Glossary
Plain-English definitions, shared with the AI Acceptable Use policy so a term means the same in both places.
- Agentic AIalso: AI agent, autonomous AI
An AI system that goes beyond producing text and takes actions on its own: calling tools, running commands or making changes, sometimes chaining several steps. That autonomy raises the stakes of both wrong output and prompt injection.
See also: Prompt injection, Human-in-the-loop
- Approved AI gatewayalso: AI gateway, sanctioned gateway
A controlled entry point through which staff access sanctioned AI, letting the organisation enforce policy on every AI interaction: logging, data-loss prevention, secret/PII protection and access control.
See also: Sanctioned AI, Data Loss Prevention (DLP)
- Data Loss Prevention (DLP)also: data loss prevention
Technical controls that detect and block sensitive data (secrets, PII, source) from leaving the organisation's boundary, including being pasted or uploaded into AI tools.
See also: Approved AI gateway, Sensitive data
- Data Processing Agreement (DPA)also: data processing agreement
A contract required under UK GDPR Article 28 when a third party processes personal data on your behalf, setting out the processing terms and safeguards. Public/consumer AI tiers typically do not provide one.
See also: Sanctioned AI, Personal data (PII)
- Data Protection Impact Assessment (DPIA)also: data protection impact assessment
An assessment required under UK GDPR Article 35 when processing is likely to result in a high risk to individuals, which covers much AI processing of personal data, to identify and mitigate that risk before processing begins.
See also: Personal data (PII), Sensitive data
- Hallucinationalso: confabulation
When an LLM produces output that is fluent and confident but factually wrong or entirely invented, for example a wrong command flag, a non-existent package, or a fabricated policy. It predicts plausible text rather than verified truth.
See also: Slopsquatting
- Human-in-the-loopalso: human oversight, HITL
A control requiring a competent human to review and explicitly authorise an AI-suggested action before it takes effect, above all any change to systems or data, so a named person remains accountable.
See also: Agentic AI, Prompt injection
- Personal data (PII)also: personal data, personally identifiable information
Any information relating to an identified or identifiable living individual (e.g. names, emails, IDs, online identifiers). Processing it is regulated by UK GDPR and the Data Protection Act 2018; disclosing it to a public LLM is a third-party disclosure that usually needs a lawful basis and a DPA.
See also: Sensitive data, Data Protection Impact Assessment (DPIA), Data Processing Agreement (DPA)
- Private / on-prem AIalso: self-hosted AI, on-premises AI, private LLM
An AI capability hosted within the organisation's own boundary (on-premises or in a controlled private environment) so that prompts and data never leave that boundary and stay out of reach of any third-party provider. This is the lowest-exposure sanctioned option.
See also: Sanctioned AI, Public / consumer LLM
- Prompt injectionalso: indirect prompt injection, poisoned input
An attack where instructions hidden in content the model processes (a web page, document, email or ticket) hijack its behaviour, because an LLM cannot reliably separate instructions from data. The NCSC regards it as intrinsic to LLMs and not fully eliminable.
See also: Agentic AI, Human-in-the-loop
- Public / consumer LLMalso: public AI tool, consumer AI, third-party LLM
A large language model offered as a general consumer service (e.g. the free or personal tiers of ChatGPT, Gemini, Claude, Copilot) where, under the standard terms, inputs may be retained, processed by third parties and used to improve the model, with no organisation-specific data processing agreement.
See also: Sanctioned AI, Private / on-prem AI, Shadow AI
- Sanctioned AIalso: approved AI, approved tool
An AI tool formally approved for organisational use because it meets defined requirements, accessed through an approved route. The requirements are, at minimum, contractual no-training terms and a signed data processing agreement (DPA), or the tool is self-hosted/private.
See also: Public / consumer LLM, Private / on-prem AI, Approved AI gateway, Data Processing Agreement (DPA)
- Sandbox-before-prodalso: sandbox first, test before prod
The practice of running any AI-generated command or change in an isolated, non-production environment first, confirming its effect and blast radius, before it is ever applied to live systems.
See also: Human-in-the-loop
- Secret / credentialalso: credential, API key
Any value that grants access or proves identity: passwords, API keys, tokens, connection strings, private keys. Once you paste one into a third-party tool, treat it as compromised and rotate it.
See also: Sensitive data
- Sensitive dataalso: sensitive information, restricted data
Information that must not be entered into any AI tool unless that tool is sanctioned and the handling is approved. This covers personal data (UK GDPR), secrets and credentials, proprietary source code, configurations and network detail, and confidential commercial or legally privileged material.
See also: Personal data (PII), Secret / credential, Public / consumer LLM
- Shadow AIalso: unsanctioned AI
Use of AI tools that the organisation has not approved, cannot see and does not govern. Usually public/consumer tools reached through personal accounts, outside any policy, logging or DLP.
See also: Public / consumer LLM, Sanctioned AI
- Slopsquattingalso: AI package hallucination attack
A supply-chain attack that exploits AI 'package hallucinations': because models invent plausible package names that recur predictably, attackers pre-register those names on public registries with malware, so anyone who runs the AI-suggested install line pulls in hostile code.
See also: Hallucination