Glossary

The BROCS vocabulary, defined tersely and linkably.

View as Markdown

Each definition has a stable anchor and a structured-data entry. Link to the term when using it outside this site.

BROCS #: BROCS is a vendor-neutral framework for assessing enterprise AI enablement across Build, Run, Observe, Control, and Secure. It is pronounced like "brocks".
Enterprise AI operations #: The shared services, responsibilities, and controls used to deliver, run, observe, change, and secure AI systems across an organization. The term covers purchased, configured, and custom systems already in use.
Operational maturity #: The degree to which operating capabilities work consistently and can be supported by current evidence. BROCS discusses operational maturity through evidence-backed coverage across five scopes. Its scoreline is an internal diagnostic.
Production AI operating model #: The ownership, interfaces, shared services, and evidence used to support AI workloads in production. BROCS organizes the model under Build, Run, Observe, Control, and Secure.
AI readiness #: The ability to meet the requirements of an intended AI system before deployment. BROCS tests readiness across the delivery path, runtime, telemetry, change mechanisms, and enforced organizational requirements.
GenAIOps O / Observe #: Generative AI operations, sometimes called LLMOps. It extends MLOps practices to prompts, orchestration, grounding data, retrieval indexes, evals, and generative AI applications.
Agent operations C / Control #: The operating practices for agents that use tools or take actions. They cover runtime, identity, state, traces, authorization, action limits, recovery, and retained evidence.
BROCS Score #: The total number of assessment statements an organization can support with current evidence, from 0 to 25. The scoreline is the five-number breakdown by capability.
Scoreline #: A five-number summary of an organization's BROCS coverage, with one score of 0 to 5 per letter, written in letter order. B4 R3 O2 C3 S1 is a scoreline. Each score also carries a coverage label, from Uncovered at 0 to Covered at 5.
Tool churn B / Build #: Frequent adoption, replacement, and retirement of AI tools. BROCS treats tool change as a design constraint for shared services and integration contracts.
Enablement layer B / Build #: Shared identity, model access, data access, runtime, telemetry, and policy services used across AI applications and tools.
Shadow AI S / Secure #: Use of AI tools that the organization has not sanctioned, usually through personal accounts and personal payment methods. It often increases when approved options are unavailable or slower than the work requires.
BYOK B / Build #: Bring your own key. The customer supplies their own model provider credentials so inference is billed to and governed through the customer's provider account.
BYOC R / Run #: Bring your own cloud. The platform's runtime deploys into the customer's own cloud account, so the data plane, the data residency, and most of the bill live under the customer's contract while the vendor supplies the software. The counterpart of BYOK one layer down: BYOK keeps the model credential yours, BYOC keeps the entire runtime yours. The strong form keeps serving when the vendor's control plane is unreachable.
BAA endpoint B / Build #: A model endpoint covered by a Business Associate Agreement, permitting protected health information to be handled under the agreement's HIPAA terms.
Sovereignty R / Run #: The property that inference and data processing happen somewhere the organization controls legally and physically. Jurisdiction, regulation, contracts, and internal policy determine the required placement.
Golden path B / Build #: A documented and supported route from idea to production with approved templates, controls, and automation. It is designed to be the easiest delivery path to use.
Integration tax #: The cumulative cost of contracts, integrations, identity wiring, and audit processes incurred when capabilities are split across products and suppliers.
Control plane C / Control #: The part of a system that decides what should be running, with what configuration. Distinct from the data plane, which carries the actual work.
Data plane R / Run #: The part of a system that processes requests, inference, and data. Its availability requirements may differ from those of the control plane.
Provisioning R / Run #: Creating the infrastructure a piece of work needs: compute, database, secrets, ingress, and identity. Self-service provisioning provides these resources through an approved automated path.
Portability R / Run #: The ability to run the same workload in a different place without rewriting it. BROCS evaluates whether a workload can run in each environment permitted for its data, including local, private, and public infrastructure.
Golden signals O / Observe #: Latency, traffic, errors, and saturation. The four SRE signals. For AI workloads the BROCS measurement set also includes tokens, cost, tool calls, and application-specific success or refusal rates.
Agent trace O / Observe #: An ordered record of what an agent did in one run: prompts, tool calls, arguments, results, and the data touched. It supports incident analysis, evaluation, and audit.
Drift O / Observe #: Change in model behaviour over time without a corresponding change in your code. Causes include provider updates, retrieval corpus changes, and prompt edits upstream of you.
Eval O / Observe #: A repeatable test of model or agent output quality against fixed inputs. It detects regressions against expected outputs or grading criteria.
Model routing C / Control #: Deciding at request time which model or provider serves a call, and being able to change that decision centrally. This reduces the work required to change providers.
Pinning C / Control #: Fixing a workload to a specific model version so a provider update cannot change behavior without an explicit version change.
Ingress C / Control #: The path through which requests reach an application and where authentication, authorization, and request logging are applied.
Prompt injection S / Secure #: Getting a model to follow instructions from content rather than from its operator. Direct injection comes from the user; indirect injection arrives inside data the model reads, such as a document, a web page, or an email.
Blast radius S / Secure #: Everything a component can reach if it is compromised or simply wrong. For an agent it includes its tool permissions, standing data access, network access, and available credentials.
Data exfiltration S / Secure #: Data leaving its boundary through an AI channel: pasted into a prompt, pulled by an assistant with broad read access, sent outbound by an agent with open egress, or carried in a trace or log. The GRC question underneath is one of visibility: do you know, today, what data your AI systems are sharing and accessing, internally and externally? If the answer needs an investigation, the answer is no.
Human in the loop S / Secure #: A required human approval on a specific class of action before it executes. Useful approvals are narrowly scoped, give the reviewer enough context, and cannot be bypassed by content the agent reads.
Showback S / Secure #: Reporting AI spend back to the team that incurred it without moving money. Chargeback moves the money as well. Both require per-team, per-app attribution at the point of inference.
Audit evidence S / Secure #: The artifacts a control owner or auditor needs to show a control operated: access records, approvals, traces, and retention proof. BROCS expects operating systems to produce this evidence continuously.
DORA metrics B / Build #: Change lead time, deployment frequency, failed deployment recovery time, change fail rate, and deployment rework rate, as defined by DORA. BROCS applies change lead time to versioned AI changes and uses value-stream mapping for idea-to-production flow.
Platform engineering B / Build #: Developing an internal platform as a product for its users. Its self-service, shared capability, and product-management practices inform Build and Run.
GRC S / Secure #: Governance, risk, and compliance. BROCS connects GRC policy and evidence requirements to the systems that enforce them.
FinOps S / Secure #: An operating practice for allocating technology spend, assigning accountability, and measuring unit economics. BROCS applies it to model and inference costs.
Retrieval boundary C / Control #: The versioned, reviewed set of sources a model is permitted to answer from. Making the set explicit lets the organization approve and audit the source corpus.