Glossary
Canonical definitions for the terms GoSentrix uses to describe evidence-backed release decisions, security verification, and AI-generated code governance.
Defined term
Release-evidence verification is the process of qualifying evidence from security, engineering, and workflow systems, evaluating that evidence against versioned policy, and preserving the basis for an explicit software release decision.
Why it matters: It gives security, engineering, and governance teams a reviewable basis for proceed, stop, escalate, or require-authorization decisions.
Defined term
A security verification body is an independent evidence layer that determines whether available security evidence is strong enough to support a consequential action.
Why it matters: It separates the tools that generate claims from the authority to make policy-bound security decisions.
Defined term
A proof artifact is a preserved record that links a claim, the evidence supporting or refuting it, the policy version applied, and the decision outcome.
Why it matters: It lets a later reviewer reconstruct why a release was allowed, blocked, escalated, or sent for authorization.
Defined term
Policy-version binding means a decision is evaluated and recorded against the exact policy version active at the time the decision was made.
Why it matters: It prevents later policy changes from rewriting the basis for past release decisions.
Defined term
A defensible release decision is a software release decision whose evidence, applicable policy, and reasoning can be reviewed and explained after the fact.
Why it matters: Defensibility does not mean perfection. It means the organization can show what it knew, what rule applied, and why the outcome followed.
Defined term
An evidence-backed release is a software release authorized by qualified evidence rather than ticket state, verbal assurance, or unreviewed tool output alone.
Why it matters: It turns release approval into a reproducible decision instead of a trust exercise.
Defined term
AI-generated code governance is the discipline of capturing provenance, reviewing AI-produced changes, and verifying claims made by coding agents before those changes are released.
Why it matters: It keeps agentic development fast while preventing probabilistic claims from becoming release authority without independent evidence.
Defined term
Vulnerability fix proof is evidence that the original vulnerable behavior or exposure no longer applies to the release artifact being evaluated.
Why it matters: It distinguishes real remediation from ticket closure, suppression, or a scanner result disappearing in one run.
Defined term
Release readiness evidence is the set of qualified records used to decide whether a software change satisfies the release policy for its risk context.
Why it matters: It gives reviewers a concrete basis for release approval instead of relying on summarized status alone.
Defined term
Continuous security verification is repeated qualification of security evidence across the delivery lifecycle so decisions are evaluated as evidence changes.
Why it matters: It prevents stale approvals and old scanner states from carrying authority into a new release context.
Defined term
An evidence ladder is a governed sequence of evidence states, such as detected, observed, corroborated, validated, proven, disproven, or accepted.
Why it matters: It prevents teams from treating a raw signal as proof before the signal has earned authority.
Defined term
A decision record is the preserved explanation of a release or security decision, including evidence inputs, policy version, outcome, and reasoning.
Why it matters: It makes release history reviewable for audits, incident response, and executive accountability.
Defined term
Agent-neutral governance means security controls evaluate evidence consistently regardless of which AI coding agent, IDE, repository, scanner, or CI system produced the change.
Why it matters: It avoids locking governance to a single AI tool while preserving a common release evidence standard.
Defined term
A validated autofix is an AI- or automation-produced fix that has independent evidence showing the original risk is absent in the new artifact.
Why it matters: It separates a generated patch from a verified remediation outcome.
Defined term
An AI-BOM is a bill of materials for AI-assisted software work, recording models, agents, prompts, tool calls, and generated changes that influenced an artifact.
Why it matters: It gives reviewers and auditors provenance for code produced or modified through agentic workflows.
Defined term
Verified remediation is confirmation, through qualified evidence, that a claimed fix removed or neutralized the specific risk being evaluated.
Why it matters: It closes the loop on remediation using evidence, not workflow status.
Defined term
Suppression hides or accepts a finding for workflow purposes; disproval provides evidence that the finding is invalid in the evaluated context.
Why it matters: It prevents ignored findings from being misrepresented as proven false.
Defined term
The claim-to-evidence gap is the distance between what a tool, ticket, or person says and the evidence required to rely on that claim for a decision.
Why it matters: It explains why more findings and more dashboards do not automatically create defensible release authority.
The glossary is meant to make GoSentrix terms extractable and precise. For the full category explanation, read the release-evidence verification pillar page and the public verification doctrine.
Release-evidence verification is the process of qualifying evidence from security, engineering, and workflow systems, evaluating that evidence against versioned policy, and preserving the basis for an explicit software release decision.
A security verification body is an independent evidence layer that determines whether available security evidence is strong enough to support a consequential action.
A proof artifact is a preserved record that links a claim, the evidence supporting or refuting it, the policy version applied, and the decision outcome.
Policy-version binding means a decision is evaluated and recorded against the exact policy version active at the time the decision was made.
A defensible release decision is a software release decision whose evidence, applicable policy, and reasoning can be reviewed and explained after the fact.
An evidence-backed release is a software release authorized by qualified evidence rather than ticket state, verbal assurance, or unreviewed tool output alone.
AI-generated code governance is the discipline of capturing provenance, reviewing AI-produced changes, and verifying claims made by coding agents before those changes are released.
Vulnerability fix proof is evidence that the original vulnerable behavior or exposure no longer applies to the release artifact being evaluated.
