agents as non-human identities.

Vector database — A datastore optimized for storing embeddings and finding nearest neighbors by similarity, usually via an HNSW index. Examples: pgvector (extension), Milvus/Qdrant/Weaviate/Chroma (purpose-built), Pinecone (managed).

vGPU (virtual GPU) — NVIDIA’s licensed software that lets multiple VMs share one physical GPU (the “NVIDIA GRID” name is retired). On Blackwell, time-sliced vGPUs can layer on top of MIG instances.

vGPU (in context: VRAM sizing) — See VRAM.

VLAN (Virtual LAN) — A logical network segment that partitions one physical switch into isolated broadcast domains, used to separate traffic for security and management.

VRAM (video RAM / GPU memory) — A GPU’s onboard memory; the binding constraint for serving models. Budget it as: weights (params × bytes-per-weight) + KV cache + ~15–20% framework/activation overhead.

vLLM — A high-throughput production serving engine (PagedAttention, continuous batching; a PyTorch Foundation project) for multi-GPU/multi-node LLM inference. Contrast with personal runners like Ollama.

WORM (Write Once, Read Many) — Immutable retention (e.g., S3 object-lock) that prevents data from being altered or deleted for a set period; used with signed artifacts and audit logs to satisfy EU AI Act Article 12 logging and ransomware resilience.