Glossary

Every acronym and term the site leans on, said the simple way. Where a term comes up a lot in interviews, there is a line you can actually say out loud. Acronyms are also spelled out the first time they appear on each page.

Interview and delivery

FDEForward Deployed Engineer: An engineer who sits with the customer, figures out the real problem, and ships a working system in their environment.Say it like “My job is to turn a vague customer ask into something running in production.”
FRfunctional requirement: Something the system must do: answer this question, draft that email, update that ticket.
GAgenerally available: A product feature that is fully released and supported — not preview or beta.
ICindividual contributor: Someone who leads through their own work rather than by managing people.
MVPminimum viable product: The smallest version that proves the idea works for real users. Not a demo — something people actually use.
NFRnon-functional requirement: How well the system must work — speed, safety, uptime, cost — as opposed to what it does.Say it like “Fast, safe and cheap mean nothing until I put a number and a workload on each.”
PMproduct manager: The person who owns what gets built and why.
QAquality assurance: Checking the thing works before real users see it.
RACIresponsible, accountable, consulted, informed: A table that says, for each task, who does it, who signs it off, who is asked and who is told.
SMEsubject-matter expert: The person at the customer who actually knows the domain — the one who can tell you if an answer is right.
STARsituation, task, action, result: The four-beat shape for a behavioural answer: what was going on, what you owned, what you did, what changed.

Models and AI

AIartificial intelligence: Here, almost always means systems built around large language models.
ASRautomatic speech recognition: Speech-to-text. In a live call, its delay and errors flow into everything after it.
DPOdirect preference optimisation: Training a model on pairs of "this answer is better than that one", without a separate reward model.
Fine-tuning: Training an existing model further on your own data. Usually the last thing to reach for, after prompting and retrieval.
GEPA: An automated prompt-optimisation method: it proposes prompt changes, scores them on an evaluation set, and keeps the best.
GPT: OpenAI's family of large language models. Often used loosely to mean any chat model.
Hallucination: The model stating something that sounds right but is not supported by any source.Say it like “I don't try to stop the model guessing — I make it answer only from evidence, and check it did.”
LLMlarge language model: The model that reads text and writes text — GPT, Claude, Llama. Powerful, but it will confidently make things up if you let it.
LLM-as-judge: Using a model to grade another model's answers against a rubric. Cheap and fast, but you calibrate it against human grades first.
MASTMulti-Agent System failure Taxonomy: A 2025 study that sorted why multi-agent systems fail. Most failures were bad specs and agents misreading each other, not the model itself.
MLmachine learning: Models that learn patterns from data instead of following hand-written rules.
NLnatural language: Plain human language, as opposed to code or SQL.
OCRoptical character recognition: Turning scanned pages or images into text. Often where document pipelines quietly lose accuracy.
RLHFreinforcement learning from human feedback: Teaching a model which answers people prefer by rewarding the preferred ones.
SFTsupervised fine-tuning: Training a model further on good example inputs and outputs so it copies that behaviour.
VADvoice activity detection: Working out when someone has started or stopped talking.

Retrieval and data

ANNapproximate nearest neighbour: Vector search that trades a little recall for a huge speed-up by not comparing the query with every vector.
BIbusiness intelligence: Dashboards and reports over company data.
BM25: The standard keyword-search scoring method. Great at exact names, codes and IDs that vector search misses.
CDCchange data capture: Streaming each insert, update and delete from a source database so downstream copies stay current without full reloads.
Chunking: Splitting documents into pieces small enough to search and fit in a prompt, without cutting the meaning in half.
CSVcomma-separated values: A plain spreadsheet file.
DBdatabase: Where the data lives.
EDIelectronic data interchange: Old but everywhere: the standard file formats companies use to swap orders, invoices and shipment updates.
Embedding: A list of numbers that captures what a piece of text means, so similar meanings end up close together.
FAISS: Meta’s open-source library for fast vector similarity search on CPU or GPU.
Grounding: Tying every claim in an answer back to a source the user can check.Say it like “Grounded is not the same as correct — the source itself can be stale or wrong.”
Hybrid search: Running keyword search and vector search together and merging the results — catches both exact terms and meaning.
IDidentifier: The unique key for a record — a customer ID, a ticket ID, a request ID you can trace end to end.
INT88-bit integer: Storing each vector number in one byte instead of four, which cuts index memory at a small cost in recall.
IVFinverted file index: A vector index that groups vectors into clusters and searches only the clusters nearest the query.
JSON: The standard text format for structured data passed between systems.
MMRmaximal marginal relevance: A way to pick retrieved chunks that are relevant but not repeats of each other, so the context covers more ground.
MRRmean reciprocal rank: A retrieval score: for each query, one divided by the rank of the first relevant result, averaged over all queries. In business talk the same letters mean monthly recurring revenue; on this site they always mean the retrieval score.
NDCGnormalised discounted cumulative gain: A ranking score that rewards putting the most relevant results nearest the top.
PDF: The document format that looks the same everywhere — and is often painful to extract text from.
PQproduct quantization: A way to compress each vector into short codes, so a large index fits in memory at a small cost in accuracy.
RAGretrieval-augmented generation: Fetch the relevant documents first, then have the model answer only from them.Say it like “The model doesn't know the customer's data, so I retrieve the right evidence and make it answer from that, with citations.”
RAGAS: An open-source library that scores a retrieval-augmented generation pipeline on faithfulness, relevance and context quality.
RDSAmazon Relational Database Service: AWS’s managed PostgreSQL, MySQL and similar databases.
Reranking: A second, more careful pass that reorders the top search results before they go to the model.
RRFreciprocal rank fusion: A simple way to merge two ranked result lists — each result scores by how high it sits in each list.
SQLstructured query language: The language for asking questions of a database.
UCUnity Catalog: Databricks’ governance layer: one place for table, model and file permissions, lineage and audit.
Vector search: Finding the chunks whose meaning is closest to the question, using embeddings.

Agents and tools

Agent loop: Think, pick a tool, look at the result, repeat — until the task is done or a limit is hit.
APIapplication programming interface: The way one system lets another call it. For an agent, every tool is usually an API call.
ASTabstract syntax tree: Code parsed into its structure — functions, calls, imports — so a tool can reason about it rather than raw text.
Guardrail: A check before or after the model — block unsafe input, stop a bad action, catch a leaked secret.
HITLhuman in the loop: A person approves or corrects the AI before anything risky happens.Say it like “The agent recommends; a human approves the write. I make that approval durable so it survives a restart.”
IDEintegrated development environment: The code editor a developer works in.
LCELLangChain Expression Language: LangChain’s pipe syntax for chaining prompts, models, retrievers and parsers into one runnable.
MCPModel Context Protocol: An open standard for plugging tools and data sources into an AI app, so each tool is written once and reused.
Orchestrator: The part that decides which step or agent runs next and keeps track of where the task is.
Prompt injection: Text hidden in a document or web page that tries to hijack the model: "ignore your instructions and…".Say it like “I treat everything the model reads as untrusted, and the model never holds more permission than the user.”
REST: The most common style of web API: resources at URLs, read and changed with HTTP calls.
RFCRequest for Comments: The documents that define internet standards — RFC 9110 is the one for HTTP.
SDKsoftware development kit: A ready-made library for talking to a service.
SOAPSimple Object Access Protocol: An older XML-based web-service protocol that many enterprise systems still expose instead of a REST API.
Tool calling: The model asking your code to run a function — search, look up an order, create a ticket — and using the result.

Security and compliance

ABACattribute-based access control: Permissions decided by attributes — region, department, data sensitivity — not just role. Finer-grained than RBAC.
ACLaccess control list: The list of who is allowed to see or change a thing.Say it like “I filter by the user's permissions before retrieval, not after — the model should never see what the user can't.”
Blast radius: How much damage one mistake can do. You design to keep it small.
CVECommon Vulnerabilities and Exposures: The public catalogue of known security flaws, each with an id such as CVE-2024-1234.
DLPdata loss prevention: Tools that stop sensitive data leaving where it should stay.
DLSdocument-level security: A search index that filters results per document by who is asking, so a user only ever matches what they may read.
Fail closed: When a safety check breaks or times out, block the action rather than let it through.
GDPRGeneral Data Protection Regulation: The EU's data-privacy law: consent, the right to be forgotten, where data may live.
HIPAAHealth Insurance Portability and Accountability Act: The US law on protecting health data.
HMAChash-based message authentication code: A signature that proves a message came from who it says and was not changed on the way.
IAMidentity and access management: Who can sign in and what each identity, person or service, is allowed to touch.
JWTJSON Web Token: A signed token that carries who the user is and what they may do, checked on every request.
KMSkey management service: The service that holds and rotates encryption keys, so your app never stores them itself.
Least privilege: Give every user, service and agent only the access it needs for this task, and nothing more.
OBOon-behalf-of: A service acting with the signed-in user's own permissions, by forwarding their token, rather than with a service account of its own.
OIDCOpenID Connect: The login layer on top of OAuth. OAuth only says what an app may do; OIDC adds who the user is, as a signed ID token.
OWASP LLM Top 10: OWASP's list of the biggest risks in LLM apps. LLM01 is prompt injection; the others cover things like leaking data and giving the model too much power.
PCI DSSPayment Card Industry Data Security Standard: The rules for handling card data. The one that bites voice systems: never keep the card security code — not even in a call recording.
PHIprotected health information: Health data tied to a person. Heavily regulated, especially in the US.
PIIpersonally identifiable information: Anything that identifies a person — name, email, phone, account number. It needs masking, access control and care in logs.
RBACrole-based access control: Permissions given by role: managers can do this, agents can do that.
Red teaming: Deliberately attacking your own system to find how it breaks before someone else does.
RLSrow-level security: The database only returns the rows this user may see. Watch who can bypass it — in Postgres, table owners and superusers do unless you force it on.
SAMLSecurity Assertion Markup Language: The XML standard enterprises use for single sign-on between their identity provider and an application.
SECUS Securities and Exchange Commission: The US markets regulator. Its rule 17a-4 says how long broker-dealers must keep records, and how.
SHASecure Hash Algorithm: A family of hash functions used to fingerprint content, for example to detect changed documents.
SOC 2: An audit report showing a vendor handles customer data securely. Enterprise buyers ask for it before signing.
SOXSarbanes-Oxley Act: The US law on financial-reporting controls. It is why finance teams want every change to leave an audit trail.
SSNsocial security number: The United States personal identity number: a classic example of sensitive personal data.
SSOsingle sign-on: One company login for every app. It is also where you get the user's identity to enforce permissions.
Tenant isolation: Making sure one customer's data, prompts, caches and logs can never show up for another customer.
TLSTransport Layer Security: The encryption that protects data in transit, the S in HTTPS. mTLS makes both sides prove who they are.
XPIAcross-prompt injection attack: Instructions hidden in content the model reads — a document, web page or tool result — that try to hijack it.

Reliability and operations

ALBApplication Load Balancer: AWS’s HTTP load balancer, which spreads requests across healthy service instances.
APMapplication performance monitoring: Tooling that traces requests through a service and shows where time and errors come from.
Backpressure: Slowing down or rejecting new work when the system is full, instead of falling over.
Canary release: Ship the new version to a small slice of traffic first, watch it, then widen.
CI/CDcontinuous integration and continuous delivery: The automated pipeline that tests and ships every change.
Circuit breaker: Stop calling a dependency that keeps failing for a while, instead of hammering it.
CMDBconfiguration management database: The IT inventory: which services exist, who owns them, what depends on what.
DLQdead-letter queue: Where messages go after they keep failing, so they stop blocking everything else and someone can look at them.
DNSDomain Name System: The internet’s address book: it turns a host name into an IP address.
Drift: Quality slowly changing because the data, the users or the model changed underneath you.
ECSAmazon Elastic Container Service: AWS’s managed way to run containers without operating Kubernetes.
FIFOfirst in, first out: Handle things in the order they arrived.
Golden set: A fixed set of real questions with agreed right answers, run on every change to catch regressions.Say it like “Nothing ships unless it holds up on the golden set.”
Idempotency: Doing the same request twice has the same effect as doing it once — so a retry never double-refunds.Say it like “Every write carries an idempotency key, so retries are safe.”
ITIL: The standard playbook for IT service management processes.
ITSMIT service management: How an IT team runs tickets, incidents and changes — ServiceNow is the typical tool.
Observability: Being able to see why the system did what it did — logs, metrics, traces, and for AI, the prompt and evidence behind each answer.
RCAroot cause analysis: Working out why something actually broke, not just what broke.
Retry amplification: Every layer retrying a failed call, so one outage turns into a flood of traffic that makes it worse.
RPOrecovery point objective: How much data you can afford to lose in a disaster, measured in time.
RTOrecovery time objective: How long you can afford to be down in a disaster.
SEVseverity level: The incident severity scale. SEV-1 is the worst: a major outage that pages everyone.
Shadow mode: Run the new system on real traffic but don't show its output to users — just compare it with what happened.
SLAservice level agreement: The promise to the customer, usually with penalties. Looser than the SLO, so you have room.
SLIservice level indicator: The actual measurement behind an SLO — latency, error rate, answer success rate.
SLOservice level objective: The target you commit to internally: "95% of answers in under 3 seconds".Say it like “I set the SLO on a stated workload and window, then alert when we burn through the error budget.”
SREsite reliability engineering: The team and practice that keeps production running: on-call, SLOs, incident response.
TTLtime to live: How long a cached or stored item stays valid before it expires.

Performance and cost

CDNcontent delivery network: Servers around the world that cache content close to users.
CPU: A general-purpose processor.
DBUDatabricks Unit: How Databricks bills: you pay for compute time, not for bytes scanned.
FLOPfloating-point operation: A unit of compute. Used to size how much GPU work a model needs.
GPUgraphics processing unit: The chip models run on. Usually the biggest cost line.
KVkey–value: As in "KV cache": the model's memory of the prompt so far, reused so it does not recompute it for every new token.
Model routing: Sending easy requests to a small cheap model and hard ones to a big model.
Noisy neighbour: One heavy customer on a shared platform slowing everyone else down.
P50: Median latency: half of requests are faster than this.
P95: 95% of requests are faster than this. The number users actually feel on a bad day.
P99: 99% of requests are faster than this — the tail. It is where the slow outliers live.
Prompt caching: Reusing the processed start of a prompt that repeats across calls, to save time and cost.
QPSqueries per second: How much traffic hits the system each second.
RAMrandom-access memory: A machine’s working memory; vector indexes that must fit in it get expensive at scale.
RPSrequests per second: How many requests a system handles each second: the usual unit for sizing load.
SSEserver-sent events: A simple way for a server to stream an answer to the browser as it is written.
Tail latency: How slow the slowest requests are (P95, P99). Averages hide it.
TPOTtime per output token: How fast the rest of the answer streams once it has started.
TTFTtime to first token: How long until the first word of the answer appears. With streaming, this is what feels fast or slow.

Business and domain

ATSapplicant tracking system: The recruiting system that holds candidates, applications and hiring stages.
B2Bbusiness-to-business: Selling to companies rather than to consumers.
CCTVclosed-circuit television: Private video surveillance cameras and their recordings.
CFOchief financial officer: The executive who owns the budget. Answer them with cost per outcome, budgets and predictability, not token counts.
CLMcontract lifecycle management: The system that stores contracts and tracks them from draft to renewal.
CRMcustomer relationship management: The sales and customer system of record — Salesforce is the usual example.
CSATcustomer satisfaction score: How happy customers say they are, usually from a quick survey.
DAUdaily active users: How many people use the product on a given day.
EHRelectronic health record: A patient's medical record system.
ERPenterprise resource planning: The system that runs finance, orders and inventory — SAP is the usual example.
ETAestimated time of arrival: When a shipment is expected.
FAQfrequently asked questions: The common questions and their standard answers.
FDAFood and Drug Administration: The United States regulator for medicines, medical devices and food safety.
FHIR: The standard API format for exchanging health records.
HRhuman resources: The people team.
JDjob description: The written description of a role that recruiting systems match candidates against.
KPIkey performance indicator: The number the business watches to judge success.
NBFCnon-banking financial company: An Indian lender that is not a bank but is still regulated.
ROIreturn on investment: What the customer gets back for what they spend. Say it in hours saved or money saved, not "better AI".
SKUstock-keeping unit: One specific product variant a retailer tracks.