> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/glossary.md). # Glossary Definitions for the terms used across Solcis documentation, from both the engineering and the compliance side. One term per concept, used the same way on every page. Where a term means something to engineers and something else to compliance practitioners, both are given. ## Solcis | Term | Meaning | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Runtime AI compliance** | Enforcing your adopted compliance controls on what your AI systems do, at the moment of action, traced to the framework clause, with tamper-evident, independently verifiable evidence. What Solcis does. | | **Agentic compliance** | The agent-specific case of runtime AI compliance: the same enforcement applied to what an autonomous agent does, where the actor has its own identity and acts across systems at machine speed. | | **Solcis** | The company, and the family name for its two products, Solcis Compliance Studio and Solcis Policy Engine. Both run in your infrastructure; we don't host them. | | **Solcis Compliance Studio** | The licensed compliance plane, where you author and promote policies, detect drift, hold the evidence ledger, see coverage and discovered agents, manage models, and connect GRC, SIEM and ticketing tools. It sends enforcement policies down to the enforcement layer and receives decisions and evidence back. | | **AI systems** | The AI-powered software, agents, and models your organisation runs. The umbrella for what Solcis governs. | | **Deployment** | One running Solcis environment: Compliance Studio and the Policy Engine instances it manages, in a customer's or partner's infrastructure. | | **Air-gapped** | A deployment with no network path to or from it. Both Solcis products install from offline packages and run the same way. | | **Bring your own model** | You choose the language model the inference check uses, register it in Solcis Compliance Studio (compliance model management), and run it in your environment with your own credentials. | ## Enforcement layer | Term | Meaning | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Solcis Gateway** | The Solcis-provided gateway that puts enforcement on the action path. You can use your own gateway instead; it works alongside NVIDIA OpenShell or Microsoft AGT where you run them. | | **Solcis SDK** | How the Solcis Policy Engine is built into your AI application, on the action path where it decides to act. | ## Agents and actions | Term | Meaning | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Agent** | A system that takes actions on behalf of an organisation, usually driven by a language model. An agent is the thing that acts; a model is what it reasons with. | | **Action** | Something an agent attempts that has an effect: a tool call, a payment, a record update, a data export, an email. The unit the Solcis Policy Engine evaluates. | | **Tool** | A capability an agent can invoke. "Tool call" is used when the action is literally one. | | **Agent framework** | The software an agent is built with. The Solcis Policy Engine connects to specific frameworks so their actions pass through it. | | **Model Context Protocol (MCP)** | An open protocol through which agents call tools on MCP servers. MCP calls are evaluated by the Solcis Policy Engine at MCP endpoints or as they pass through a gateway. | | **Connection** | How an action reaches the Solcis Policy Engine: on the action path through the Solcis SDK, at a model, tool or MCP endpoint, or through a gateway (your own or the Solcis Gateway). An action that reaches no enforcement point isn't evaluated. | | **Enforcement path** | The route an action takes through the Solcis Policy Engine before it's allowed to proceed. | ## Controls, rules and runtime policies | Term | Meaning | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Control** | A statement from your compliance programme of what must or must not happen. What Solcis enforces. | | **Preventive control** | A control that stops an action before it happens. Solcis is built for these. | | **Detective control** | A control that finds out after the fact. | | **Rule** | The deterministic, machine-readable expression a control is authored into. It matches an action or it doesn't. Rules live in a runtime policy. | | **Runtime policy** | The deployable artefact that's authored, approved and promoted in Solcis Compliance Studio, and enforced by the Solcis Policy Engine. Carries the rules that implement one or more controls. "Policy" alone is avoided; it's overloaded with the GRC sense of a policy document. | | **Authoring** | The step, done in Solcis Compliance Studio, that turns a control into rules, using knowledge of your environment. | | **Environment knowledge** | What Solcis Compliance Studio holds about your agents, tools, data and approvers, so that rules refer to your systems rather than generic ones. | | **Framework** | A published set of requirements: a standard such as ISO/IEC 42001:2023, or a regulation such as the EU AI Act. Frameworks have requirements; organisations implement controls to meet them. | | **Requirement** | A clause of a framework. Not the same as a control. | ## Evaluation | Term | Meaning | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Solcis Policy Engine** | The component that receives an action, evaluates it, returns a decision, writes the compliance receipt and sends it to Compliance Studio. | | **Deterministic check** | The first step of evaluation: rules applied to the action. Repeatable. | | **Inference check** | The second step, run only where a policy requires judgement: the action assessed by a model you run. Probabilistic. Never described as deterministic. | | **Small language model (SLM)** | A language model small enough to self-host and to return a decision inside the latency budget. What the inference check uses, and what makes air-gapped and sovereign deployment practical. | | **Decision** | What the Solcis Policy Engine returns for an evaluated action. Allow, Deny or Escalate, with a severity rating. | | **Allow** | The action proceeds. | | **Deny** | The action is refused, citing the control. | | **Escalate** | The action is held for a person to approve or reject. | | **Risk Rating** | The action proceeds with a rated finding for review. A model output. | | **Escalation** | An action held under an `Escalate` decision, and the approval or rejection that resolves it. | | **Shadow mode** | A policy state in which the policy evaluates and records what it would have decided, without affecting the action. | | **Runtime** | "At runtime" means as the action happens. Not a synonym for "real time", which implies a latency figure. | ## Evidence | Term | Meaning | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Compliance receipt** | The record the Solcis Policy Engine writes for one evaluated action: the action, the decision, the control, the lineage, which step decided, and integrity data. A defined term in the Software Licence. | | **Evidence ledger** | The store of compliance receipts, held in Solcis Compliance Studio. One per deployment. | | **Tamper-evident** | A record whose integrity can be checked, so that alteration or removal is detectable. Not the same as tamper-proof, which Solcis doesn't claim. | | **Independently verifiable** | Checkable by an auditor, regulator or court without trusting Solcis or the organisation that runs it. | | **Verifier** | The person or party who checks the evidence ledger independently of the people who built or run the deployment. | | **Lineage** | The chain from a decision back through the runtime policy version and control to the framework requirement. | ## People and components | Term | Meaning | | ---------------------- | ------------------------------------------------------------------------------------------------ | | **Console** | The web interface of Solcis Compliance Studio. | | **Compliance manager** | The role that authors, approves and promotes runtime policies in Solcis Compliance Studio. | | **Auditor** | The role that reads the evidence ledger and every policy transition in Solcis Compliance Studio. | | **Agent developer** | The role that connects agents to the Solcis Policy Engine (using the Solcis SDK). | | **Administrator** | The role that configures the deployment, identity and access in Solcis Compliance Studio. | | **Operator** | General term for whoever runs a deployment day to day, whatever their role. | | **Entitlement file** | The file that licenses a deployment. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.solcis.ai/references/glossary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.