Glossary — Every Abbreviation, Explained in Plain Language

Drills expand each abbreviation on first use; this is the one-stop reference. Organized by category.

Reliability & operations (SRE vocabulary)

Term	Expansion	Plain-language meaning
SRE	Site Reliability Engineering	Google-originated discipline of running production systems with engineering rigor: measure reliability, automate operations, learn from failure without blame.
SLI	Service Level Indicator	The measurement — a number that captures whether the service is doing its job (e.g., "% of scoring requests answered correctly within 200ms"). The art is choosing indicators that measure meaning, not just uptime.
SLO	Service Level Objective	The target for an SLI (e.g., "99.9% over 30 days"). Internal goal that drives alerting and priorities.
SLA	Service Level Agreement	The contract — an SLO promised to a customer, usually with penalties. SLAs should be looser than SLOs so you breach your own alarm before you breach the contract.
Error budget	—	The allowed amount of failure implied by an SLO (99.9% = ~43 min/month of failure "budget"). When the budget is spent, reliability work outranks features. Turns reliability from a religion into a resource you manage.
MTTD / MTTR	Mean Time To Detect / Mean Time To Recover	How long failures go unnoticed / how long until service is restored. Silent failures are an MTTD problem — most drills in theme 1 are about shrinking detection time from weeks to minutes.
RED metrics	Rate, Errors, Duration	The three basics to monitor for any request-driven service: how many requests, how many fail, how long they take. Drill 2's lesson: watch Rate too — zero traffic with zero errors is an outage, not health.
p50 / p99	50th / 99th percentile	Latency percentiles. p50 = typical request; p99 = the slowest 1%. Averages lie; percentiles (and per-segment slicing) tell the truth.
DR	Disaster Recovery	The plan and infrastructure for surviving the loss of a system, site, or region.
RTO	Recovery Time Objective	How long recovery is allowed to take. If restoring the database takes 26 hours and the business assumed 4, the RTO was fiction (drill 32).
RPO	Recovery Point Objective	How much recent data you're allowed to lose (e.g., "at most 5 minutes of transactions"). Determines backup/replication frequency.
Sev-1 (Severity 1)	—	The highest incident severity: major business impact, all hands, formal incident management.
DLQ	Dead-Letter Queue	A holding pen for inputs that repeatedly fail processing, so one "poison" message can't jam or endlessly retry the pipeline (drill 15).
TTL	Time To Live	An expiry duration — for cache entries (drill 4), DNS records (drill 26), debug flags (drill 48), or access grants (drill 34). Things without TTLs live forever, usually regrettably.
CI/CD	Continuous Integration / Continuous Delivery	The automated pipeline that tests and ships every change. The drills extend it: evals, contamination checks, and red-team suites belong in CI alongside unit tests.
Runbook	—	Step-by-step instructions for handling a known operational situation. Rots unless tested (drill 33).
Game day	—	A scheduled exercise where you deliberately break something (kill a zone, restore a backup, send a test page) to verify resilience claims before reality does.
Break-glass	—	A pre-designed emergency procedure to bypass normal controls fast — time-boxed, audited, auto-revoked (drills 25, 34).
Toil	—	Manual, repetitive operational work (rotating a key by hand, rerunning a job). SRE treats toil as a debt to automate away — it's also fragility (drill 25).
Postmortem	—	The structured writeup after an incident: timeline, causes, and systemic action items. "Blameless" means it asks what made actions seem reasonable, not who to punish (drill 31).

Cloud & infrastructure

Term	Expansion	Plain-language meaning
AZ	Availability Zone	An isolated datacenter within a cloud region. "Multi-AZ" claims mean nothing until tested (drill 23).
NAT	Network Address Translation (gateway)	The cloud component that lets private servers reach the internet. A classic hidden single point of failure (drill 23).
DNS	Domain Name System	Translates names to addresses. Its caches (TTLs) are why traffic keeps flowing to old destinations after a failover (drill 26).
IAM	Identity and Access Management	The cloud's permission system: who/what can do which actions on which resources.
KMS	Key Management Service	The cloud service holding encryption keys. Per-tenant keys make data isolation provable (case 20); rotated-away keys make old backups unreadable (drill 32).
STS	Security Token Service	Issues short-lived cloud credentials. Its rate limits are the kind of invisible quota that bites at peak (drill 22).
API	Application Programming Interface	The contract through which programs call each other.
GPU / CPU	Graphics / Central Processing Unit	GPUs: the expensive accelerators used for model training and inference; a favorite hiding place for waste (drill: case 18).
VOIP	Voice Over Internet Protocol	Internet phone numbers — cheap, recyclable, and thus a weak identity signal that creates false links in fraud graphs (case 7, drill 21 context).
TAM	Technical Account Manager	Your named contact at a cloud provider — the person to warn before a peak event so quota increases don't sit in a ticket queue (drill 22).
200 OK / 429	HTTP status codes	200 = "success" (even when the payload is garbage — theme 1's recurring villain); 429 = "too many requests," the sound of hitting a rate limit or quota.
Thundering herd	—	Many clients hitting a resource simultaneously (e.g., after a cache flush), overwhelming it (drill 21).
Split-brain	—	Two sides of a system each believing they're the authoritative one, both accepting writes — divergent truth that must be painfully reconciled (drill 26).
Fencing	—	The mechanism that forces single-writer behavior during failover, rather than hoping (drill 26).
Backpressure	—	Deliberately slowing or rejecting incoming work at the front door so an overloaded component can recover, instead of queueing until collapse (drill 24).
Egress	—	Data leaving a cloud zone/region/provider — billed per gigabyte, invisible until the invoice (drill 27).

AI / ML / LLM

Term	Expansion	Plain-language meaning
AI / ML	Artificial Intelligence / Machine Learning	ML: systems that learn patterns from data rather than following hand-written rules.
LLM	Large Language Model	The text-in/text-out models (Claude, GPT, etc.) behind modern AI assistants and document processing. Non-deterministic, instructable by anyone who reaches their context (drill 14), and priced per token.
Token	—	The unit LLMs read, write, and bill by (~¾ of an English word). Cost engineering is token engineering (drills 15, case 18).
RAG	Retrieval-Augmented Generation	Instead of letting the model answer from memory, retrieve the relevant authoritative documents and have it answer from those — the fix for invented policies (drill 17).
Context window	—	The maximum input an LLM can see at once. Exceeding it silently truncates the input (drill 19).
Prompt injection	—	Attacker-controlled content (an email, a PDF) containing instructions the model then follows. The SQL injection of the LLM era (drill 14).
LLM-as-judge	—	Using one model to grade another's outputs. Scales cheaply; must be calibrated against humans or it becomes a bias amplifier (drill 18).
Eval	Evaluation (suite)	The ML equivalent of a test suite: curated inputs with known-good outputs, scored automatically. Belongs in CI (drill 16).
Golden set	—	A carefully hand-labeled, adjudicated dataset held as ground truth for evals.
ASR	Automatic Speech Recognition	Speech-to-text transcription (case 14).
WER	Word Error Rate	Transcription error metric. Component WER doesn't predict end-task accuracy — errors concentrate on names, numbers, and accents (case 14).
OCR	Optical Character Recognition	Extracting text from images/scans.
AUC	Area Under the (ROC) Curve	A 0.5–1.0 score of how well a model separates classes. 0.99 usually means leakage, not brilliance (case 3).
PSI	Population Stability Index	Measures how much a score or feature distribution has shifted between two time windows — a standard drift alarm (drill 1).
GNN	Graph Neural Network	ML on graph structures. Name-dropped more often than needed (case 7's lesson: fix the edges first).
Training-serving skew	—	The model sees features computed one way in training and another way live — offline metrics become fiction (case 16).
Drift	—	The world (or the data pipeline) changing out from under a trained model — input distributions, adversary behavior, label meaning.
Goodhart's law	—	"When a measure becomes a target, it ceases to be a good measure." The one-line explanation of drills 18, 28's flags, and 37.

Security & privacy

Term	Expansion	Plain-language meaning
PII	Personally Identifiable Information	Data that identifies a person — names, SSNs, account numbers. Follows its own rules wherever it flows, including into logs (drill 48).
SSN	Social Security Number	The classic high-sensitivity identifier in US financial data.
DLP	Data Loss Prevention	Tooling that detects sensitive data moving where it shouldn't (into a public chatbot, out an email — drill 43).
GDPR	General Data Protection Regulation	EU privacy law; source of data-deletion rights that must propagate through derived data (case 14, drill 48).
GLBA	Gramm-Leach-Bliley Act	US law governing financial institutions' handling of customer financial data (drill 14).
SOC 2	Service Organization Control 2	The standard audit report vendors show to prove security controls. Attests to control design — not to what their debug logs did last Tuesday (drill 45).
Least privilege	—	Every identity gets the minimum access needed, nothing more. Requires an escape hatch for emergencies (drill 34) or people invent worse ones.
Lateral movement	—	An attacker expanding from the first compromised system to others — cheap when one god-account opens every door (drill 47).
Data poisoning	—	Manipulating a model's training data so it learns what the attacker wants (drill 46).
Model extraction / oracle attack	—	Reconstructing a model's behavior by querying it systematically — every API response is a lesson to the adversary (drill 44).
Red team	—	People (or test suites) playing attacker against your own system — hostile invoices, injection attempts, cross-tenant probes — before real attackers do.

Finance & domain (the business context of these drills)

Term	Expansion	Plain-language meaning
ERP	Enterprise Resource Planning (system)	The company's system of record for money — invoices, payments, accounting. Posting to it has real-world side effects (case 13).
AP	Accounts Payable	The function that receives and pays supplier invoices.
PO	Purchase Order	The pre-approved "we intend to buy this" document; matching invoice↔PO↔receipt ("three-way match") is a deterministic fraud/error control.
GL	General Ledger	The master accounting record; "GL coding" = which expense category a payment lands in.
SIU	Special Investigations Unit	An insurer's fraud-investigation team (case 11).
PIP	Personal Injury Protection	Auto-insurance injury coverage — a common fraud target (case 11).
ECOA / FCRA	Equal Credit Opportunity Act / Fair Credit Reporting Act	US lending laws behind two constraints in these materials: declined applicants must get specific reasons ("adverse action"), and credit data use is regulated (case 8).
Adverse action	—	The formal decline notice with principal reasons, required by ECOA/FCRA — the reason black-box underwriting models can't ship as-is (case 8).
Bust-out	—	Fraud pattern: build good payment history, get credit limits raised, then max out everything and vanish (case 7).
Chargeback	—	A card transaction reversed after a customer dispute — arrives 60–90 days late, which is why fraud labels lag (theme 6).
CAC	Customer Acquisition Cost	Marketing spend per new customer won (case 9).
ROI	Return On Investment	Dollars back per dollar spent — the unit every model metric eventually has to convert into (case 10, 18).
CRO / CTO / CFO / COO / CEO	Chief Risk / Technology / Financial / Operating / Executive Officer	The stakeholders whose questions end several of these cases.
Vintage	—	In lending: the cohort of loans originated in a given period, tracked over time. "Vintage curves" show how each cohort's defaults mature (case 8).
Champion/challenger	—	Running a new model ("challenger") alongside the incumbent ("champion") on live traffic, comparing before switching — the safe way to adopt anything (case 10).
Swap-set analysis	—	Comparing two decision systems on the same population: who does the new one approve that the old declined, and vice versa. The off-diagonals are where all the value and risk live (case 10).