Technical language, explained.

governance

The decisions, responsibilities, policies and review practices that determine how an organization manages its technology and security.

AI security governance

Security responsibilities and rules for AI use, including information access, provider dependencies, permitted actions and review as systems change.

control validation

Checking whether an agreed safeguard behaves as intended in defined conditions. It does not establish that every risk has been addressed.

trust boundary

A point where information or actions move between systems, users or organizations with different permissions or assumptions.

connector identity

The account or application identity used by an integration to access another system. Its permissions may differ from the requesting user's permissions.

least privilege

Limiting an identity's access and permitted actions to what its specific task requires, with review as those needs change.

prompt injection

Input that attempts to change an AI application's intended behavior, including instructions hidden in material the application retrieves.

sensitive data

Information requiring particular handling because of business, personal, contractual or regulatory considerations. Its classification and permitted uses depend on context.

third-party protocols

Agreed technical connections and working procedures with outside organizations, including authentication, approvals, data handling and incident responsibilities.

data provenance

Information about where data came from, when it was captured and how it was changed, helping people judge whether it is appropriate for a decision.

resilience

The ability to prepare for disruption, maintain essential activities where possible and recover deliberately within understood constraints.

human approval

A deliberate decision by an authorized person before a specified action proceeds. Its effectiveness depends on the information, authority and controls supporting that decision.

API

An application programming interface: a defined way for software systems to exchange information or request actions. Authentication and authorization still need to be designed and checked.

OWASP

The Open Worldwide Application Security Project, which publishes security resources. A referenced risk list helps frame questions; it is not a certification or a complete test plan.

NIST AI RMF

NIST's voluntary Artificial Intelligence Risk Management Framework. Referenced here as risk-management guidance, not a certification or a promise of complete framework coverage.

CUI

Controlled Unclassified Information: a US government information category with applicable safeguarding requirements. Mentioning CUI does not establish authorization or readiness to handle it.

Contextual explanations, not legal definitions or a certification standard. Framework references inform scoping; coverage must be agreed for the actual engagement.