GlossaryAI governance and data security, .
The vocabulary that turns up in an AI governance review, in alphabetical order, without marketing definitions. Where RedactWall does something specific with a term, one sentence says what.
Terms
| Term | Definition |
|---|---|
| AI compliance | Showing an auditor, an examiner or a board that AI use followed the policy you set. It rests on a record of what was decided, not on assurances about what was intended. |
| AI governance | Deciding which AI tools an organization allows, what data may reach them, and being able to show how both were enforced. RedactWall enforces the approved policy on the paths it governs, and records what was decided there. |
| check digit | A digit computed from the rest of an identifier so a mistyped value fails arithmetic instead of passing silently. RedactWall applies the issuer’s own check digit wherever one is published. |
| content-free evidence | A record that proves what was decided without keeping the sensitive content that caused the decision. RedactWall records the kind of data found, never the data itself. |
| data lineage | Following a piece of data as it is copied, renamed or moved, so a later disclosure can be traced back to an earlier one. In design at RedactWall. |
| detector | A rule that recognises one class of sensitive value in text. RedactWall ships 106 structured detector types, including MEMBER_ID, LOAN_NUMBER and ROUTING_NUMBER. |
| DLP | Data loss prevention: finding sensitive data and stopping it crossing a boundary you control. Classical DLP was designed around email and file shares, so AI traffic has to be covered separately. |
| egress | Any path by which data leaves a boundary you control: an API call, a message, an upload, a clipboard. Naming the egress is what makes a control testable. |
| exact-data matching | Detection that matches against one organization’s own records rather than a general pattern. RedactWall matches against a copy of your records that cannot be read back into the original data. |
| examination package | A bundle of evidence assembled for a stated reporting period and handed to a reviewer. RedactWall’s is sealed to the period it names and checks out on its own, with no system of ours involved. |
| fail-closed | When a control cannot do its job, it denies rather than allows. If RedactWall cannot record a decision, it refuses the request rather than letting it through unrecorded. |
| inline enforcement | A control that sits on the path itself and decides each piece of traffic before it moves. RedactWall’s AI and email controls both decide before data leaves. |
| least privilege | Every identity holds exactly the authority it needs and nothing more. RedactWall enforces this on itself and refuses to serve if any part of the system holds more authority than it should. |
| MCP | Model Context Protocol: a standard interface by which an AI client connects to servers that expose tools and data to a model. It turns ad-hoc integrations into a surface you can enumerate and govern. |
| model response inspection | Deciding on what the model returns, not only on what was sent to it. RedactWall checks the answer on the way back, before staff or an application see it. |
| post-hoc detection | Finding sensitive data after it has come to rest, by looking at what is already stored there rather than sitting on the path data travels: it reports rather than blocks. RedactWall’s cloud drive scanning finds and reports. |
| prompt injection | Instructions hidden in content a model reads, such as a web page, a document or a tool result, that arrive as data and get acted on as commands. A control that looks only at what a person typed sees none of it. |
| redaction | Removing or masking sensitive values from content while leaving the rest usable. What happens to each kind of finding is set by your policy, which a risk owner approves before it activates. |
| retrieval-augmented generation | Usually shortened to RAG: an application feeds a model documents so its answer can draw on them. It moves an organization’s own files onto the AI path. |
| shadow AI | AI tools staff adopt without approval, procurement or a security review. It is an inventory problem before it is a policy one, because a tool nobody has listed cannot be governed. |
| tamper-evident record | A record built so that altering an earlier entry can be detected later, rather than merely discouraged. A correction is a new entry, not a rewrite of an old one. |
| tool call | A model’s request that an application run a named function and return the result into its context. RedactWall’s agent control approves the call before it runs and checks the result before the model reads it. |
Where these terms show up
- Coverage gives every surface one level: decides before data leaves, finds and reports, or on the device.
- Verify it yourself is where tamper-evident record stops being vocabulary and becomes something your team runs.
- Disclosures states what the evidence supports.
If a term you need is missing, tell us and it will be added.