mcp, approvals & compliance - the terms.

MCP (Model Context Protocol)

The Model Context Protocol (MCP) is an open standard that connects AI models to external tools, data sources and services - introduced by Anthropic in November 2024. Instead of building a custom integration per application, AI assistants such as ChatGPT or Claude talk to any system through one uniform interface.

Read definition →

MCP server

An MCP server is a service that offers tools to an AI agent via the Model Context Protocol - such as "look up order", "issue refund" or "delete record". AI clients like ChatGPT or Claude connect to the server, see the tool list and invoke the tools on the user's behalf.

Read definition →

MCP client

An MCP client is the application that connects to MCP servers and makes their tools available to an AI model. Typical clients are ChatGPT, Claude (desktop and Code), VS Code, Gemini CLI or custom agent frameworks. The client discovers tools and forwards the model's invocations to the server.

Read definition →

Tool call

A tool call is a single invocation of a tool by an AI agent - with concrete arguments and a result. Example: refund_order with amount=€180. Tool calls are where language becomes action: orders, refunds and deletions happen as tool calls, not as chat messages.

Read definition →

AI agent

An AI agent is an AI system that does not just answer but acts autonomously: it plans steps, invokes tools and pursues goals across multiple interactions. Chat agents, voice agents and autonomous workflows (e.g. built with LangGraph or n8n) are agents - their shared lever into the real world is tool calls.

Read definition →

MCP gateway

An MCP gateway is an infrastructure component in front of one or more MCP servers that handles authentication, rate limits, routing and protocol translation - comparable to an API gateway. A gateway governs technical access; the business question of which action needs human approval is typically not one it answers.

Read definition →

Rug pull (MCP)

A rug pull is an MCP security risk: an MCP server changes a tool's definition after the user has come to trust it. A harmless-looking "check weather" tool can suddenly exfiltrate data after an update - while the client keeps showing the same tool name.

Read definition →

Tool poisoning

Tool poisoning is an attack that hides malicious instructions inside an MCP tool's description. The AI model reads tool descriptions as trusted context - a crafted description can instruct it to leak data or abuse other tools without the user seeing any of it.

Read definition →

Human-in-the-loop (HITL)

Human-in-the-loop means a human decides before an automated system executes a critical action - not after. For AI agents this concretely means defined tool calls are held until an authorized person approves or rejects them. The difference from mere logging: the human can intervene before anything happens.

Read definition →

Approval

An approval is a human's documented decision that a held action may execute. An effective approval involves the authorized person, the full context (tool, arguments, triggering agent, matching rule) and permanent evidence of the decision and its timestamp.

Read definition →

Hold

A hold is a suspended tool call: an agent's invocation is stopped before execution and waits until a human decides. During the hold the action is neither executed nor discarded - it sits in an approval inbox with full context (tool, arguments, rule).

Read definition →

Monitor mode

In monitor mode a control layer observes traffic to an MCP server without intervening: every tool call is recorded, nothing is blocked. If the layer fails, traffic keeps flowing (fail-open). Monitor mode is the zero-risk entry - it makes visible for the first time what agents actually do.

Read definition →

Enforce mode

In enforce mode a control layer physically enforces rules: critical tool calls are held until a human decides, forbidden calls are rejected. If the layer fails, no unchecked action gets through (fail-closed). Enforce mode is the difference between convention ("the agent should not") and enforcement ("the agent cannot").

Read definition →

Fail-open / fail-closed

Fail-open and fail-closed describe how a control system behaves during an outage: fail-open lets traffic continue unchecked (availability over control), fail-closed stops it (control over availability). Which behavior is right depends on the risk of the protected actions.

Read definition →

Escalation chain

An escalation chain governs what happens to an open approval when the responsible decision-maker does not react: after a deadline the request automatically moves to the next person or role - say, from the team lead to on-call after 30 minutes. No critical action sits unanswered.

Read definition →

Four-eyes principle

The four-eyes principle requires that critical operations are reviewed by two independent people before they take effect. In internal control systems it is standard for payments and irreversible changes - and it transfers directly to AI agents: a payment run prepared by an agent executes only after two independent approvals.

Read definition →

EU AI Act Article 14

Article 14 of the EU AI Act (Regulation (EU) 2024/1689) requires high-risk AI systems to be designed so humans can effectively oversee them - including the ability to intervene, interrupt the system or discard an output. Logs alone are not enough: oversight must be able to act before the effect.

Read definition →

ISO/IEC 42001

ISO/IEC 42001 is the international standard for AI management systems (AIMS), published in 2023. It requires organizations to systematically govern the risks of their AI systems - with defined responsibilities, lifecycle controls and evidencable processes. Certifiable like ISO 27001, and increasingly part of B2B requirements.

Read definition →

DPA (data processing agreement)

A data processing agreement (DPA) under Art. 28 GDPR governs how a provider processes personal data on a company's behalf: purpose, instructions, technical and organizational measures, sub-processors, deletion duties. Without a DPA, using a data-processing SaaS service in the EU is generally not GDPR-compliant.

Read definition →

Hash chain

A hash chain is a sequence of records in which every entry contains the cryptographic hash (e.g. SHA-256) of its predecessor. If an old entry is modified later, all subsequent hashes stop matching - tampering becomes mathematically provable. Hash chains make logs tamper-evident without requiring a blockchain.

Read definition →

Audit trail

An audit trail is the gap-free, chronological record of all relevant events in a system - for AI agents: every tool call with arguments and result, every rule change, every approval and rejection with person, channel and timestamp. The trail becomes tamper-evident only when subsequent modifications are detectable.

Read definition →