AI Governance Glossary | AxonBrief Academy

Accountability

The obligation of an actor to answer for decisions, actions, or outcomes within its role and authority.

Agent control plane

An independent runtime layer that converts organizational identity, risk, policy, approvals, and delegation into bounded machine authority and produces evidence that those boundaries were enforced.

AI actor / stakeholder

A person or organization participating in, responsible for, affected by, or connected to AI-system activities. Consult ISO/IEC 22989 and OECD sources for formal wording.

AI lifecycle

The stages through which an AI system progresses, including conception, design, development, evaluation, deployment, operation, change, and retirement.

AI system

An engineered system that generates outputs such as content, forecasts, recommendations, or decisions for given objectives. Consult ISO/IEC 22989 for standardized terminology.

Authoritative source

A source designated by organizational policy as the system of record or source of truth for a particular decision domain.

Bounded autonomy

Autonomous system behavior operating within explicit, enforceable, observable, and revocable authority boundaries.

Capability omission

Removing or withholding a capability that should never be used rather than relying only on instructions telling the system not to use it.

Compensating control

An alternative control used to reduce risk when a preferred control cannot be met temporarily or in a particular context.

Continuous assurance

Ongoing collection and evaluation of evidence that governance conditions and control effectiveness remain valid as the system and environment change.

Control objective

A testable condition derived from governance intent and policy that must remain true for a system to be appropriately governed.

Decision right

Explicitly allocated authority to make a defined class of decisions or authorize actions under stated conditions and limits.

Delegated authority

Authority transferred by a legitimate actor or system to another actor or system for a defined task and bounded scope.

Escalation

A governance outcome in which a decision cannot be automatically permitted or denied and is transferred to an actor with higher or different authority.

Evaluation gate

A lifecycle point at which defined evaluation evidence is checked before a system may proceed to production or expanded authority.

Evaluation governance

Governance of what is evaluated, admissible metrics and test sets, threshold authority, interpretation, and sufficient evidence.

Exception

A temporary, bounded, formally authorized deviation from normal policy, with scope, duration, compensating controls, evidence, and expiry.

Execution capability

The technical ability of a person, service, agent, credential, or component to perform an action. Capability is not proof of legitimate authority.

Execution envelope

The bounded identities, actions, resources, data, tools, limits, duration, context, delegation, and escalation rules defining legitimate machine authority.

Explainability

The degree to which meaningful information can be provided about why an AI system generated an output or behaved in a particular way.

Governance drift

Gradual divergence between the live system and the authority, controls, evaluations, or assumptions under which it was approved.

Governance evidence

Trustworthy information sufficient to show that a decision, control, or authority boundary was legitimately established and operated as intended.

Governance invariant

A control objective expressed as a condition that remains true despite normal variability in model behavior.

Governed AI registry

An inventory covering use cases, owners, risk, data/context, memory, tools, credentials, providers, actions, evaluations, exceptions, and lifecycle—not only models.

Human oversight

Mechanisms through which humans supervise, approve, intervene in, override, suspend, or otherwise govern AI-system activity.

Impact

A consequence affecting people, groups, organizations, rights, processes, assets, society, or the environment. Impact assessment is broader than a numeric risk tier.

Independent challenge

Review by an actor or control function sufficiently independent from the party with incentives to build, ship, or operate the system.

Inference

Use of a trained model to produce outputs from inputs.

Least authority

Granting only the minimum authority required for the current task, context, and duration.

Machine authority

The formally delegated capacity of an AI-enabled system to change organizational or external state within explicit boundaries.

Meaningful human oversight

Oversight in which a competent person has legitimate authority, sufficient information and time, and an effective ability to intervene, reject, escalate, or stop.

Model

A computational representation used to generate predictions, content, classifications, decisions, or other outputs from inputs.

Model-routing governance

Constraints that determine which models and providers are admissible before optimization for cost, latency, or quality.

Non-amplifying delegation

Delegated authority cannot exceed that of the delegating chain and should normally be attenuated to the minimum required.

Policy Decision Point

A component or service that evaluates relevant facts against policy and returns an authorization decision.

Policy Enforcement Point

A component or service that mediates access and enforces a policy decision before execution.

Policy-as-code

Compiling selected explicit governance decisions into deterministic, versioned, testable rules evaluated at authoritative control points.

Provenance

Information about the origin and lineage of data, context, models, artifacts, decisions, approvals, or other elements relevant to behavior.

Residual risk

Risk remaining after controls and treatment have been applied.

Reversibility

The degree to which consequences can be undone or remediated. Lower reversibility generally warrants stronger authority and oversight controls.

Risk

The effect of uncertainty on objectives; AI risk analysis considers likelihood, consequence, affected parties, context, and controls.

Risk-acceptance authority

Legitimate authority to accept a defined level and type of residual risk on behalf of the organization.

Segregation of duties

Separation of proposing, approving, executing, and verifying so one actor does not control the full critical chain without challenge.

Traceability

Ability to link events, artifacts, decisions, components, and lifecycle records so evolution and operation can be reconstructed.

Training

The process through which model parameters are adjusted using data and an optimization procedure.

Transparency

Availability of appropriate information about an AI system, its operation, limitations, or governance to relevant stakeholders.

AI governance and governable-systems vocabulary.