--- title: "Glossary" description: "Plain-language definitions for Norcaster terms: deployments, workflows, policies, enforcement events, traces, evals, retrieval, and MCP." canonical: https://www.norcaster.com/docs/glossary --- Glossary # Norcaster terms in plain English Use this page as the canonical vocabulary for product docs, support answers, and the Norcaster Assistant. ## Deployment A production-facing model endpoint or logical model binding that Norcaster runs through its runtime control plane. ## Inference target The concrete backend behind a deployment. Workflow model and agent nodes execute through provider-backed inference targets. ## Provider model A model exposed by an external provider such as Anthropic, OpenAI, Azure OpenAI, Bedrock, Groq, Together, Voyage AI, or similar. ## Workflow A versioned graph of nodes that can fetch data, transform payloads, redact text, call tools, run retrieval, and invoke models. ## Node One step in a workflow, such as mcp\_input, redact\_text, model, agent, function, retrieval, tool\_call, router, condition, approval, or output. ## Agent A workflow node that lets a provider-backed chat model call configured functions through a bounded native tool-calling loop. ## Function A deterministic workflow node or agent tool that executes HTTP, webhook, or internal logic without arbitrary local code execution. ## MCP input A workflow node that connects to an MCP server and normalizes tool or resource output into text, raw, items\_count, and has\_text. ## Policy A runtime rule that decides whether to allow, block, warn, redact, or budget-gate a request. ## Contract A schema or feature expectation for request or response shape. Contracts make AI payloads predictable. ## Enforcement event An audit record that captures what policy or contract decision happened for a request. ## Trace A request timeline showing steps, latency, errors, retrieval, citations, evals, and policy decisions. ## Eval A saved quality check for AI outputs, similar to a test suite for prompts, retrieval, or model changes. ## Retrieval / RAG Looking up your own documents or chunks so model responses can be grounded in private knowledge. ## Knowledge base A configured collection of sources, chunks, embeddings, and vector indexes used for retrieval. ## Redaction Replacing sensitive text such as emails, phone numbers, IDs, or custom regex matches before provider inference. ## Audit export A downloadable evidence package showing requests, enforcement events, redaction summaries, and model payload visibility. ## AI Runtime Control Plane The runtime layer between applications and model providers that deploys, controls, observes, and evaluates production AI — enforcing policy before inference and recording evidence per request. Norcaster's product category. ## Runtime evidence Tamper-evident, time-stamped records that controls actually fired on live AI traffic — policy decisions, redaction events, approvals, provider attribution — as opposed to policy documents, which state intent but prove nothing. ## Evidence vs. attestation Norcaster's honesty model: an obligation is runtime-evidenced only when a stored field backs it; obligations needing a human judgment (an access review, an organizational process) are attestations, recorded with owner and review date. Evidence is produced by the platform; verdicts are rendered by auditors and counsel — never by Norcaster. ## Audit bundle A manifest-led evidence package (PDF, CSV, or JSON) composed on demand: policy configuration, enforcement records, redaction evidence, provider activity, change history, register extract, attestations, and coverage — stamped with the catalogue and policy versions in force, and independently verifiable with a bundled standalone script. ## Criterion mapping (SOC 2) The section of a SOC 2-scoped audit bundle that maps each Trust Services Criterion to its honesty tag, the bundle sections backing it, and the evidence rows included — the artifact a CPA firm's workpapers cite. Norcaster evidences; only a licensed CPA firm attests. ## Obligations map The in-product view showing which obligations (EU AI Act or SOC 2 TSC) carry live runtime evidence with counters and permalinks, which carry attestations with owners and review dates, and which are out of scope — a dashboard where every status is backed by stored data. ## Hash-chained trace store A per-tenant append-only ledger where each record carries the SHA-256 digest of the previous one, so undetected alteration breaks the chain; segment Merkle roots anchor to the public Sigstore Rekor transparency log for verification without trusting Norcaster. ## External Reviewer role A scoped, time-boxed, read-only access role for auditors and legal reviewers, enforced by a server-side deny-list — never API keys, provider secrets, or billing — with every access audit-logged from entry to expiry. ## Assistant guidance When answering users, prefer these stable terms. If a user says “quality checks,” explain that Norcaster calls them evals. If a user says “document lookup,” explain retrieval or RAG. If a user says “safety rules,” explain policies, contracts, and enforcement events.