An Enterprise AI Dictionary

Vocabulary is governance infrastructure. When "agent" means four different things in one meeting, the policy that uses the word means nothing. These are the terms doing load-bearing work in enterprise AI right now — defined for what they do in a decision, not padded for a glossary.

Autonomy & oversight

Assistive AI ("copilot"): Reads, retrieves, drafts, suggests; a human holds the keyboard and owns every output. Chat as advice.
Agentic AI: Systems that plan and execute multi-step work against real systems — chat as execution. The word carries the governance load: once AI acts, oversight design is the product.
AI agent: A model wired to tools, memory, and a goal. In vendor decks, nearly anything; in governance, anything with write access.
Human-in-the-loop (HITL): A human approves each action before it executes. The middle rung of the autonomy ladder — and the bottleneck; see approval fatigue.
Human-on-the-loop (HOTL): The system acts within boundaries; humans monitor and intervene by exception. Requires escalation thresholds and a named error owner, or it is just autonomy with witnesses.
Bounded autonomy: HOTL made concrete: spend limits, scope limits, thresholds. Autonomy without boundaries is liability with throughput.
Escalation threshold: The pre-defined line above which a human must look. Set before deployment — otherwise it gets negotiated during an incident.
Kill criteria: Pre-committed conditions under which an autonomous workflow reverts to humans, and who has authority to pull it. Their absence turns a failing check into a meeting.
Orchestration: The layer that routes work among models, tools, and humans. Where most "agent" engineering actually lives.
Multi-agent system: Agents feeding agents. Errors compound across handoffs; per-step observability is not optional.
Tool use / function calling: The mechanism by which a model invokes software. The door between advice and execution.
MCP (Model Context Protocol): The emerging open standard for connecting models to tools and data. Increasingly what "integrations" means in practice.
Connector: A sanctioned data pathway into the model — drive, email, CRM. Each one is an access-control decision wearing a convenience costume.

Governance & risk

NIST AI RMF: The U.S. reference framework: govern, map, measure, manage. Its load-bearing idea is proportionality — controls scaled to context, not uniform.
ISO/IEC 42001: The certifiable AI management-system standard: roles, supplier vetting, periodic review. What auditors will eventually ask to see.
EU AI Act: Risk-category law: prohibited, high-risk, limited, minimal. Its vocabulary travels even where its jurisdiction doesn't.
Deployer vs. provider: Using AI internally versus putting it in your product. Two different obligation sets — and the line organizations most often cross without noticing.
Consequential decision: A decision materially affecting an identifiable person: hiring, credit, pricing, discipline. U.S. state-law term; the escalation trigger that data-class tests miss.
Prohibited use (Tier ∞): The enumerated never-list. Its existence changes a governance table's message: not everything is approvable at some price.
Risk tier: A use case's assigned level of scrutiny; set at intake, it resolves the approver, the verification obligation, and the graduation gate in one move.
Acceptable use policy: The document employees acknowledge. Effective only where its rules are instantiated in configuration and training; otherwise, a PDF.
Shadow AI: Ungoverned use on personal accounts. Best read as a price signal: the sanctioned path costs too much friction.
Just culture: Blameless review for good-faith error; enforcement for willful violation. The precondition for ever hearing about your incidents.
Severity taxonomy: The scale that classifies incidents — caught before use, left the team, reached a client or regulator — keyed to the tiers so it isn't a second language.
Model risk management (SR 11-7): Banking's validation doctrine: inventory, independent validation, continuous monitoring. GenAI governance keeps reinventing it, usually worse.
Independent validation: Evaluation run or reviewed by someone who doesn't own the use case's success. The person who wants it deployed is not the judge of whether it works.
Attestation: A named person re-confirming, on the record, that an approval still describes reality. The compliance word for "signature with consequences."
Data classification: The public / internal / confidential / regulated ladder. AI policy should reference the existing scheme, not rebuild it.
Third-party risk (TPRM): Vendor vetting: data retention, training-use terms, tenant isolation, subprocessors. Done once per tool — orthogonal to the per-use-case tier.
Training-use opt-out: The contractual bar on a vendor training models on your inputs. The first line every general counsel reads.
Tenant isolation: Assurance that your data and usage stay walled off from the vendor's other customers.
Audit trail: Who asked what, what was generated, what was touched. Cheap to log, ruinous to lack.

Architecture & data

Foundation / frontier model: Large general-purpose models; "frontier" marks the current capability edge. What you rent, not build.
Context window: How much the model can consider at once. The budget every "just give it all the documents" plan spends.
RAG (retrieval-augmented generation): Fetching relevant documents into the prompt so answers draw on your sources rather than the model's memory. The default enterprise pattern.
Grounding: Whether output is traceable to supplied sources. Its absence has a name; see hallucination.
Embeddings / vector database: Meaning encoded as geometry so retrieval can find "relevant." The plumbing under RAG.
Fine-tuning: Adjusting model weights on your data. Rarely the first answer; often what people say when they mean RAG.
System prompt: Standing instructions the model receives before every user message. Policy's closest technical relative.
Inference: A model producing output; the metered unit of cost and of latency.

Evaluation & reliability

Hallucination: Fluent, confident output with no source behind it. The failure mode verification norms exist for — plausibility is precisely what it defeats.
Evaluation ("evals"): Structured testing of models and configurations against defined tasks and scoring. The discipline that separates "seems good" from "is good."
Gold set: Reference tasks with known-correct answers, built from your own documents. Define "good" once so it can be measured repeatedly.
LLM-as-judge: Using a model to grade model outputs at scale. Powerful, cheap, and itself a thing requiring validation.
Benchmark vs. eval-on-own-data: Public benchmarks predict benchmark performance. Only evaluation on your documents predicts yours.
Regression evaluation: Re-running the suite whenever anything changes — model, prompt, retrieval. The standing control for the change you didn't make.
Silent model update: The vendor changed the model under you; behavior shifted without a release note. Models change under you — plan accordingly.
Model drift: Slow degradation as the world moves away from what the system learned. One reason approvals age.
Guardrails: Runtime constraints on inputs and outputs: filters, schemas, refusal rules. Necessary; never sufficient alone.
Red teaming: Adversarial testing — making the system fail on purpose before someone else does it by accident.
Observability: Seeing each step of what the system actually did. In multi-agent settings, the difference between debugging and archaeology.

Adoption & operating model

Everyday / productivity AI: The workforce-enablement rollout: broad, assistive, deployer-side. What most executives mean by "AI rollout."
Agentic enterprise: The aspiration term: agents woven through operations. Survey ambition currently runs well ahead of governance reality.
Use-case intake: The single front door where proposed uses arrive and are triaged to a tier. A use case with no tier is not yet permitted.
Graduation to standard practice: The gate at which a pilot becomes the normal way work is done: training complete, evaluation passed, sign-off recorded.
Pilot purgatory: Where programs live when nothing defines graduation. The address of the widely cited finding that ~95% of GenAI pilots showed no P&L impact.
Champions network: Named per-department power users: the distribution system for training and the return path for feedback.
Prompt library: Curated, approved patterns for common tasks. Cheap capability transfer, and an underrated control surface.
Approval fatigue: Proposal volume outruns review capacity and sign-off becomes rubber-stamping. The quiet death of human-in-the-loop.
Change management: The people half of the rollout. Adoption is earned per department; involvement beats mandate.
AI council: The standing cross-functional owner: policy, tiering disputes, incident review, on a cadence. An operating rhythm, not committee theater.

Companions: Risk Tiering for Employee AI Use · Staging AI Autonomy: Per Use Case, Not Per Calendar · The Enterprise AI Rollout: A Reference Model.

Companions in this framework

← All frameworks

Autonomy & oversight

Assistive AI ("copilot")

Reads, retrieves, drafts, suggests; a human holds the keyboard and owns every output. Chat as advice.

Agentic AI

Systems that plan and execute multi-step work against real systems — chat as execution. The word carries the governance load: once AI acts, oversight design is the product.

AI agent

A model wired to tools, memory, and a goal. In vendor decks, nearly anything; in governance, anything with write access.

Human-in-the-loop (HITL)

A human approves each action before it executes. The middle rung of the autonomy ladder — and the bottleneck; see approval fatigue.

Human-on-the-loop (HOTL)

The system acts within boundaries; humans monitor and intervene by exception. Requires escalation thresholds and a named error owner, or it is just autonomy with witnesses.

Bounded autonomy

HOTL made concrete: spend limits, scope limits, thresholds. Autonomy without boundaries is liability with throughput.

Escalation threshold

The pre-defined line above which a human must look. Set before deployment — otherwise it gets negotiated during an incident.

Kill criteria

Pre-committed conditions under which an autonomous workflow reverts to humans, and who has authority to pull it. Their absence turns a failing check into a meeting.

Orchestration

The layer that routes work among models, tools, and humans. Where most "agent" engineering actually lives.

Multi-agent system

Agents feeding agents. Errors compound across handoffs; per-step observability is not optional.

Tool use / function calling

The mechanism by which a model invokes software. The door between advice and execution.

MCP (Model Context Protocol)

The emerging open standard for connecting models to tools and data. Increasingly what "integrations" means in practice.

Connector

A sanctioned data pathway into the model — drive, email, CRM. Each one is an access-control decision wearing a convenience costume.

Governance & risk

NIST AI RMF

The U.S. reference framework: govern, map, measure, manage. Its load-bearing idea is proportionality — controls scaled to context, not uniform.

ISO/IEC 42001

The certifiable AI management-system standard: roles, supplier vetting, periodic review. What auditors will eventually ask to see.

EU AI Act

Risk-category law: prohibited, high-risk, limited, minimal. Its vocabulary travels even where its jurisdiction doesn't.

Deployer vs. provider

Using AI internally versus putting it in your product. Two different obligation sets — and the line organizations most often cross without noticing.

Consequential decision

A decision materially affecting an identifiable person: hiring, credit, pricing, discipline. U.S. state-law term; the escalation trigger that data-class tests miss.

Prohibited use (Tier ∞)

The enumerated never-list. Its existence changes a governance table's message: not everything is approvable at some price.

Risk tier

A use case's assigned level of scrutiny; set at intake, it resolves the approver, the verification obligation, and the graduation gate in one move.

Acceptable use policy

The document employees acknowledge. Effective only where its rules are instantiated in configuration and training; otherwise, a PDF.

Shadow AI

Ungoverned use on personal accounts. Best read as a price signal: the sanctioned path costs too much friction.

Just culture

Blameless review for good-faith error; enforcement for willful violation. The precondition for ever hearing about your incidents.

Severity taxonomy

The scale that classifies incidents — caught before use, left the team, reached a client or regulator — keyed to the tiers so it isn't a second language.

Model risk management (SR 11-7)

Banking's validation doctrine: inventory, independent validation, continuous monitoring. GenAI governance keeps reinventing it, usually worse.

Independent validation

Evaluation run or reviewed by someone who doesn't own the use case's success. The person who wants it deployed is not the judge of whether it works.

Attestation

A named person re-confirming, on the record, that an approval still describes reality. The compliance word for "signature with consequences."

Data classification

The public / internal / confidential / regulated ladder. AI policy should reference the existing scheme, not rebuild it.

Third-party risk (TPRM)

Vendor vetting: data retention, training-use terms, tenant isolation, subprocessors. Done once per tool — orthogonal to the per-use-case tier.

Training-use opt-out

The contractual bar on a vendor training models on your inputs. The first line every general counsel reads.

Tenant isolation

Assurance that your data and usage stay walled off from the vendor's other customers.

Audit trail

Who asked what, what was generated, what was touched. Cheap to log, ruinous to lack.

Architecture & data

Foundation / frontier model

Large general-purpose models; "frontier" marks the current capability edge. What you rent, not build.

Context window

How much the model can consider at once. The budget every "just give it all the documents" plan spends.

RAG (retrieval-augmented generation)

Fetching relevant documents into the prompt so answers draw on your sources rather than the model's memory. The default enterprise pattern.

Grounding

Whether output is traceable to supplied sources. Its absence has a name; see hallucination.

Embeddings / vector database

Meaning encoded as geometry so retrieval can find "relevant." The plumbing under RAG.

Fine-tuning

Adjusting model weights on your data. Rarely the first answer; often what people say when they mean RAG.

System prompt

Standing instructions the model receives before every user message. Policy's closest technical relative.

Inference

A model producing output; the metered unit of cost and of latency.

Evaluation & reliability

Hallucination

Fluent, confident output with no source behind it. The failure mode verification norms exist for — plausibility is precisely what it defeats.

Evaluation ("evals")

Structured testing of models and configurations against defined tasks and scoring. The discipline that separates "seems good" from "is good."

Gold set

Reference tasks with known-correct answers, built from your own documents. Define "good" once so it can be measured repeatedly.

LLM-as-judge

Using a model to grade model outputs at scale. Powerful, cheap, and itself a thing requiring validation.

Benchmark vs. eval-on-own-data

Public benchmarks predict benchmark performance. Only evaluation on your documents predicts yours.

Regression evaluation

Re-running the suite whenever anything changes — model, prompt, retrieval. The standing control for the change you didn't make.

Silent model update

The vendor changed the model under you; behavior shifted without a release note. Models change under you — plan accordingly.

Model drift

Slow degradation as the world moves away from what the system learned. One reason approvals age.

Guardrails

Runtime constraints on inputs and outputs: filters, schemas, refusal rules. Necessary; never sufficient alone.

Red teaming

Adversarial testing — making the system fail on purpose before someone else does it by accident.

Observability

Seeing each step of what the system actually did. In multi-agent settings, the difference between debugging and archaeology.

Adoption & operating model

Everyday / productivity AI

The workforce-enablement rollout: broad, assistive, deployer-side. What most executives mean by "AI rollout."

Agentic enterprise

The aspiration term: agents woven through operations. Survey ambition currently runs well ahead of governance reality.

Use-case intake

The single front door where proposed uses arrive and are triaged to a tier. A use case with no tier is not yet permitted.

Graduation to standard practice

The gate at which a pilot becomes the normal way work is done: training complete, evaluation passed, sign-off recorded.

Pilot purgatory

Where programs live when nothing defines graduation. The address of the widely cited finding that ~95% of GenAI pilots showed no P&L impact.

Champions network

Named per-department power users: the distribution system for training and the return path for feedback.

Prompt library

Curated, approved patterns for common tasks. Cheap capability transfer, and an underrated control surface.

Approval fatigue

Proposal volume outruns review capacity and sign-off becomes rubber-stamping. The quiet death of human-in-the-loop.

Change management

The people half of the rollout. Adoption is earned per department; involvement beats mandate.

AI council

The standing cross-functional owner: policy, tiering disputes, incident review, on a cadence. An operating rhythm, not committee theater.

Companions: Risk Tiering for Employee AI Use · Staging AI Autonomy: Per Use Case, Not Per Calendar · The Enterprise AI Rollout: A Reference Model.