AI delivery glossary: quality gates, SBOM, SAST

Agent orchestration decides which AI agent runs when, with what context, tools, model and limits. What it covers, and how AI CodeOps runs a session's agents.

An agentic workflow runs AI models and tools through a set sequence of steps toward a goal. How it differs from a free-running agent, and AI CodeOps workflows.

An audit log is a time-ordered record of who did what, when and to what. What a good one captures, and what the AI CodeOps audit log records and keeps.

Branch protection sets the rules a branch must meet before changes land, such as reviews and passing checks. What it covers, and how it applies to AI CodeOps.

A canary deploy releases a change to a small part of production first and compares it with the rest before going further. How it works, and what to measure.

Code owner approval blocks a merge until an owner of the changed files approves. How the rule works, and how it sits next to the approval in AI CodeOps.

CODEOWNERS is a file naming who is responsible for each part of a repository. Where it lives, how its patterns match, and how it applies to AI changes.

A context window is all the text a model can take into account for one response, the response included. What counts, and how AI CodeOps keeps steps small.

A coverage floor is the lowest test coverage a change may ship with. How teams set one, its pitfalls, and how minCoveragePct works in the AI CodeOps CI check.

CycloneDX is the OWASP standard for bills of materials, also published as ECMA-424. What a CycloneDX file holds and how AI CodeOps records and reads them.

A deploy gate decides whether a change may be released to an environment. How it differs from a merge gate, and the three deploy gates AI CodeOps gives you.

DORA metrics measure software delivery: how fast changes ship and how often they fail. The current five, and the four AI CodeOps computes from your deploys.

An egress policy limits the outbound connections a workload may make. How it works in Kubernetes, and how AI CodeOps restricts traffic out of its sandboxes.

The EU Cyber Resilience Act sets security rules for products with digital elements sold in the EU. Its key dates, what it asks of software makers, and SBOMs.

A fail-closed check denies the action when it can't reach a verdict, such as on an error or timeout. Why gates should fail closed, and where AI CodeOps does.

A feature flag turns behaviour on or off at runtime without a new deploy. What flags are used for, the risk of old flags, and the OpenFeature standard.

A flaky test passes and fails on the same code with nothing changed. Common causes, why flakiness erodes trust in gates, and how AI CodeOps treats re-runs.

Human-in-the-loop means a person reviews or approves at set points before an automated system acts. Where it fits in AI coding, and how AI CodeOps applies it.

ISO/IEC 27001 is the international standard for an information security management system. What it requires, how certification works, and AI CodeOps today.

Least privilege means each person, service or agent gets only the access its task needs. Why it matters more with AI agents, and how AI CodeOps applies it.

A license policy lists which open-source licenses your software may ship with. How it is enforced, and how AI CodeOps checks it against a project's SBOM in CI.

An MCP server offers tools, data and prompts to AI applications over the Model Context Protocol. What a server exposes, and the AI CodeOps MCP server.

A merge queue tests each pull request against the latest branch plus the changes queued ahead of it, then merges in order. How it works and why CI must opt in.

MCP is an open protocol that lets AI applications call tools and read data from other services. How it works, and how AI CodeOps agents connect to MCP servers.

Model routing sends each AI request to the model suited to it, trading quality against cost. Common approaches, and how the AI CodeOps Auto tier picks.

A multi-agent system splits work between several AI agents with distinct roles. Why that helps with code, where it doesn't, and how AI CodeOps uses them.

Mutation testing checks your tests by making small changes to the code and seeing whether any test fails. How it works, and how it differs from coverage.

A policy engine evaluates rules against requested actions and returns allow or deny. How policy-as-code works, and how AI CodeOps uses it to govern AI sessions.

Prompt caching lets a provider reuse the processed start of a prompt and bill repeated input at a lower rate. How it works, and how AI CodeOps uses it.

Prompt injection is text that changes what an AI model does in ways its operator didn't intend. Direct and indirect forms, and how AI CodeOps limits the damage.

Provenance is verifiable information about where, when and how software was produced. Build provenance, the record of a change, and what AI CodeOps signs.

A quality gate is a pass-or-fail check a change must clear before it moves on. What it checks, why it matters for AI code, and how AI CodeOps applies it.

RBAC grants permissions to roles and assigns people to roles, not permissions to people. How it works, and the built-in and custom roles AI CodeOps provides.

A rollback returns a system to its last known-good version after a bad release. Why the record matters, and how AI CodeOps tracks rolled-back deployments.

A rollback plan says, before a release, how to undo it: the trigger, who decides, the steps and the data. What goes in one, and how AI CodeOps records it.

A ruleset is a named list of rules GitHub applies to branches or tags. How rulesets differ from branch protection rules, and how they apply to AI CodeOps PRs.

A sandbox is an isolated environment where untrusted code runs without reaching the host or other systems. What isolation means, and where AI CodeOps tests.

An SBOM lists every component, version and license inside a piece of software. What goes in one, why buyers ask for it, and how AI CodeOps records them.

Secrets scanning searches code and history for leaked credentials. What it catches, and how AI CodeOps handles secrets instead: encrypted, masked, kept from AI.

Single sign-on lets people use one identity provider login for many apps, over SAML 2.0 or OpenID Connect. How it works and how to set it up for AI CodeOps.

Slopsquatting is publishing a package under a name AI models tend to invent, so code that installs the invented dependency gets the attacker's code.

SLSA is a framework of levels for software supply-chain security, built around build provenance. The Build track levels L0 to L3, and where AI CodeOps fits.

SOC 2 is a CPA's examination of a service company's controls for security and related criteria. Type 1 and Type 2 reports, and where AI CodeOps stands today.

SCA finds the open-source components in your code and flags known vulnerabilities and license risks. What it does, and how it fits next to AI CodeOps.

SPDX is an open standard for SBOMs and the source of standard license identifiers. What it covers, how it compares with CycloneDX, and its use in AI CodeOps.

SAST analyses source code without running it to find security flaws such as injection. How it works, its limits, and how AI CodeOps' diff review relates to it.

Tool calling lets a model ask the application to run a function and return the result. How the round trip works, and the tool limits in AI CodeOps sessions.

A VEX document states whether a product is affected by a known vulnerability. The four statuses, the not_affected reasons, and how VEX pairs with an SBOM.