These are the terms that do the most work across this library, defined in the same plain English the pages use. Where a page goes deeper, the term links to it.
A few pairs get confused often enough to be worth reading side by side: open weights and open source, a policy and an enforcement point, training and inference.
- Acceptable use policy
- A written rule for how people may use AI at work, including approved tools, restricted data, review duties, and reporting. Start with the AI acceptable use policy template and kit.
- Agent
- An AI system that takes actions on someone's behalf. An agent can make recommendations, request human approval, or act within delegated authority. Read: Does the AI advise a person, or act on its own?
- AI data loss prevention (AI DLP)
- Controls that inspect AI traffic and act when protected data appears. SUPERWISE Sentinel applies this kind of control to traffic sent through it.
- AI gateway
- A control point between people or applications and the AI models they call. An LLM gateway is the version built for language-model traffic.
- Attention
- The technique a transformer uses to weigh how much each part of an input bears on every other part. Read: What is a model weight, and what is a transformer?
- Attribution
- Being able to prove, afterwards, who asked what and what the system did. Read: Can you prove afterwards who did what with AI?
- Auditable logic
- Logic that can be inspected well enough to reconstruct why a system produced an output. The boundary differs between explicit rules and learned systems, as the auditability guide explains.
- Business Associate Agreement (BAA)
- A contract required when a business associate handles protected health information for a covered entity. See what that means for ChatGPT and Claude.
- Control point
- A place where an organization applies, tests, monitors, or reviews an AI control. Control points can be distributed across a deployment. Read: What does AI enforcement at runtime actually look like?
- Data destination
- The named place where prompts, files, and responses are processed or held, with retention and training terms behind it. Start with where data goes when people use AI.
- De-identification
- Removing or transforming identifiers so health information meets the HIPAA Privacy Rule standard. See the HHS guidance and the PII redaction guide.
- Deepfake
- Synthetic audio, image, or video made to pass as a real recording of a real person. Read: What can and cannot be guaranteed about an AI system?
- Developer liability
- Responsibility resting on whoever designed and trained a system, by analogy to product liability. Read: Who is liable when an AI system causes harm, or an agent acts?
- Enforcement point
- The place in a system where a rule is actually checked, while something is happening and before it takes effect. Read: What does AI enforcement at runtime actually look like?
- Fine-tune
- Adjusting an already-trained model on additional data to specialize it, without training it from scratch.
- Generative AI
- Systems that produce new content (text, images, code, audio) from patterns learned in training. Read: Is it predicting something, or making something?
- Governance limit
- A boundary on what a control can see, enforce, or prove. Review what an AI governance layer cannot do before relying on a claim.
- Guardrail
- A technical or procedural constraint that can detect, flag, filter, constrain, or route an AI request, response, or action for review. Read: Are your AI controls enforced, or just written down?
- Hyperscale
- Data-center capacity at the largest tier: the facilities that frontier model training and high-volume inference require. Read: Does all AI need a hyperscale data center?
- Inference
- Using a trained model to answer something. The ongoing cost of running AI. Read: What is the difference between training and inference?
- Jailbreak
- An input designed to make an AI system ignore or override its instructions or safeguards. See the jailbreak detection documentation.
- LLM gateway
- A control point between an application or user and a language model. An LLM gateway can route requests, track cost, or protect data before forwarding a request.
- Multi-jurisdiction governance
- Applying more than one legal or policy regime to the same AI system. The practical choices are covered in enforcing several AI regulations at once.
- Observability
- Being able to see who is using which AI, how much, and whether anything is going wrong, while it happens. Read: What can you see while your AI is running?
- Open source
- Code, and often training data and license, published. Broader than open weights, and rarer in AI. Read: What is the difference between open weights and open source?
- Open weights
- A model whose trained numbers are published, so anyone can run or adapt it. Not the same as open source. Read: What is the difference between open weights and open source?
- Operator liability
- Responsibility resting on the organization that deployed a system, whoever built it. Read: Who is liable when an AI system causes harm, or an agent acts?
- Parameter
- A value or setting learned or chosen for a model. A weight is one type of learned parameter. Read: What is a model weight, and what is a transformer?
- PII detection
- Finding values that match defined personally identifiable information types before they are stored, shared, or sent to an AI model. The PII redaction guide shows how to test detection. Read: What is PII data, and what counts as PII?
- PII masking
- Replacing detected personal information with a placeholder or altered value. Review the PII redaction guide and PII redaction documentation. Read: What is PII data, and what counts as PII?
- PII redaction
- Detecting personally identifiable information and removing or replacing matched values. The guide to PII redaction before an LLM shows where that control sits in a model request. See the profession examples for accountants, real estate agents, insurance agents, and lawyers. Read: What is PII data, and what counts as PII?
- Policy
- A documented rule or statement of intent that can be implemented through people, processes, contracts, and technical measures. Read: Are your AI controls enforced, or just written down?
- Predictive AI
- Systems that score or classify things that already exist. They do not produce new content. Read: Is it predicting something, or making something?
- Protected health information (PHI)
- Individually identifiable health information protected by HIPAA when held or transmitted by a covered entity or business associate. Check the product-specific answers for ChatGPT and Claude.
- Provenance
- The traceable origin of something: a model's training data, or a file's chain of custody. Read: Who built the AI model, and on what?
- Runtime
- While the system is actually running and serving requests, as opposed to when it was built or reviewed. Read: What does AI enforcement at runtime actually look like?
- Secret scanning
- Detecting credentials such as API keys before they reach a repository, log, or AI model. See the secret and credential detection documentation.
- Shadow AI
- AI tools, accounts, features, or agents used for company work outside the organization’s approved path, review, and controls. The shadow AI guide covers detection across network, browser, endpoint, and gateway routes. Read why a company ban can hide the risk.
- Token
- A unit of text a model reads and writes: a word, part of a word, or a symbol. AI usage is metered and billed in tokens.
- Training
- The process of adjusting model parameters from data, including pretraining, post-training, and repeated fine-tuning. Read: What is the difference between training and inference?
- Transformer
- A model architecture built around attention. Causal transformers mask future tokens and generate language autoregressively, one token at a time. Read: What is a model weight, and what is a transformer?
- Watermarking
- A signal embedded in generated content so it can later be identified as synthetic. Probabilistic, and removable. Read: What can and cannot be guaranteed about an AI system?
- Weight
- One of the numbers inside a model that determines how an input becomes an output. Read: What is a model weight, and what is a transformer?
- Zero data retention (ZDR)
- An arrangement under which the vendor keeps no copy of your prompts and outputs once a request is answered, for the products it names. Read: Where does your data go when people use AI?
- Retention period
- How long a vendor keeps each kind of data, such as chats, files, logs, and safety records, before deleting it. Read: Where does your data go when people use AI?
- Training on your data
- Contract wording on whether your prompts, outputs, files, or feedback may be used to train or improve the vendor's models. Read: Where does your data go when people use AI?
- Data residency
- The region where your data is stored, and sometimes where it is processed. Read: Where does your data go when people use AI?
- Data processing agreement (DPA)
- The contract that governs how a vendor handles personal data for you: what it processes, for how long, on whose instructions, with what security, and what happens to the data at the end. Read: Where does your data go when people use AI?
- Controller
- The organization that decides why and how personal data is used. Read: Where does your data go when people use AI?
- Processor
- An organization that handles personal data on a controller's behalf and on its instructions. Read: Where does your data go when people use AI?
- Subprocessor
- A company the vendor engages to process your data, such as a cloud host or a model provider. Read: Where does your data go when people use AI?
- SOC 2 report
- An independent CPA's examination of a vendor's controls relevant to security, availability, processing integrity, confidentiality, or privacy. Read: What can and cannot be guaranteed about an AI system?
- Prompt injection
- An attack that hides instructions in content the AI reads, so it follows the attacker. Read the jailbreak detection documentation.
- Retrieval-augmented generation (RAG)
- A design in which the tool looks up documents and hands them to the model as context for its answer. Read: Who built the AI model, and on what?
- Human oversight
- Named people with the authority and the information to monitor an AI system, step in, override it, or stop it, as the risk requires. Read: Does the AI advise a person, or act on its own?
- AI inventory
- A maintained list of the AI tools and uses in the firm, each with an owner, a purpose, the data involved, the vendor, and its status. Read: What is shadow AI, and how do you detect it?
- Impact assessment
- A written review of what a system is for, who it affects, its risks and controls, and the risk that remains, done before use and repeated when something changes. Read: How do you tell real AI governance from theater?
- Audit log
- A time-ordered record of who did what, when, and in which system, kept for accountability and investigation. Read: Can you prove afterwards who did what with AI?
- Model card
- A short document describing a model's intended uses, how it was evaluated, and its known limits. Read: Who built the AI model, and on what?
- System card
- A vendor document for a deployed AI product, covering its evaluations, safeguards, and limits, which can reach beyond the model underneath. Read: What can and cannot be guaranteed about an AI system?
Keep going
What is prompt injection, and how do you defend against it?
What is shadow AI, and how do you detect it?
Reading an AI contract?
Free practical kitAI terms that matter: the words in your contracts and policies. Twenty-seven terms in plain English, each with the question to ask the vendor and a dated example from OpenAI, Anthropic, Google, or Microsoft. Includes a map of where each term appears in the paperwork. Eight pages, PDF.
A practical next step
SUPERWISE uses these words in the same senses. The SUPERWISE platform is where guardrails, policies, observability, and one audit trail sit together.
Sources
- National Institute of Standards and Technology, Trustworthy and Responsible AI Resource Center glossary.
- National Institute of Standards and Technology, AI Risk Management Framework Core.
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile.
- Vaswani et al., Attention Is All You Need, 2017.