Resources
Plain-language definitions of the AI and governance terms that come up when AI agents enter a business that has to answer for how its systems behave. Accurate, practical, and built to be cited.
Terms
Grouped by where they come up. Every definition stands on its own, so you can link straight to one and it still makes sense out of context.
A software system that uses a language model to take actions toward a goal, not just answer a question. An agent can call tools, read and write data, and chain several steps together, which is why the access it holds and the oversight around it matter more than for a simple chatbot.
The term NIST uses for what most people call hallucination: a model producing confident, fluent content that is not grounded in its sources. It appears in NIST AI 600-1, the Generative AI Profile, as one of the risk categories that generative AI creates or makes worse. The word is more precise than hallucination because it names the behavior, filling a gap with plausible material, rather than implying perception.
Further training of an existing model on a focused set of examples so it performs better on a specific task or in a specific style. It changes the model`s weights, unlike prompting or retrieval, which leave the model unchanged.
Output from a language model that is fluent and confident but factually wrong or unsupported by its sources. Because models generate plausible text rather than retrieve verified facts, hallucination is a built-in risk that grounding and human review are meant to contain.
The act of running a trained model to produce an output from a given input, as opposed to training the model in the first place. Most of the ongoing cost and latency of an AI feature comes from inference, since it happens on every request.
A model trained on very large amounts of text to predict and generate language, which lets it answer questions, summarize, write, and reason over text. An LLM does not store facts the way a database does; it produces likely continuations, which is why grounding and review matter.
The information a model can see for a single request, including the prompt, prior turns, and any retrieved documents, all bounded by a context window. Anything outside that window is not available to the model unless it is supplied again or stored in an external memory.
The instruction and context given to a model to produce a response. Prompt design strongly affects output quality, and in production a prompt is often assembled from a fixed template plus the user`s request and any retrieved data.
A pattern that retrieves relevant documents from a trusted source and supplies them to the model so its answer is grounded in that material. RAG reduces hallucination and lets a system answer from private or current data without retraining the model.
The set of rules, roles, and controls that decide how AI is allowed to be used, who is accountable for it, and how its risks are managed. It is the structure that lets a company adopt new capability without inheriting unchecked exposure.
A measure of how prepared a business is to deploy AI safely and usefully, across its data, processes, controls, and people. A readiness review identifies where AI creates real leverage and what has to be in place before any agent touches live systems.
A checkpoint where a person must review and approve a decision before an agent acts on it. Gates are placed on the actions that carry real risk, so automation handles the routine work while a human stays in control of the consequential calls.
A durable record of each meaningful action a system took, who or what initiated it, and when. In regulated settings the trail is captured as the system runs rather than reconstructed after the fact, so it can stand as evidence during a review.
AI that operates inside explicit controls: scoped permissions, human approval on risky actions, audit trails, and instrumentation that proves how it behaved. The point is to capture the productivity of AI while keeping its actions visible, bounded, and accountable.
The technical and policy limits that constrain what an AI system can do or say, such as blocked topics, output checks, action limits, and required approvals. Good guardrails are enforced by the system rather than left to the model`s good behavior.
Deciding and enforcing exactly what each agent or user is allowed to access and do, granting only what a task requires. Least privilege keeps access narrow by default, so a system can touch the data and actions for its job and nothing more.
A classification that ranks an action or use case by how much harm it could cause, so controls can be matched to stakes. Low-tier work can run automatically, while high-tier actions route through approval gates and tighter logging.
An access model that grants permissions to defined roles, then assigns people or systems to those roles, rather than wiring permissions to each individual. It makes access easier to reason about and audit, since you review a handful of roles instead of every account.
A database control that limits which rows a given user or request can read or change, enforced by the database itself rather than by application code. In multi-tenant systems it is the backstop that keeps one customer`s data from being exposed to another.
AI tools used inside a company without approval, oversight, or security review, often by well-meaning staff pasting work into public chatbots. It is a governance risk because sensitive data can leave the business and no audit trail exists for what was done. In NIST AI RMF terms it is a map problem first: you cannot govern what you have not found.
A signed statement about subject matter someone else is responsible for. In assurance, an attestation engagement is one where a licensed practitioner reports on another party`s controls, which is what a SOC 2 report is. In computing, attestation means a signed statement a component makes about its own state, as with remote attestation or build provenance. Keep it distinct from certification, which is a conformity decision by an accredited body, and from self-assessment, which is neither.
An unbroken, documented record of who handled a piece of evidence, when, what they did to it, and how it changed hands, such that the item presented is demonstrably the item collected. The term comes from evidence law. For a data pipeline the equivalent is lineage plus custody metadata: for each record, the source system, the ingest time, every transformation and the version of the job that applied it, and every person or agent that touched it, with a verifiable link back to the original payload.
A record that reveals any alteration, as distinct from one that prevents alteration. Hash chaining and Merkle trees make a log tamper-evident: each entry carries the hash of its predecessor, so changing anything anywhere breaks the chain and is detectable. WORM storage makes a log tamper-prevented: the storage layer refuses the change in the first place. The two are complementary and are not substitutes, and knowing which one a system actually provides is the first question a reviewer should ask.
Storage that refuses modification or deletion for a defined retention period, which is the honest technical meaning of an immutable log. Object-lock features in the major clouds implement it, and the stricter mode, which cannot be overridden even by an account`s root credentials for the duration of the retention period, is the posture an auditor recognizes. A weaker mode that allows a privileged override is weaker evidence. Append-only enforced only in application code is a policy, not a guarantee.
A contract required under US HIPAA between a covered entity and any vendor that handles protected health information on its behalf. The BAA binds the vendor to the same safeguards and breach-notification duties, and is a prerequisite before a vendor or AI service may process PHI.
Building the controls and records a regulation expects directly into a system, so evidence of how the rules were followed is produced by the system itself. It replaces the scramble of assembling proof by hand at audit time.
The requirement that data be stored and processed in a specific country or region, often to satisfy a law or contract. For AI deployments it shapes which models, cloud regions, and providers are permissible, since sending data to an out-of-region service can breach the rule.
Removing enough from health information that it is no longer protected health information and falls outside the US HIPAA Privacy Rule. 45 CFR 164.514 allows exactly two routes: expert determination, where a qualified person documents that the re-identification risk is very small, and safe harbor, where 18 specified identifiers are removed and there is no actual knowledge that what remains could identify someone. A limited data set, which keeps dates and some geography under a data use agreement, is not de-identified data. Treating the two as the same is a common and visible mistake.
A European Union regulation that governs AI systems using a risk-based approach, placing stricter obligations on higher-risk uses and prohibiting a narrow set of practices outright. It applies broadly to providers and deployers whose systems are used in the EU, and is phasing in over several years.
The international standard for an Artificial Intelligence Management System, published in December 2023. It is a management system standard, so it certifies how an organization governs AI, not whether any individual model is safe, accurate, or fair. That distinction is the most useful thing to know about it. Its Annex A carries 38 controls across 9 control objectives, selected against the organization`s own risk and impact assessment rather than applied as a mandatory checklist. Unlike SOC 2, it is a genuine certification, issued by an accredited body after a two-stage audit. Related standards include ISO/IEC 42005 on AI system impact assessment, ISO/IEC 42006 on the bodies that certify, and ISO/IEC 27001, which secures the data while 42001 governs the AI.
The US HIPAA Privacy Rule standard, at 45 CFR 164.502(b) and 164.514(d), that limits any use or disclosure of protected health information to the least needed to accomplish the purpose. It is the exact regulatory hook for silent over-collection by AI: an agent granted access to a full patient record when its task needed three fields is a minimum-necessary problem before it is anything else, whether or not the extra data is ever read.
A voluntary framework published as NIST AI 100-1 in January 2023 by the US National Institute of Standards and Technology, to help organizations identify, assess, and manage the risks of AI systems. Its core is four functions: govern, who owns AI risk and what the policy says; map, what the system is for and what could go wrong; measure, how risk is evaluated and monitored; and manage, how risk is treated, escalated, and recovered from. The four run continuously and iteratively rather than as sequential stages. The framework is sector-agnostic and non-certifiable: there is no such thing as being NIST AI RMF certified.
Individually identifiable health information that is protected under US HIPAA, covering the medical and payment details that can be tied to a specific person. Any AI system that processes PHI inherits HIPAA obligations, including safeguards, access controls, and a signed BAA with the provider.
Information that can identify a specific individual, on its own or combined with other data, such as a name, email, government ID, or device identifier. How PII may be collected, stored, and shared is governed by privacy laws, which constrain what an AI system can do with it.
The prescriptive route to de-identifying health information under 45 CFR 164.514(b)(2): remove 18 specified identifiers of the individual and of relatives, employers, and household members, and hold no actual knowledge that what remains could identify anyone. The 18 include names, geographic units smaller than a state, all date elements except year, contact details, government and account and device identifiers, biometrics, and full-face images. Two details practitioners recognize: the first three digits of a ZIP code may be kept only if the area they cover holds more than 20,000 people, and every age over 89 must be collapsed into a single category of 90 or older.
An attestation report issued by a licensed CPA firm on both the design and the operating effectiveness of a service organization`s controls across a period, typically three to twelve months. A Type I covers design at a single point in time and can be satisfied by a written policy and a screenshot. A Type II cannot: it requires a population of dated artifacts covering the whole observation window, from which the auditor draws a sample. This is why ungoverned AI fails audits. If an agent took actions during the period and no dated, retrievable record of those actions exists, the control has no population and cannot be tested. SOC 2 is an attestation, not a certification, so nothing is ever SOC 2 certified.
The AICPA criteria a SOC 2 examination is conducted against, currently the 2017 Trust Services Criteria with revised points of focus from 2022. There are five categories: security, availability, processing integrity, confidentiality, and privacy. Security is the common criteria and is always in scope; the other four are elected based on the commitments the organization actually makes. The security category is organized as CC1 through CC9, and for AI deployments the three that matter most are CC6 logical access, CC7 system operations and monitoring, and CC8 change management, because that is where an ungoverned agent shows up as a finding.
IntellaGrow`s governed operating pattern: the way agents get deployed, with permissioning, human-in-the-loop approval on risky decisions, audit trails, and compliance instrumentation built in from the first commit. It is how capability ships with the guardrails attached rather than bolted on later. Parts of it are configured per engagement today; the unified console is in development.
A senior technology leader who owns a company`s AI strategy and accountability on a part-time basis, rather than as a full-time executive hire. You get the judgment and ownership of a chief technology or AI officer for the share of their time your stage actually needs.
Next
Definitions tell you what the words mean. These take the same ideas and put them into a document, a number, or a decision.
A twenty minute intro call turns the vocabulary into a plan: where AI creates leverage for you, and what is safe to do first.
If AI is not the right tool for your problem, you will hear that from us.