AI governance terms, in plain language

The five answers a policy check can return: Allow (continue as submitted), Warn (continue with a warning), Transform (continue with a corrected version), Escalate (wait for a person with authority), or Deny (stop). Your application applies whichever comes back.

Issuing a refund or sending a message can be a protected action: an application action checked against policy while it can still be changed.

VeriProof’s response to an action checked against active policy, which the connected application then applies.

A way to test how a rule responds to supplied facts. Preview returns evaluation results without creating enforcement records.

What the application or responsible business system reports happened. A payment might be completed, declined, or still awaiting approval.

The point in a workflow where an application requests a policy check, such as before calling a tool.

An integration that records activity for monitoring and investigation. Controlling an action requires a supported check before it runs.

Shadow shows how a rule would respond. It records proposed results without changing application behavior or opening review work.

Once authorized users activate a policy, a supported integration applies its results to the action in Enforced mode.

The history of an action, including its supplied context, policy result, and available review and outcome information.

Selected records brought together for an audit, investigation, or internal review. An evidence pack can include decision history and integrity information.

Recording an event as it happens in the workflow. The record preserves the information available at that time.

Where did this information come from? Provenance identifies its source, distinguishing application data from human responses and records supplied by other systems.

A short value calculated from content. Comparing fingerprints shows whether the content changed; it doesn't show whether the original information was true.

A single fingerprint for a group of records, used with a proof to check whether a particular record belongs to that group.

Designed to make changes detectable through integrity checks. The term describes evidence of alteration, not a guarantee that alteration is impossible.

A record-keeping approach that adds new entries rather than overwriting earlier ones through normal writes.

Integrity evidence checked against Azure SQL Database Ledger and its protected digests. This is the default integrity option in the managed service.

A public fingerprint on the Solana blockchain, used when an environment is set up with Solana instead of Azure SQL Database Ledger. It supports integrity verification without publishing the decision content, and no personal data is ever published to it.

A link from a framework requirement to the controls or evidence used to address it.

The requirements and applications addressed by recorded controls. Evidence and testing help reviewers assess how those controls performed.

Something a review needs but the available records do not yet show. A missing approval record, for example, is an evidence gap.

Monitoring and analysis of AI application behavior. VeriProof adds policy decisions, business context, and human review to that operational picture.

The work of identifying, assessing, monitoring, and managing risks arising from models across an organization.

A hiring or promotion tool covered by NYC Local Law 144’s definition. See New York City’s guidance for its scope.

An EU AI Act classification that depends on a system’s purpose and use. Explore the EU AI Act overview.

More than watching a workflow. Human oversight gives a person the information and authority to supervise an AI system and influence its actions.

The record of what your agents did, in the terms the business uses, together with the workflows that let business owners, compliance, audit, and management act on it without going through engineering.

A catalog of field names and permitted values for each industry, drawn from published standards such as ISO 20022, HL7 FHIR, and ACORD. Agents emit these names, policies reference them, and reviewers read a plain-language label.

An agent whose application is connected to VeriProof, so its consequential actions are checked before they run and their outcomes are reported back. Agents can be built with an SDK, assembled in Copilot Studio, or work through a browser.

One decision journey accepted by VeriProof, including one still awaiting review or an application-reported outcome. Policy checks, reviews, and the reported outcome belong to that journey. Retries and child steps don't count as separate decisions. Plans are priced by agents and recorded decisions.

Business owner, risk and compliance officer, governance engineer, developer, auditor, and administrator. Each has a portal built for their part of the work, and built-in handoffs move work between them: an exception reaches the person with authority, a missing field becomes a developer fix request, a governance engineer's rule change for a production agent goes to an administrator or compliance officer to approve, and a risk decision lands with the named business owner. See the roles and handoffs.