Glossary — compliance & Google ADK terms

A2A envelope: An agent-to-agent message envelope signed per RFC 9421, so a downstream agent can verify the origin, policy context, and integrity of an inbound request. Regulus emits and verifies A2A envelopes across agent boundaries.
Learn more →
BasePlugin / plugin SPI: The ADK extension interface (com.google.adk.plugins.BasePlugin) exposing BeforeAgentCallback, BeforeModelCallback, BeforeToolCallback, and AfterToolCallback hooks. Regulus ships 8 composable BasePlugin implementations that ride along with the agent trajectory.
Learn more →
Compliance plane: The decision-plane layer that sits between an AI agent runtime and its regulator: purpose limitation, residency, dual-control, and audit evidence. Regulus is the compliance plane for Google ADK — the runtime ships agents, the compliance plane makes them acceptable.
Learn more →
Data residency: The requirement that agent state — sessions, memory, artifacts — is stored and processed within a permitted jurisdiction. The Regulus residency plugin and service extensions pin writes to the resolved region and fail closed when residency cannot be satisfied.
Learn more →
Dual-control (kill switch): A control requiring two parties or a human-in-the-loop approval before a high-risk action proceeds. Regulus ships a kill-switch plugin that can halt an agent and gate high-risk tools behind dual-control.
Learn more →
Fail-closed: A safety posture where, if a control cannot be satisfied (e.g. residency unknown, policy unresolved), the action is denied rather than allowed. Regulus applies fail-closed semantics to memory, artifact, and high-risk tool calls.
Google ADK (Agent Development Kit): Google's open framework for building and deploying AI agents, with a documented plugin SPI and Vertex AI Agent Engine as a managed runtime. Regulus targets ADK 1.2 as its primary runtime and plugs into the official BasePlugin callback surface without forking it.
Learn more →
Governance framework: A voluntary risk-management standard mapped to executable controls — NIST AI RMF (incl. the 600-1 GenAI Profile) and the ISO/IEC 42001 family (42001, 23894, 23053). Regulus ships 6 frameworks, with a Statement of Applicability generator for ISO 42001.
Learn more →
GRC adapter: An integration that routes signed compliance evidence to a Governance, Risk & Compliance platform. Regulus ships 4: ServiceNow IRM, OneTrust AI Governance, MetricStream, and a generic HMAC-signed webhook.
Learn more →
Hash-chained audit envelope: An append-only event log where each record includes a hash of the previous one, making tampering detectable. Regulus writes one per state-changing tool call, carrying the verbatim policy clause, jurisdiction, and framework citation, verifiable offline with `regulus audit verify`.
Learn more →
Model risk management (MRM / SS1/23): The discipline — codified in the UK PRA's SS1/23 — of identifying, tiering, and validating the risk that a model behaves incorrectly. Regulus ships a model-risk plugin that tiers LLM agents and produces the audit trail SS1/23 validators need.
Learn more →
Purpose limitation: The GDPR Article 5(1)(b) principle that personal data is collected for specified, explicit purposes and not further processed incompatibly. Regulus enforces it at the tool boundary, not just in a policy PDF.
Learn more →
Regulation profile: A machine-readable encoding of a specific regulation (e.g. EU AI Act, GDPR, DORA, FCA SYSC, PRA SS1/23). Regulus ships 10 profiles that compose into one resolved policy at runtime — strictest retention wins, residency is intersected, audit fields are unioned.
Learn more →
Vertex AI Agent Engine: Google Cloud's managed runtime for deploying ADK agents. Regulus integrates via RegulusVertexAiSessionService and RegulusGcsArtifactService, which extend Google's own session and artifact services with policy, privacy, and residency gating.
Learn more →

New to Regulus? Start with why it exists, see the architecture, or browse the 10 regulation profiles. Part of Neul Labs.