AI governance glossary

The vocabulary of AI governance is settling fast, and the same word often hides two different ideas. This glossary defines 25 terms as the Agentic Commerce Framework® (ACF®) uses them, separates the notions most often confused, and points to the primary text whenever a law or a standard is involved.

Foundations

AI governanceThe rules, roles and controls that decide how an organization builds, buys and uses AI, and who answers for the results.AI agent governanceThe discipline of deciding what an AI agent may decide or do alone, who answers for it, how it can be stopped and how its actions are proven.Agentic sovereigntyThe capacity to entrust decisions to agents without ceasing to be responsible for them, and to take back control of each one.EU AI Act and AI agentsThe European regulation on AI does not name agents, but its rules on high-risk uses, oversight and logs apply to the agents that fall within them.

Authority and delegation

AI agent decision authorityThe scope of decisions an AI agent is entitled to take by itself, set by the organization and bounded by limits written in advance.Delegated authorityA power to decide that a person or organization entrusts to someone else, here an AI agent, while keeping responsibility and the right to take it back.AI agent delegationThe act of entrusting a task or a decision to an AI agent, or from one agent to another, within a scope defined in advance.AI agent authorization vs authorityAuthorization is what an agent can technically reach; authority is what it is entitled to decide. Governing an agent requires both, and they often diverge.AI agent authority revocationThe withdrawal of the decision power granted to an agent, temporarily or for good, with its technical rights cut and the event recorded.AI agent mandateThe written document that puts figures on what an agent may do, what it must refuse and who answers for it.Non-delegable decisionsThe decisions an organization keeps in human hands whatever their score, because they engage its reputation, its liability or its survival.AI agent decision classificationA ready-to-use sorting of business decisions into three zones: the agent acts alone, the agent prepares and a human validates, or the decision stays human.Decision criticalityA score for a decision based on its impact, frequency and irreversibility, which bounds how far it can be delegated to an agent.

Oversight and control

Human oversight of AIThe ability of competent people to monitor an AI system, understand it, overrule it and stop it, as required for high-risk systems by Article 14 of the AI Act.Human in the loopA setup in which a person must approve an AI system's action before it takes effect; useful for serious acts and unworkable at high volume.AI agent kill switchA device that interrupts an AI agent at several levels of severity, entrusted to a named person, independent from the agent and tested regularly.DDAO (Delegated Decision Agent Officer)The function created by ACF that answers for the decisions an organization delegates to AI agents, and that can refuse a deployment.AI agent ownerThe named person who wants an agent, deploys it and answers for its purpose and upkeep; without one, the agent is ungoverned.

Identity and inventory

AI agent identityThe means of recognizing which agent is acting, on whose behalf, in which version and under which mandate.Know Your Agent (KYA)Practices for verifying who is behind an AI agent and what it is allowed to do before dealing with it, by analogy with Know Your Customer.AI inventoryThe maintained list of the AI systems and agents an organization uses, with their purpose, data, owner and level of risk.Shadow AIAI tools and agents adopted in an organization outside any framework or supervision, and therefore invisible to its governance.

Proof and audit

AI audit trailThe preserved, verifiable record of the decisions an AI system or agent has taken, showing what was decided, by whom and under which rule.Proof of governanceThe ability to show what was decided, by whom, under which rules and when, using five pieces of evidence rather than policy documents.AI auditAn assessment of an AI system or of the governance around it, against defined criteria and based on evidence.