66 terms
Definitions in this topic
- BusinessAccountability by designHow to make AI agents answerable from day one: owners, decision rights, approval gates and audit trails built in, not written in a policy.
- ProductionAgent audit trailAI agent audit trails explained: what to record, how a trail differs from a trace, and the rules we use to keep one honest.
- ProductionAgent authorizationAgent authorization explained: enforcing scoped AI agent permissions for each requested action and resource.
- BusinessAgent governanceAgent governance explained: identity, least privilege, action logging and ownership for autonomous agents, and who is building the frameworks.
- ProductionAgent identityAgent identity explained: proving which AI agent acts, its authority, and its permitted credentials.
- ProductionAgent incident responseAgent incident response is the prepared plan for containing and investigating harmful AI agent behavior, with owners and stop controls set in advance.
- ProductionAgent policy engineAn agent policy engine decides deterministically whether an AI agent may run a tool call, checking identity, resource, risk and approval first.
- BusinessAgent washingAgent washing explained: how inflated agent claims obscure system capabilities, controls, and accountability.
- BusinessAI accountabilityAI accountability explained: who answers when AI causes harm, why the accountability gap opens, and how companies assign owners and approvers.
- BusinessAI Act digital omnibusWhat the EU digital omnibus changed in the AI Act: deferred high-risk deadlines and lighter duties for smaller companies.
- BusinessAI agent certificationWhat AI agent certification is, how the first programs like AIUC-1 work with SOC 2, and what a certificate does and does not prove.
- ProductionAI agent securityAI agent security explained: protecting agent inputs, tools, memory, identity, permissions, and execution boundaries.
- LLM foundationsAI alignmentWhat AI alignment is, how labs align models in practice, why reward hacking is the canonical failure, and what it means for buyers.
- BusinessAI assuranceAI assurance uses independent testing and review evidence to back claims that an AI system is safe or reliable, and shows residual risk to decision makers.
- BusinessAI auditWhat an AI audit checks, who performs it, how it relates to ISO 42001 and the EU AI Act, and how a company prepares for its first one.
- BusinessAI biasWhere AI bias comes from, the main types with hiring examples, what the EU AI Act requires, and how to test a system for it.
- BusinessAI complianceAI compliance turns laws, contracts and standards into owned controls, evidence and reviews across an AI system's lifecycle, not a launch checklist.
- Agentic AIAI containmentWhat AI containment means for agents: blast radius, sandboxes, kill switches, and how containment differs from monitoring.
- BusinessAI content detectionWhat AI detectors measure, why false positives hit real people, and why watermarking and C2PA provenance are the sturdier route for a business.
- BusinessAI ethicsWhat AI ethics means in practice: the core principles, how they become enforceable controls, and where ethics meets regulation.
- BusinessAI explainabilityAI explainability explained: why it decides adoption in regulated work, and how it differs from interpretability.
- BusinessAI governanceAI governance explained in plain terms: approval gates, audit trails, and clear ownership for the AI systems your company actually runs.
- BusinessAI inventoryAI inventory explained: a maintained record of AI systems, owners, data, vendors, risks, and controls.
- BusinessAI liability insuranceAI liability insurance explained: what the new coverage includes, and why a general liability policy may now exclude AI.
- ProductionAI red teamingAI red teaming explained: controlled adversarial testing of models, agents, tools, data access, and safety controls.
- BusinessAI risk classificationAI risk classification assigns an AI use case to a risk category by purpose, affected people and potential harm, which sets its controls and legal duties.
- BusinessAI risk managementAI risk management is the ongoing work of identifying, treating and monitoring risks from an AI system, from design and procurement through retirement.
- BusinessAI safety caseAn AI safety case is a structured argument that a system is safe for a defined use, linking hazards to controls, test evidence and residual risk.
- BusinessAI securityWhat AI security covers, how it differs from using AI in cybersecurity, and what a mid-sized company should put in place first.
- BusinessAI transparencyAI transparency means telling users and operators where AI is used, its limits and data, and how to appeal an outcome, without exposing model secrets.
- BusinessAI TRiSMAI TRiSM explained: the acronym a buyer meets in analyst decks, and which control layers it actually names.
- BusinessAI usage policyAI usage policy explained: what the document must cover, who owns it, and how it evidences the AI literacy duty.
- BusinessAI vendor assessmentAI vendor assessment explained: reviewing an AI provider's data, security, contracts, limits, and fit for a workflow.
- BusinessAI washingAI washing explained: what it is, the SEC and FTC cases that defined it, and the questions that expose it in a vendor pitch.
- LLM foundationsAI watermarkingAI watermarking embeds a detectable signal in generated text, images, audio or video. Why edits and compression weaken it, and where provenance helps.
- BusinessAuditabilityWhat auditability means for AI systems, the records it requires, and how it differs from explainability, traceability and the audit itself.
- ProductionBlast radiusWhat blast radius means for AI agents: how permissions, credentials and chained tool calls set it, and the controls that shrink it before launch.
- ProductionC2PAC2PA is an open standard for signed Content Credentials that record who created or edited a media file and with which tools, not whether it is true.
- ProductionConfidential AIConfidential AI explained: how hardware enclaves and attestation protect data in use, what they miss, and when a company needs them.
- ProductionContent provenanceContent provenance explained: origin, edit history, Content Credentials, verification limits, and business use.
- BusinessData residencyData residency for AI sets where data is stored and processed, covering prompts, retrieved records, logs, embeddings and backups, not just the database.
- BusinessData sovereigntyWhat data sovereignty means for AI buyers: sovereignty vs residency, what the EU and Gulf require, and the questions to put to a vendor.
- BusinessEU AI ActThe EU AI Act explained plainly: the four risk tiers, what providers and deployers each owe, and how to work out where your use case sits.
- BusinessGuardian agentGuardian agent explained: what an agent that watches your agents actually does, and whether it is a real control.
- Agentic AIGuardrailsGuardrails explained: the automated rules that constrain an AI agent, and how they differ from a human approval gate.
- BusinessHIPAA compliant AIWhat makes an AI tool HIPAA compliant, whether ChatGPT, Claude or Gemini qualify, and the checklist a healthcare buyer runs before sharing PHI.
- Agentic AIHuman in the loopHuman in the loop explained for business leaders: what an approval gate actually protects, and where to place it.
- BusinessISO 42001ISO 42001 explained: what the AI management system standard requires, and who actually needs to be certified.
- ProductionLeast privilege for AI agentsLeast privilege for AI agents limits each agent to the data, tools and short-lived credentials its task needs, reducing damage from prompt injection.
- ProductionMemory poisoningMemory poisoning explained: how unsafe information persists in AI agent memory and affects later actions.
- BusinessModel risk managementWhat model risk management is, the supervisory framework behind it, and how MRM extends from bank models to AI systems.
- BusinessNIST AI Risk Management FrameworkThe NIST AI RMF explained: the four functions, how it compares to ISO 42001, and when a mid-sized company needs it.
- BusinessNon-human identityNon-human identity explained: what counts as one, why AI agents multiply them, and how to govern the ones nobody owns.
- BusinessPrivate AIPrivate AI for business: the deployment options, what each protects, what it costs in capability and upkeep, and when public AI is enough.
- Agentic AIPrompt injectionPrompt injection explained: direct versus indirect attacks, and the guardrails that actually catch them.
- BusinessResidual riskResidual risk vs inherent risk for AI systems: the simple formula, worked examples, and who signs off on what is left after controls.
- BusinessResponsible AIResponsible AI explained: turning AI principles into system-specific controls, evidence, accountability, and ongoing risk management.
- LLM foundationsReward hackingWhat reward hacking is, how it relates to specification gaming and Goodhart's law, and why it explains agents that go rogue.
- BusinessRogue AIWhat rogue AI means in practice: malicious, accidental and subverted agents, why CIOs treat them as insider risk, and the controls that contain one.
- BusinessShadow AIShadow AI explained: unreviewed AI use that moves company data outside approved controls and ownership.
- BusinessSilent AISilent AI explained: why ordinary policies may or may not pay for AI losses, how insurers are adding AI exclusions, and what to check at renewal.
- BusinessSovereign AISovereign AI is the ability to deploy and govern AI under chosen legal, data and infrastructure control, without building every component domestically.
- ProductionTool approvalTool approval explained: pausing sensitive AI agent actions for explicit authorization before execution.
- ProductionTool poisoningTool poisoning explained: malicious tool metadata or output that steers an AI agent into unsafe actions.
- BusinessTraceabilityWhat traceability means in AI: the records that connect data, model versions and outputs, and how it differs from auditability and explainability.
- ProductionVoice biometricsVoice biometrics explained: voiceprints, verification scores, enrolment, spoofing risks, and controls for responsible authentication.