Glossary

This glossary defines the vocabulary of Landscape in the book's own words: the names and scales of Contour, the notation, exactly as docs/NOTATION.md gives them; the terms of the book's method, the test, the grades of source, the three labels for statements about the future and the nine instincts; the terms of the landscape itself, from architecture as code and the registers an organisation already keeps to the European instruments that place duties on named people; and the two fictional organisations that walk through every chapter. Each entry ends with the chapter in which the term is introduced, in brackets. Terms adopted from the seven volumes of The Transformed Architecture are marked with the volume and chapter they come from ("adopted from AI Governance, Chapter 2"); every such term is defined here and in the chapter that introduces it, so that the reader never needs the volume. Terms without such a mark are this book's own. Systems are described by what they do, they rank, draft, route, flag or execute, never by what they want. Statements about law name the instrument and the article and are organisational and architectural implications, not legal advice.

A

Action class. One kind of action a unit can take, such as "route a claim", "offer an open shift" or "wipe a host", each with its own autonomy level and its own reversibility. A unit that holds several action classes is drawn in the one-page landscape at its ceiling and opened into one thin bar per class in the decision-rights view. (Chapter 6; drawn in full in Chapter 17)

Agent. A system in which a model directs its own sequence of tool calls towards a goal, and which, in this book's sense, acts with an identity of its own: a service account, a workload identity or credentials that are not a person's. An agent does not want anything and does not understand what it handles; it executes a loop within a mandate. (Chapter 3; the consequence that such an agent becomes a privileged machine insider is adopted from AI Red Team, Chapter 6)

Agentic work tool. Mode 3 of the six usage modes: a model run in a loop with tools on a workstation, in a repository or in a cloud sandbox, which edits files, executes commands, calls connectors and opens pull requests while a person delegates and reviews. It acts with the person's identity and is drawn as a circle in the amber of Mode 3. (Chapter 3; adopted from AI Governance, Chapter 2)

AI Act. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744. The book uses its own terms, provider, deployer, high-risk AI system and general-purpose AI model, attributes every statement to an article, and treats its obligations as organisational implications. The obligations for the high-risk systems listed in Annex III apply from 2 December 2027 under the amended Article 113. (Chapter 1, Question 12; the structure in Chapter 7, the amendment in Chapter 11)

AI Decision Record (AIDR). An Architecture Decision Record with the fields a decision about an AI system needs. The landscape model lists, for each unit, the AI Decision Records that decided its mode, level and controls under registers.decision_records; the book uses the plain phrase decision record in its prose. (Chapter 14; adopted from AI Platform and Security, Chapter 5)

AI Incident Database. A public record, kept by the Responsible AI Collaborative, of incidents in which an AI system is reported to have caused or nearly caused harm, drawn from press reports and public submissions and classified by volunteer editors; the snapshot of 2 November 2026 holds 1,786 incidents, 1,498 of them classified under the MIT AI Risk Repository taxonomy. It records what was reported and accepted, so its counts carry the selection of the press and its editors and are revised for past years as reports arrive. The OECD's AI Incidents and Hazards Monitor, an automated reading of news coverage, is the second incident record the book uses. (Chapter 1, Question 11; its limits in Chapters 7, 9 and 10)

AI inventory. The authoritative register of every AI system and model an organisation provides or deploys, with purpose, risk class, owner and lifecycle status, generated from descriptors beside the code and the deployments the pipelines observe; the model's field for its identifier is ai_system_register, and the rule behind it is that you cannot govern what you cannot enumerate. One unit of the landscape corresponds to one entry, and the inventory fills the unit's name, mode, owner, lifecycle and hosting. (Chapter 4; populated in Chapter 14; adopted from AI Governance, Chapter 9 and its glossary)

Ambient AI. Mode 0 of the six usage modes: AI that people meet without having chosen it, such as generated answers in search engines, automatic summaries in collaboration tools and AI features that suppliers enable through a product update. The series calls it the blind spot, because vendor AI may already act at an effective autonomy nobody decided; the notation draws it in grey-blue, and at the start of 2027 both illustrative organisations carry one such unit at Level 4 Autonomous with no seat, no diamond and no baseline. (Chapter 3; adopted from AI Governance, Chapter 2; the blind spot from AI Red Team, Chapter 8)

Annex III. The AI Act's list of the uses it treats as high-risk, among them recruitment and selection (point 4(a)), decisions on the terms of work, the allocation of tasks and the monitoring of workers (point 4(b)) and the evaluation of eligibility for essential public assistance benefits (point 5(a)). It is a list of uses, not of models, which is why the book's classification follows the unit and not the model behind it. Annex I lists the high-risk systems that are products or safety components, whose obligations apply from 2 August 2028. (Chapter 1, Question 12; read as a list of uses in Chapter 7)

Architecture as code. The practice of keeping the description of an organisation's systems as text files in version control rather than in documents and diagrams: every change is dated, attributed and reviewable, tests fail when the description and the reality disagree, and a rule written as code can refuse a release. A document can say anything; a test can fail. Written Architecture as Code, with capitals, for the discipline and the companion book. (Chapter 3; adopted from Architecture as Code (Chapters 1 and 2); the movement is named Shift 1, from documents to code, in The Transformed Security Architect, Chapter 3)

Assistant. A large language model put to work for a person, with that person's identity and permissions: it drafts, retrieves and suggests, and the person remains the one who sends, closes and signs. An assistant can do nothing its user could not do, and when something goes wrong the trail leads to a person who chose to send. (Chapter 3)

Attestation. A person or a supplier asserting that a control operated: a questionnaire answer, a contract clause, a policy document, a signed attestation. The notation draws attested evidence as a dashed baseline and as a hatched cell in the evidence view, apart from the evidence a system produces, because the two look alike in a report and differ in a crisis. (Chapter 3; adopted from AI Governance, Chapter 11)

Author's projections. The author's own statements about the next years, confined to one marked section of Chapter 20 and nowhere else in the book, each carrying its label, the evidence it leans on and what would show it wrong. Everywhere else the book says what the data show and labels what others expect. (Chapter 1; the projections in Chapter 20)

Autonomy level. What the AI may do without a person approving each action, drawn as the column of a mark, on five levels adopted by their exact names: Level 0 Advisory, the AI suggests and a person decides and acts; Level 1 Assisted, the AI drafts the action and a person reviews and executes it; Level 2 Supervised, the AI executes after explicit approval of each action; Level 3 Bounded, the AI executes pre-approved, reversible actions within a codified playbook and a person is informed and can stop it; Level 4 Autonomous, the AI selects and executes actions without per-action approval, within bounds set in advance. The level belongs to an action in a context, not to a product, is decided and recorded rather than discovered, and the line that matters most runs between Level 2 and Level 3. A unit is drawn at the highest level it holds for any action that changes something outside the unit; read-only actions such as enriching an alert do not set the column. (Chapter 3; adopted from AI Red Team, Chapter 6)

Autonomous production agent. Mode 5 of the six usage modes: an agent that acts on business systems without a person approving each step, where the person sets the mandate, bounds and stop conditions and monitors outcomes rather than actions. Drawn as a rounded square in the plum of Mode 5; Hansa Mutual runs six, Nordvik Region none. (Chapter 3; adopted from AI Governance, Chapter 2)

B

Base rate. How often a kind of event happens in the best public record, stated as a share of a population: 3.43 per cent of EU enterprises with an outage caused by an attack in Eurostat's 2024 survey, beside 17.97 per cent with an outage caused by a failure; 3 incidents of 1,498 under an AI pursuing its own goals, beside 412 under fraud. The base rate does not make a frightening story false; it says how much of the agenda the story has earned. (Chapter 9)

Baseline. The short line under a mark that says where proof that the controls hold comes from: solid for automatic evidence, produced by the system (logs, tests, gates and policies as code); dashed for attested evidence, declared by a person or a supplier, including signed attestations; absent where there is none. A dashed baseline at R3 Hard to reverse is a control whose proof is a promise protecting an outcome that takes weeks to undo. (Chapter 4)

Baseline trajectory. The European Commission's projection, published on its Digital Decade dashboard and recomputed every year, of where an indicator would stand in 2030 on a line drawn through the observed points; the ideal trajectory is the path the indicator would have to follow to reach the target. Each trajectory carries its vintage, the year it was computed, and the four AI vintages so far end at 20.29, 16.76, 35.92 and 54.28 per cent. They are the publisher's expectations, not observations, and the book makes no projection of its own from them. (Chapter 1, Question 9; read in Chapter 8)

Binary instinct. The habit of seeing automated or manual, human or machine, when the data show five levels of autonomy and most AI at work drafts for a person who decides. Its rule of thumb: ask at which level, for which action; "automated" is five answers, not one. (Chapter 6)

Blame instinct. The habit, when something has gone wrong, of looking for an agent to hold responsible and stopping when one has been found, which in this landscape is the model, the vendor or the agent software, because those acted last, when the decision rights were never designed. Its rule of thumb: look for the seat before you look for the culprit; if nobody was named to decide, that is the finding. (Chapter 13)

Box instinct. The habit of drawing AI as one box, and "the cloud" as one cloud, when the measured landscape is many uses of many kinds at many levels. The other eight instincts stand on it. Its rule of thumb: when someone says "the AI" or "the cloud", ask which ones, and count them before you judge them. (Chapter 5)

Built AI application. Mode 4 of the six usage modes: the organisation integrates a model into its own system through an API, a managed platform or self-hosted weights, and owns the full lifecycle. Drawn in the navy of Mode 4, as a circle where it drafts for a named user and as a rounded square where it acts with an identity of its own. (Chapter 3; adopted from AI Governance, Chapter 2)

C

Ceiling. The highest autonomy level a unit holds for any of its action classes, drawn as the length of its bar in the decision-rights view and as its column in the one-page landscape. The seat and the diamond sit at the ceiling, because the question is who decided that the unit may act at the level it actually reaches, and whether anything enforces it. (Chapter 17)

Container. A rounded rectangle of the boundary frame in which marks are placed by who runs them: a solid border for the organisation's own boundary, its premises, tenant or data centre; a dashed border for a supplier, labelled by role and never by brand; a dotted border for a jurisdiction outside the EU and the EEA. Containers nest, and a mark sits in the container of the supplier that hosts it, or, failing that, that supplies its application or operates it. A supplier is never a mark. (Chapter 4; taught in Chapter 16)

Containment. The layers around an agent that are enforced outside it, so that it cannot relax them, and that each produce evidence it cannot alter: credentials scoped to one task, a disposable working space, an allow-list of where data may go, two people for anything irreversible, a stop switch and a log the agent cannot reach. A platform is under control when containment holds whatever anyone intends. (Chapter 3; adopted from AI Platform and Security, Chapters 19 and 25)

Contour. The notation of this book: one unit drawn as one mark with seven dimensions and nothing else, placed by three frames and rendered in six standard views, the same way every time, so that two organisations can be compared at a glance, a year of change can be read on one page, a supplier and a jurisdiction can be placed and the reader can see who decides. It is drawable by hand on a whiteboard in five minutes, and the renderer makes the sketch exact, not possible. (Chapter 1; taught in Chapter 4; specified in docs/NOTATION.md and Appendix A)

Conversational assistant. Mode 1 of the six usage modes: a general-purpose chat interface to a model, into which the person brings the context and from which the person takes the output away. Drawn as a circle in the blue of Mode 1. (Chapter 3; adopted from AI Governance, Chapter 2)

D

Dataset. One directory data/<slug>/ behind every chart and every test question, holding the raw file exactly as retrieved, the tidy.csv the charts read and a SOURCE.md that records the publisher, the address, the retrieval date, the licence, the transformations and the publisher's caveats. Every number in the prose is read from such a file at the precision it prints, every chart caption ends with the publisher, the dataset and the year of retrieval, and Appendix C lists every dataset from those files. (Chapter 1; the method in Appendix C)

Decay. The slow loss of reversibility after a function is delegated to a unit: small delegations erode the skill, the procedure, the capacity, the interfaces and the memory a fallback needs, until the documented fallback no longer exists, within months of go-live rather than years. On the landscape, decay is a mark whose row should have moved up and did not, and it is caught only by doing the work without the unit for a defined period. (Chapter 15; adopted from AI Boss, Chapters 25, 30 and 33, with the mechanism from AI Threat, Chapter 26)

Decision record. A short, numbered, dated record of a decision, kept beside the thing it decides, that says what was decided, by whom, why, what follows and what it would take to undo, and that is never edited afterwards, only superseded. The book uses the plain phrase for what Architecture as Code calls an Architecture Decision Record (ADR); the seat on a mark is rendered from such a record rather than from memory. (Chapter 3; adopted from Architecture as Code (Chapter 4))

Decision right. The authority to say what an AI use may do, to change that, and to stop it. A decision right without evidence is a hope; evidence without a decision right is a report nobody has to act on. The holder's standing is drawn as the seat. (Chapter 3; taught in Chapter 17)

Decision tier. The standing of the person who holds the decision right for a unit, written in the seat: T1 the operator or user, T2 the system owner or architect, T3 an executive, T4 the board or an elected body, where the management body of a financial entity counts as the board; T0 means nobody is named and the seat is absent. The tiers are the book's own: they grade who holds the right, whereas the four decision tiers of AI Governance, Chapter 13, route each decision to the lowest tier that can take it with the necessary evidence. (Chapter 4)

Delegated access without delegation. A person's account being used by software without that person approving each action: on the landscape, a circle at Level 3 Bounded or Level 4 Autonomous. The shape is the first thing to check in those columns; a square there is an agent, a circle there is this anti-pattern. (Chapter 4; this book's name for a case of the identity mistake that AI Platform and Security, Chapter 12, describes: collapsing into one the AI component's identity and the person's it acts for)

Delegation profile. One record per system and management function (DLG-*) in a delegation register, giving the degree of delegation, the deciders, the agreement with the employees' representatives, the stop path, the review date and the reversibility tests. Nordvik Region's rostering system runs under DLG-NR-ROS-01, agreed with its unions; the profile's degree per function becomes an action class and its level in the landscape model. (Chapter 6; populated in Chapter 14; adopted from AI Boss, Chapters 4 and 25)

Delegation register. A list not of systems but of the functions handed to them, each with the decision behind it, the human role that remains and the path by which the function would be taken back, kept with reversibility tests whose failure freezes further delegation. It is one of the three registers from which a landscape model is filled. (Chapter 11; adopted from AI Threat, Chapter 26, and AI Boss, Chapter 25)

Denominator. The population a count is divided by: enterprises with ten or more persons employed, large enterprises, all individuals aged 16 to 74, classified incidents, respondents to a self-selected survey. The same fact counted against five denominators gives five numbers, none of them the "real" one, and a count of incidents over a period of rising adoption has no denominator at all. (Chapter 10)

Deployer. Under Article 3(4) of the AI Act, a body using an AI system under its authority outside a personal, non-professional activity. The organisation is the deployer of every mark on its landscape, including the marks in non-EU containers, and under Article 25(1) it becomes the provider of a high-risk system when it puts its own name on one, substantially modifies one or changes its intended purpose so that it becomes high-risk. Article 26 places the deployer's duties on it, among them assigning human oversight to natural persons with the necessary competence, training and authority. (Chapter 1; read in Chapters 7 and 16)

Destiny instinct. The habit of treating architecture as fixed documents and AI as an inevitable tide, when both change by decisions that are recorded and reversible: the law's dates moved by an amending regulation, and an adoption series is a sum of separate decisions that can stall and jump. Its rule of thumb: nothing here is fixed and nothing is inevitable; ask what was decided, by whom, and what it would take to reverse it. (Chapter 11)

Digital Decade. Decision (EU) 2022/2481 establishing the Digital Decade Policy Programme 2030, whose targets include that 75 per cent of EU enterprises use cloud computing, big data or AI by 2030 and that the Union employ 20 million ICT specialists. The Commission tracks each target on its dashboard and publishes a baseline trajectory towards it every year. (Chapter 1, Question 9; read in Chapter 8)

Digital Omnibus. Regulation (EU) 2026/1744, the Digital Omnibus on AI, adopted on 8 July 2026, published on 24 July and in force from 27 July 2026, which amends the AI Act. Its Article 1, point 40, replaced points (a) and (c) of the third paragraph of Article 113 and added a point (d), so that the obligations of Chapter III, Sections 1 to 3, apply from 2 December 2027 to the high-risk systems of Annex III and from 2 August 2028 to those of Annex I; it also moved the regulatory sandboxes, added two prohibitions and reworded the AI literacy obligation. (Chapter 1, Question 12; read in Chapter 11)

DORA. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, which requires in Article 28(3) that financial entities keep a register of information on all contractual arrangements for ICT services from third-party providers; the executive board of a financial entity is its management body. For an insurer such as Hansa Mutual the supply and sovereignty view is that register drawn. The book also quotes a research programme published by Google Cloud under the same name, DORA, in Chapter 11; the two are unrelated, and the chapter says which is meant. (Chapter 12; read in Chapter 16)

Drift. The movement of a unit between usage modes while its controls stay where the use case started: a prompt becomes a shared skill, a skill a product, an application an automation. Governance therefore attaches to the use case and not to the tool, every change of mode is a change event that requires review, and classification is triggered by change rather than by the calendar. On the time view, drift with the controls left behind is a trail to the right whose end lacks a filled diamond, a seat or a solid baseline. (Chapter 3; taught in Chapter 15; adopted from AI Governance, Chapters 2 and 8)

E

Embedded workplace assistant. Mode 2 of the six usage modes: an assistant inside the office suite that reads and acts on mail, documents, calendars and chats with the user's own permissions, where the assistant, not the person, retrieves the context. Drawn as a circle in the green of Mode 2. (Chapter 3; adopted from AI Governance, Chapter 2)

Empty corner. The top-right cell of the landscape, Level 4 Autonomous at R4 Irreversible, shaded faintly in every view because the series concluded that Level 4 is never used for irreversible actions, so that a well-governed landscape has nothing there and anything drawn there is visible at once. The tests fail on a model that places a unit there unless its notes say "empty corner" explicitly, so that an exception is a deliberate, visible record. It is the first thing to look at in any landscape. (Chapter 4; the conclusion adopted from AI Red Team, Chapter 6, AI Threat, Chapter 30, and AI Boss, Chapters 4 and 33)

Estimate. A figure the author derives from published values rather than reads in a source, such as the share of AI-using enterprises with three or more technologies, obtained by dividing one Eurostat share by another. The book calls an estimate an estimate and gives its method; a weak one is labelled speculation. (Chapter 1)

EU data region of a non-EU vendor. A global vendor's offer to process data in a European region, drawn in the supply and sovereignty view as a non-EU jurisdiction with a dotted border and those words in its label, because the contract is with a company governed by the law of its home country and the data region is a property of the service, which the vendor can change, not of the law, which it cannot. Both illustrative organisations use one, and the view makes the placement visible so that the people who made it can defend it. (Chapter 16)

Evidence. A machine-generated artefact that demonstrates that a control operated, produced by normal operation rather than assembled when an auditor asks: a log the system wrote, a test that ran, an evaluation gate or a policy as code that passed or refused a release. Attestation is not evidence. The notation draws automatic evidence as a solid baseline and as a filled cell in the evidence view; Architecture as Code calls the practice evidence as code. (Chapter 3; adopted from AI Governance, Chapter 11, AI Platform and Security, Chapter 25, and Architecture as Code (Chapter 15A))

Evidence ladder. Five rungs on which a claim is graded by the kind of support it has, not by whether it is true: fiction, argument, laboratory demonstration, incident in the wild and pattern at scale. Fraud and discrimination by means of AI are patterns at scale; agents acting beyond their mandate are incidents in the wild; a system escaping control to catastrophic effect stands at argument and laboratory demonstration. (Chapter 9; adopted from AI Threat, Chapter 4)

Evidence manifest. The artefact that ties one period's evidence for one unit together: what was collected, by what, from where, who may read it, and a signature binding the bundle to the pipeline run that produced it. It sits behind each cell of the evidence view and is what an auditor asks for. (Chapter 17; adopted from AI Governance, Chapter 11)

Expected. The label for a statement about the future that is supported by strong evidence, with uncertain timing or form, within five years. Expected trends justify preparation. The label appears in bold the first time a paragraph makes such a statement. (Chapter 1; adopted from AI Governance, Chapter 22)

F

Fear instinct. The habit of letting the dystopia, the runaway system and the attacker who gets in, crowd out the quiet, measured harms that fill the incident and threat data: fraud, failures that were nobody's attack, discriminatory rankings and disclosure by mistake. Its rule of thumb: when a story frightens you, find the base rate and the quiet harm it hides. (Chapter 9)

Frame. One of three ways of arranging the same marks without adding a dimension: the boundary frame places marks in containers for the organisation, its suppliers and jurisdictions; the time frame draws trails between two dates; the comparison frame draws two landscapes side by side at identical scales with a shared legend. (Chapter 4)

Fundamental rights impact assessment. The assessment Article 27 of the AI Act requires of certain deployers of high-risk AI systems before use; the landscape model records its identifier under registers.fria. Together with the deployer duties of Article 26 and the registration of Article 49, it applies to Annex III systems from 2 December 2027. (Chapter 11)

G

GDPR. Regulation (EU) 2016/679, the General Data Protection Regulation. Article 22 concerns decisions based solely on automated processing, a binary the law draws on purpose, which the autonomy levels do not replace but locate; Chapter V, Articles 44 to 46, makes every line from a mark to a container outside the EU and the EEA a transfer question where personal data travel along it. (Chapter 1; read in Chapters 6 and 16)

General-purpose AI model. In the AI Act's term, Article 3(63), a model that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of how it is placed on the market; the obligations on its providers, in Chapter V of the Act, have applied since 2 August 2025. The same general-purpose model drafts a letter at one desk and acts on a production system at another, which is why the notation draws the use and not the model. (Chapter 3; read in Chapter 7)

Grades of source. The five ranks in which the book grades every source it uses, and which decide what a figure may support: official statistics, which may support a statement of fact about a population; probability surveys by public or academic bodies, which support a statement about what respondents answered; self-selected surveys, which support a statement about their respondents only; incident databases, which support a statement about what was reported and never about how often harm occurs; and vendor reports, which support a statement about what the publisher reports and are used where nothing better exists. The grade is marked in every caption and sentence that rests on a source below the first. (Chapter 1; applied dataset by dataset in Appendix C)

H

Hansa Mutual. A fictional mutual insurance group headquartered in Hamburg, Germany, with about 9,500 employees in seven countries: Germany, the Netherlands, Sweden and Poland in the EU, Norway in the EEA, and the United Kingdom and Switzerland outside both. It builds and runs its own systems on vendor models, runs six autonomous production agents, and its difficulty is the differences between seven legal regimes. Its landscape is rendered from landscape/models/hansa_mutual.yaml and is illustrative, never evidence. (Chapter 1)

High-risk AI system. An AI system classified as high-risk under Article 6 of the AI Act: under Article 6(2) the systems used for the purposes listed in Annex III, narrowed by Article 6(3) where a system performs a narrow procedural or preparatory task, and under Article 6(1) the products and safety components of Annex I. The notation does not draw the classification, because it follows from the use and the law; the chapters say it in words and the model keeps it in the unit's description. (Chapter 1; read in Chapter 7)

I

Identity. With whose permissions a unit acts, drawn as the shape of the mark: a circle for a person's identity, as an assistant has, and a rounded square for an identity of its own, such as a service account, a workload identity, an agent with its own credentials or a vendor feature acting under the vendor's identity. Where a unit acts with a person's identity the risk is bounded by what that person may do; an agent with an identity of its own becomes a privileged machine insider. (Chapter 3; the shape in Chapter 4; the consequence adopted from AI Red Team, Chapters 6 and 28)

Illustrative. The word every figure, subsection and caption about Nordvik Region or Hansa Mutual carries, because the two organisations are fictional, their landscapes are drawings rendered from a model, and nothing about them is data or evidence. (Chapter 1)

Incident database. A record of harms assembled from what was reported: the AI Incident Database from press reports and public submissions accepted by editors, the OECD's AI Incidents and Hazards Monitor from automated reading of news, ENISA's threat landscape from public reports of attacks on Europe. Each carries a selection bias: its counts measure attention, submission and editorial effort as well as harm, a rise in a count may be a rise in reporting, and a year's total is revised as reports arrive. The book grades incident databases fourth of its five grades of source. (Chapter 1; read in Chapters 7, 9 and 10)

Instinct. One of nine patterns of misperception, each useful elsewhere and each misleading in this landscape, each given a chapter, a measured picture and a rule of thumb: the box instinct, the binary instinct, the model instinct, the straight-line instinct, the fear instinct, the size instinct, the destiny instinct, the single-perspective instinct and the blame instinct. They are this book's own, chosen because the data showed them, and not Rosling's ten; several are cousins of his and are acknowledged as such. (Chapter 1; Chapters 5 to 13)

J

Jurisdiction. The law under which a unit runs, recorded for every supplier as EU, EEA or non-EU and drawn in the supply and sovereignty view as the shaded EU and EEA area or a dotted non-EU container. Jurisdiction changes which law applies to the unit and its data, which supervisor may ask about it, whether moving data to it is a transfer under the GDPR, and whether the stop path is within reach. The EEA is distinguished because EU law reaches Norway, Iceland and Liechtenstein only once an act is incorporated into the EEA Agreement. (Chapter 16)

L

Landscape. The landscape is the world that appears inside a large European enterprise or public authority when its architecture becomes code and AI goes to work in it, as an assistant to a person, as a feature a supplier switched on or as an agent with an identity of its own. A landscape is the picture of one organisation drawn in Contour at one date: "Nordvik Region's landscape at the start of 2027". (Chapter 1)

Landscape model. The machine-readable file, one YAML file per organisation in landscape/models/, validated against landscape/schema/landscape.schema.json, from which every view is rendered and never from hand-placed coordinates. It records for each unit the seven dimensions, the suppliers it depends on by role and jurisdiction, the identifiers of the registers that populated it, a lifecycle status (planned, pilot, active, paused or retired) and a timeline of changes by date; the book calls it landscape as code. (Chapter 4; populated in Chapter 14; described field by field in Appendix A)

Large language model (LLM). A model trained on very large amounts of text that, given a prompt, produces text in return. An assistant is an LLM put to work for a person; an agent is a model directing its own tool calls. (Chapter 3)

Legend. The strip every view carries in its margin, in the same order every time: the five columns and four rows named; the four sizes; the six mode colours with their numbers; the two shapes; the diamond, filled and hollow; the seat with "T1 to T4"; the baseline, solid and dashed; and, where the view uses them, the three container borders and the trail. The comparison view carries one legend between its two panels, never two. (Chapter 4)

M

Mandate. A written statement of what a unit may do, within which it acts and outside which it may not, so that the policy decision point refuses any action that cannot be tied to a valid, signed mandate. A unit at Level 3 Bounded acts inside a mandate, and approval then moves from the individual action to the playbook and the record that approved it. (Chapter 3; adopted from AI Red Team, Chapters 6 and 7)

Mandate manifest. The mandate of an agent kept as code (MND-*), which answers who decides what the AI may do, who decides each action, who answers for it and who can stop it, with a level per action for each agent. It fills a unit's level, action classes, policy point and stop holder in the landscape model; Nordvik Region's security architect runs their own agentic work tool under MND-NR-01, aligned in 2027 with the ceiling the role charter set, and in the scenario the platform team's agents are brought under the same ceiling. (Chapter 14; adopted from The Transformed Security Architect, Chapter 13)

Mark. The drawing of one unit: a circle or a rounded square, in one of four sizes, filled in the colour of its mode with the mode's number inside, placed in the cell of its autonomy level and reversibility tier, with a diamond on its left edge, a seat above it and a baseline beneath it, each present or absent. A paused unit is drawn hollow and a retired unit hollow with a cross. (Chapter 1; taught in Chapter 4)

Model chip. A small box labelled "model" in a supplier's container of the supply and sovereignty view, joined by a thin line to each mark that takes its model from that supplier while sitting in another container. The chip separates "who runs this" from "whose model is this"; a unit whose only supplier is a model provider sits in that provider's container and needs no chip, and the model's name never appears on the page. (Chapter 4; read in Chapters 7 and 16)

Model instinct. The habit of treating the model as the risk and the value, asking "which model" first, when the usage mode and the use set both: the same general-purpose model is a drafting aid at one desk and an agent with its own permissions at another. Its rule of thumb: ask what it is used for and who deploys it before you ask which model it is. (Chapter 7)

Moral crumple zone. The position of a person attached to a system's output who can absorb the blame when it fails without having had the means to decide otherwise. A seat drawn for such a person is worse than none, because it tells the board the question is answered. (Chapter 13; adopted from AI Boss, Chapters 4 and 33)

N

Named human decider. The person who holds the decision right for a consequence, who must be identifiable, able to decide otherwise, informed independently of the system, given time, protected if they deviate and answerable: six capabilities, because a name is necessary and not sufficient. The review of a unit asks the six questions before the seat is drawn. (Chapter 13; adopted from AI Boss, Chapters 4 and 33)

NIS 2. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, whose incident-reporting duties on entities in its scope are one of the instruments that will require the same records to be kept and shown to more than one reader. (Chapter 12)

Nordvik Region. A fictional regional public authority in a Nordic member state of the European Union, with about 6,000 employees and about 450,000 residents, which coordinates regional health and social care, runs regional development and public transport and administers needs-based financial assistance for its municipalities. It buys most of what it runs, is a deployer of a high-risk AI system, lives under one legal regime and public law, and runs no autonomous production agent. Its landscape is rendered from landscape/models/nordvik_region.yaml and is illustrative, never evidence. (Chapter 1)

O

Observable. The label for a statement about something happening now and documented: in adopted legislation, published guidance, cited standards, a published dataset or a production system. Observable trends justify commitment. (Chapter 1; adopted from AI Governance, Chapter 22, which lists legislation, guidance, standards and production systems; the published dataset is this book's addition)

Official statistics. Surveys run under statistical law by a statistical office, with a documented population, a published questionnaire and a known method, such as Eurostat's surveys of ICT usage in enterprises and in households and the Digital Decade indicators the Commission computes from them. They are the first of the book's five grades of source, and even they carry flags the prose must repeat: a break in series where the question or the method changed, an estimate where values are aggregated. (Chapter 1)

P

Perception survey. A survey that asked people what they believe or feel about a subject, set beside the measured answer to a test question in the words "respondents answered" and the share. Where no such survey exists the question is a self-test. The book never writes that respondents were ignorant or failed. (Chapter 1)

Policy decision point. Deterministic code outside the model, between the model and the tools it may call, that evaluates every request against a versioned manifest before the request executes and refuses what the manifest does not allow. A rule in a model's instructions lowers the rate at which the model breaks it; a rule enforced outside the model sets a ceiling on what happens when it does. (Chapter 3; adopted from AI Platform and Security, Chapters 4 and 11)

Policy point. The small diamond on the left edge of a mark that says whether a policy decision point outside the model enforces what the unit may call, read, write or send: filled where it is enforced, hollow where one is planned, absent where there is none. In the decision-rights view it is drawn at the ceiling, where its job is to say whether the ceiling is a rule or a hope. (Chapter 4)

Possibilist. The stance of the book, in the sense Rosling gave the word: neither an optimist nor a pessimist, but someone who looks at the measured picture, sees the problems and the progress in it at the same time, and asks what can be done. On this landscape the data support neither the loudest hopes nor the loudest fears; they support work. (Chapter 1)

Probability survey. A survey by a public or academic body with a sampling frame and weights, such as Special Eurobarometer 554, the Joint Research Centre's AIM-WORK survey and Pew Research Center's panels, which can speak for a population. It is the second of the book's five grades of source. (Chapter 1)

Provider. Under Article 3(3) of the AI Act, a body that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. The role follows what a body does with a system, not which model is inside it, and Article 2(1) reaches providers outside the Union whose systems are used inside it. (Chapter 1; read in Chapters 7 and 16)

Q

Quiet harms. The harms that fill the records and rarely the headlines: a service down because a server failed, a benefit deprioritised by a ranking nobody can explain, a letter sent to the wrong address by a feature a vendor switched on, fraud against people, discriminatory rankings and disclosure by mistake. The loud harms, the runaway system and the attacker who gets in, set the agenda; the quiet ones are the common case, the ones an organisation can count, prevent and reverse, and the ones that get the least design attention. (Chapter 9; the priority adopted from AI Boss, Chapters 1 and 33)

R

Reach. The number of people whose work or whose outcomes a unit's actions touch in a year, drawn as the area of the mark in four fixed sizes: S under 100, M 100 to 999, L 1,000 to 9,999, XL 10,000 and more, with radii in the ratio 1 : 1.6 : 2.4 : 3.4. Reach counts people, never transactions: a unit touching 40,000 applications of 25,000 applicants is XL by people. (Chapter 4)

Red outline rule. A mark at Level 3 Bounded without a filled diamond is drawn with a thin red outline, because a Level 3 capability without a policy decision point outside the model is Level 4 with a misleading label. The renderer applies the rule and the tests report every such unit. (Chapter 4; the conclusion adopted from AI Red Team, Chapter 6)

Renderer. scripts/render_landscape.py, which validates a landscape model against the schema, applies its timeline to the date asked for, places the marks and writes every view as SVG and PNG with identical bytes on every run, so that a stale figure fails the build. A figure of either illustrative organisation that it did not produce may not appear in the book. (Chapter 4; commands in Chapter 14 and Appendix A)

Reversibility test. The check, run per delegated function and not per system, of whether the organisation could perform the function without the unit for a defined period: name the function, state the period, name the documented fallback, run it for real in a bounded unit, classify the result as passed, passed with conditions or failed, freeze further delegation on a failure, date the next test and record it beside the decision. A failed test moves the mark up a row. (Chapter 11; adopted from AI Threat, Chapter 26, and AI Boss, Chapter 25)

Reversibility tier. What it would take to undo the action the AI takes or shapes, drawn as the row of a mark with the hardest to reverse at the top: R1 Reversible at once, undone in minutes with nothing having left the organisation, as a draft or a quarantined email; R2 Reversible with effort, hours to days and a known procedure, as a routed case or a roster; R3 Hard to reverse, a person's outcome, money or disclosed data affected and weeks and a process to reverse, as a benefit application deprioritised for a month; R4 Irreversible, physical action, safety, legal finality, destroyed records or disclosure to the world. The tier is assessed on the action, not on a breach, at the hardest class the unit holds, and a Level 0 Advisory unit can sit at R3 because its suggestion shapes an outcome. The four tiers are this book's own. (Chapter 4; assessed in Chapter 14)

Rule of thumb. The one-sentence rule that answers each instinct, set in a blockquote once in its chapter, with a statement of where it stops applying. The nine rules are collected in Chapter 19 and printed word for word on one page at the end of Appendix B. (Chapter 1; Chapters 5 to 13)

S

Seat. The small grey circle above a mark carrying the decision tier of the person who holds the decision right for the unit, T1 to T4; absent when nobody is named, T0, so that the absence is visible. People appear in the notation only here, in neutral grey whoever holds the seat, because the book's question about people is who decides, not where they sit in the organisation chart. In the decision-rights view the seat sits at the ceiling. (Chapter 4)

Self-selected sample. A survey answered by whoever chose to answer, such as the Stack Overflow Developer Survey, large and informative and representative only of its respondents. The book quotes such surveys as perception data about the people who answered and never as a share of a population; they are the third of its five grades of source. (Chapter 1)

Self-test. A test question for which no published survey asked a comparable population, so that the reader's own answer is the only perception data there is. (Chapter 1)

Seven dimensions. The seven properties every mark carries and the only things the notation encodes: autonomy level (column), reversibility tier (row), reach (size), usage mode (colour), identity (shape), control (the policy point diamond and the seat) and evidence (the baseline). The modes and the levels are adopted from the series by their exact names; the reversibility tiers, the reach classes, the decision tiers and the kinds of evidence are this book's own. (Chapter 4)

Shadow AI. AI use that no inventory explains: the model services people reach from their desks that appear in the proxy logs and in no register, and the features vendors switched on inside licensed software. The book's prose does not use the term; its method is to draw every such use as a unit with decision_tier: T0 and a bare mark rather than leave it off the page, because a landscape without it is a landscape of what was decided rather than of what runs. (Chapter 14)

Single-perspective instinct. The habit of seeing only security, only compliance or only productivity, when the three sit on one landscape and move together, and one chair decides for all three. Its rule of thumb: before you decide, read the landscape from the other two chairs. (Chapter 12)

Size instinct. The habit of being impressed by a large number without its denominator, its base rate or its comparison. Its rule of thumb: never accept a number alone; ask what it is divided by and compared with. The rule corrects the size of a thing and does not excuse a harm: one irreversible outcome for one person is not made small by a rate. (Chapter 10)

Snapshot. One of the named dates in a landscape model's snapshots block, such as "Start of the year" and "End of the year", at which the renderer draws the one-page landscape, the supply, decision-rights and evidence views, and between the first and last of which it draws the landscape over time; the dates are fixed before the year starts and not moved. The book also uses the word in its ordinary sense for a dated copy of a dataset, such as the AI Incident Database's snapshot of 2 November 2026. (Chapter 18; the model in Appendix A)

Sovereignty. Digital sovereignty as a set of verifiable properties rather than a location: knowing where a workload runs and which law governs it, being able to move it, and being able to continue if a provider fails. The containers of the supply and sovereignty view answer the first two; the other two are the questions to ask of every dashed container. Model origin is a risk separate from hosting, which is why the model is drawn as a chip. (Chapter 5; taught in Chapter 16; adopted from AI Platform and Security, Chapter 13, and AI Governance, Chapter 6)

Speculation. The label for a statement about the future that is plausible and consequential but not yet evidenced. Speculation justifies reversibility, not commitment; it is written down so that it can be wrong on the record rather than absent from it. A weak estimate is labelled speculation. (Chapter 1; adopted from AI Governance, Chapter 22)

Stop drill. A test that measures the time between the decision to stop a unit and the unit being stopped, against a budget in minutes, run for real and logged. Hansa Mutual's first drill of its IT-operations agent took 17 minutes against a budget of 5 and moved the seat to the board; Nordvik Region's first out-of-hours drill of its benefits-triage system took 26 minutes against 15. A drill result is evidence in the tests column of the evidence view; a stop path that has never been drilled is a declaration. (Chapter 3; read in Chapters 13 and 17)

Stop path. The named people who may stop a unit without asking anyone, the mechanism they use, from where, and the time it takes, running outside the system it stops, because a stop path that runs inside the system it stops fails when it is needed. The notation gives it no glyph of its own, on purpose: it is a property the decision record names, the drill measures and the evidence view shows as a test result. (Chapter 3; adopted from AI Governance, Chapter 13, and AI Threat, Chapter 24)

Straight-line instinct. The habit of extending the last two points of an adoption or capability curve into the future, when the measured curves bend, stall and jump, because adoption and capability are sums of separate decisions and not motion. Its rule of thumb: never extend the last two points; ask what bent the last curve and what could bend this one. (Chapter 8)

Supplier role. What a supplier does for a unit, one of four: model provider, who trained and serves the weights the unit calls; hosting, on whose computers and in which country the unit runs; application, who built and supplies the software around the model; operations, who runs the service day to day and holds the credentials. A supplier container is labelled by role and jurisdiction and never by brand, because brands change, one brand plays several roles and the law attaches to roles. (Chapter 4; taught in Chapter 16)

T

Test, the. The fourteen multiple-choice questions that open the book, three options each, every answer traceable to a public dataset kept in the repository behind the book; written "the test", with its questions referred to as "Question 3". Random choice gives between four and five correct answers of fourteen; that educated readers taken together score below that is the author's expectation, not a measurement. The test returns with its measured answers, and what would change each, in Chapter 20. (Chapter 1)

Thirty-second reading. The fixed order in which any landscape is read: look at the empty corner first; count the squares at Level 3 Bounded and above, which are the agents, each of which should have a filled diamond and a seat; find the marks without a seat; find the dashed baselines at R3 Hard to reverse; look at the colours, where Mode 0 marks without a seat are AI nobody chose and Mode 5 marks are AI that acts; then, and only then, read the names. (Chapter 4)

Three chairs. The productivity, security and compliance readings of one landscape, each competent and each looking at one dimension of a mark that has seven: productivity reads colour, size and column; security reads shape, diamond and the empty corner; compliance reads row, seat and baseline. A three-chair review seats all three, has each read aloud in its own order, rotates once and records three readings and one decision; a works council or the people a unit touches may be a fourth chair. (Chapter 12)

Timeline. The dated entries in a unit's record in the landscape model, each carrying a date, a note naming the decision behind it and only the fields that changed; the renderer applies every entry dated on or before the date asked for, so that the same lines read on two dates draw a trail. No trail without an entry, no entry without a note, and no note that does not name the decision. (Chapter 14; taught in Chapter 15)

Trail. The drawing of change in the time frame: a hollow outline of the mark at its earlier position, a thin line in the mark's colour and the filled mark at its later position, with the two dates in a strip under the view. Only a change of column or row earns a trail; a change of colour, size, shape, diamond, seat or baseline is shown in the later mark alone. A mark that appeared in the period carries a small tick and the word "new"; a mark retired in the period is drawn hollow with a cross where it last stood. No more than two dates are drawn in one view. (Chapter 4; taught in Chapter 15)

U

Unit. The thing drawn: one AI use, one way in which an organisation puts a model to work, with the people who work with it. A unit is not a model, a vendor or a product: the same model used in two ways is two units, and one product that drafts and also files is two units. It corresponds to one entry in the AI inventory, one mandate manifest or one delegation profile, and each unit is one mark. (Chapter 1; defined in Chapter 4)

Usage mode. How the organisation came to use the model, drawn as the fill colour of a mark with the mode's number inside or beside it, on six modes adopted by their exact names: Mode 0 Ambient AI, Mode 1 Conversational assistants, Mode 2 Embedded workplace assistants, Mode 3 Agentic work tools, Mode 4 Built AI applications and Mode 5 Autonomous production agents. Using a model is not one activity but at least six; the usage mode, not the brand, sets the governance, and each mode puts the organisation's control point in a different place, from a supplier contract in Mode 0 to a dedicated identity, a mandate and a tested stop path in Mode 5. (Chapter 3; adopted from AI Governance, Chapters 2 and 25, with the control points from AI Platform and Security, Chapter 2)

V

V1 The one-page landscape. The first standard view: every unit as a mark on the grid of autonomy level by reversibility tier, with size, colour, shape, diamond, seat and baseline, at one date, rendered as view_<org>_landscape_<date>.png. It is the view a committee paper of one page can carry, and its first draft is a count. (Chapter 4; drawn from the registers in Chapter 14)

V2 The landscape over time. The second standard view: V1 at the later of two dates with a trail for every mark that changed cell, a tick on every new mark, a cross on every retired one and the two dates in a strip under the view, rendered as view_<org>_year_<from>_<to>.png. It is rendered every quarter, not every year, and read for movement; the decision-rights and evidence views at both dates are read for the changes no trail can show. (Chapter 4; taught in Chapter 15)

V3 The supply and sovereignty view. The third standard view: the same marks moved off the grid into the containers of whoever runs them, the organisation's own boundary, EU and EEA suppliers by role, non-EU jurisdictions, with model chips, rendered as view_<org>_supply_<date>.png. It answers the question no screen answers: where does this run, and under whose law. (Chapter 4; taught in Chapter 16)

V4 The decision-rights view. The fourth standard view: one row per unit, sorted by level and id, a bar from Level 0 Advisory to the unit's ceiling with a thin bar per action class, the diamond and the seat at the ceiling, and the Level 4 column shaded for units at R3 or R4, the empty-corner rule extended to the hard-to-reverse row, rendered as view_<org>_decisions_<date>.png. It shows for every unit who decides, up to which level, for which actions, and whether anything outside the model enforces the limit. (Chapter 4; taught in Chapter 17)

V5 The evidence view. The fifth standard view: one row per unit and columns for the kinds of evidence, logs, tests and evaluations, gates and policies as code, attestations, and none; a filled cell for automatic evidence, a hatched cell for attested, and the word "none" in red where there is neither, rendered as view_<org>_evidence_<date>.png. A hatched cell beside filled cells is honest; a hatched cell alone on an R3 row is the question to ask. (Chapter 4; taught in Chapter 17)

V6 The comparison view. The sixth standard view: two V1 views side by side at identical scales, sizes and colours, with one shared legend between them and a summary strip under each counting the units per mode and per level and the marks with a filled diamond, a seat and a solid baseline, rendered as view_compare_<orgA>_<orgB>_<date>.png. Nothing may be rescaled to fit, and the strips count but never rank. (Chapter 4; read for a year in Chapter 18)

Vendor survey. A survey of a market by a party that sells into it, such as Microsoft's Work Trend Index, Ipsos's self-funded AI Monitor or DORA's survey of software delivery, quoted where nothing better exists and marked "vendor survey" in the caption or the sentence that rests on it, with its sample and method where the vendor gives them. It is the fifth of the book's five grades of source. (Chapter 1)

Verified, declared, failed. The three words an auditor uses of a control: verified when a test that re-runs its scenario has passed recently and produced evidence by operation, declared when somebody says so, and failed when the test ran and did not pass. In the evidence view a filled cell is verified or failed, a hatched cell is declared, and the result sits in the evidence manifest behind the cell. (Chapter 3; read in Chapter 17; adopted from AI Threat, Chapter 30, and The Transformed Security Architect, Chapter 9)

W

Works council. The elected body of an establishment's employees which, in Germany and under different national rules in the Netherlands and Sweden, must be consulted or must co-determine before a system that can monitor employees' behaviour or performance goes live. In a three-chair review it is a fourth chair that reads the landscape by what each mark records about a person; at Hansa Mutual two marks changed on 30 April 2027 under a policy it was invited to review. (Chapter 12)