Glossary

A

Approved MCP Server Register

The list, maintained by the agency's IT Security lead, of MCP servers approved for agency use and the permissions and data classifications allowed for each.

Artificial Intelligence (AI)

Computer systems that perform tasks normally requiring human judgment, such as generating text, summarizing information or answering questions. In this policy it mainly refers to AI assistants that can call tools through MCP servers.

L

Least Privilege

The security principle of granting a user or system only the minimum access needed to perform a task.

M

MCP Client

The AI assistant or application that connects to an MCP server and calls its tools.

MCP Server

A service that exposes tools, data or actions to an AI assistant using the Model Context Protocol.

Model Context Protocol (MCP)

An open standard that lets an AI assistant connect to outside tools and data sources through a common interface.

O

Office of the Chief Information Officer (OCIO)

The State of Iowa office, established under Iowa Code chapter 8B, that sets enterprise information technology and security standards for executive branch agencies.

P

Prompt Injection

An attack in which instructions hidden in content an AI assistant reads, such as a document, email or web page, try to make the assistant take actions the user did not ask for.

S

Single Sign-On (SSO)

An authentication method that lets a user sign in once with their agency account to access multiple approved systems.

State Records Commission

The Iowa commission that approves records retention schedules for state agencies, setting how long each type of record must be kept.

W

Write Action

Any MCP tool call that creates, changes, sends, publishes or deletes data or messages. Write actions require the user's confirmation under this policy.