Plain language.
No product pitch.

The policies, processes and controls that determine how an organisation develops, deploys and monitors AI systems.

Coordinating multiple AI agents or skills across systems to complete a multi-step task.

Legal or financial exposure arising from an AI system's action or output.

A chronological, tamper-evident record of who did what and when, used to reconstruct and verify past actions.

A numeric estimate of how strongly available evidence supports a given answer.

Where data is physically stored and processed, often a requirement of data-protection law or contract.

When a source document or policy changes after an AI system has already produced answers based on the earlier version.

The European Union's risk-based regulation governing the development and use of AI systems, including requirements for high-risk systems.

A record linking a specific AI answer to its source, version, accountable owner and change history.

Querying a knowledge base without a structured schema or citation guarantee, typically returning raw text excerpts rather than a cited, confirmed answer.

Tying an AI-generated answer to a specific, verifiable source rather than relying on the model's own unverified output.

When an AI system generates plausible-sounding but false or unsupported information.

A design pattern where a person reviews or approves an AI system's output before it takes effect.

An open protocol for connecting AI models to external tools and data sources through a standard interface.

The practices regulated institutions use to identify, measure and control the risks of using a model in decision-making.

A specific, accountable person responsible for approving a piece of knowledge before it can be used.

Restricting what a caller can see based on an assigned sensitivity or access label, checked on every request rather than once at login.

The traceable origin of a piece of information: where it came from, who approved it, and what has changed since.

A control point that blocks unverified content from reaching a live, usable state until a defined condition—such as review or evidence verification—is met.

A technique where a model's response is supplemented with content retrieved from an external knowledge source at query time.

Running software in infrastructure the customer controls, rather than a vendor's shared cloud environment.

A defined, reviewable unit of agent capability — a compiled, versioned procedure an agent can invoke, distinct from a raw, unreviewed prompt.

Presenting an answer alongside a specific reference to the exact source and version it was derived from, rather than an unlinked claim.

Keeping one customer's data and configuration logically or physically separate from every other customer's in a shared system.

A security model that assumes no user or system is inherently trusted, verifying every request regardless of where it originates.