LLM Governance Glossary: Terms for CISOs and Compliance Leads

Policy and enforcement terms

Policy definition is a written rule about permitted LLM use: which models, which data, which users, which tools. A policy document changes nothing about system behavior on its own. It becomes a control only when something applies it.

Policy enforcement (the usual AI policy enforcement definition) is the application of a policy to an individual interaction or tool call in the execution path, producing a decision. Typical outcomes are allow, redact, block, rate limit, or escalate for human approval. The test of enforcement is whether the decision happens before the request completes, not whether a reviewer could later find a violation.

Runtime control (LLM runtime controls) is any control that operates while a request is in flight. It contrasts with pre-deployment review, which assesses a system before it goes live. Review and documented assessment are valuable, and the EU AI Act recitals describe documenting an assessment before a system is placed on the market. But a pre-deployment record does not govern what happens in each later interaction.

In-path and out-of-path describe where a control sits. An in-path control can change the outcome. An out-of-path control, such as a report built from stored records, can only describe it.

Guardrails is a vendor term with no stable meaning. It may refer to a prompt instruction, a classifier, or an enforced decision tied to a named policy. When it appears in a vendor assessment, ask which of these it is and what record each decision leaves.

Human-in-the-loop escalation is an enforcement outcome in which an interaction is held until a designated approver decides. It differs from a human reviewing logs afterward. The evidence it should produce is the triggering policy, the approver's identity, the decision and the time.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, with decisions enforced at runtime, not reviewed after the fact.

Data protection terms

Redaction is the removal or masking of sensitive content from a prompt or an output before it reaches the model or the user. It is distinct from detection, which only identifies sensitive content, and from blocking, which stops the interaction entirely. Specify the data categories covered, whether redaction applies to both directions, and what record shows that it occurred.

Access control determines which users, applications and agents may use which models and data. For LLM use it should be evaluated per interaction, not only at sign-in.

Retention is how long prompts, outputs and evidence records are kept, and who controls the period. Retention of evidence and retention of raw prompt content are separate decisions. Keeping proof of a decision does not require keeping every sensitive payload, so contracts should state each period separately.

Data residency is where data is stored and processed. For LLM use it applies to prompts, outputs and evidence records alike, so a residency commitment that covers only one of them is incomplete.

Agent and tool access terms

Tool-call control is a policy decision applied to each call a model or agent makes to a tool, evaluated with the call's parameters and the caller's identity. Approving an agent in general is not the same as approving each action it takes.

MCP server access is the question of which Model Context Protocol servers an agent may connect to and which of their tools it may invoke. Treat it as an access decision with the same scrutiny as any other privileged integration, and require a record of each permitted and denied call.

Least privilege and separation of duties are the identity concepts NIST applies to agents. In a blog published in October 2026, NIST proposed an initial set of ten design tenets for agent identity management. One bounds an agent's access strictly to the minimum scope needed for a designated task, constrained by separation of duties so an agent cannot assume conflicting privileges that bypass governance controls. These are an initial proposal, not a finalized standard.

Transaction-level governance and end-to-end agentic workflow tracing are general industry concepts. They refer to relating a business transaction, or a chain of tasks across several agents, into one governed and traceable unit. They are different from interaction-level enforcement, and a buyer should confirm which of the two a vendor means.

Evidence and audit terms

Logging is the recording of events. Audit evidence is a record that shows a specific policy was in force, what decision it produced on a specific interaction, and what happened as a result. Logs can become evidence only if they are complete, tamper-resistant, tied to a policy version and retained for the required period. A raw event stream that nobody has mapped to a requirement is storage, not proof.

An AI audit evidence record for an enforced interaction should identify the requester, the model or tool, the policy and version applied, the decision (allow, redact, block, rate limit, escalate), any approver, and the time. The same record should be retrievable by interaction, user or policy.

Traceability is the ability to reconstruct how a decision or outcome came about. The EU AI Act recitals tie traceability and transparency to documentation that a provider gives national competent authorities on request. The recitals also say the risk-management system should be regularly reviewed and updated, and that significant decisions and actions should be justified and documented. This is the difference between documenting a decision and operationally recording each interaction. Mature programs need both.

Trussed generates audit-ready evidence continuously as a product of enforcement, mapped to HIPAA, NAIC, NYDFS, EU AI Act and NIST requirements. Evidence comes from the enforcement decision itself, not from a separate reconstruction.

Code provenance, deployment and residency terms

Code provenance is the origin, licence and security context of code. It matters most where coding assistants generate or modify code, because the reviewer needs to know where a suggestion came from and whether its licence or known weaknesses create obligations. Trussed provides code provenance for code produced with coding assistants.

Model provenance, model lineage and dataset provenance are separate industry concepts. They describe the origin and history of a model, how it was derived from earlier models, and the data used to train it. They are different from code provenance and should be requested and defined separately.

Self-managed deployment means the control software runs in the customer's own cloud account. Its relevance is that prompts, outputs and evidence records can stay within boundaries the customer already governs, which simplifies residency and retention commitments. Trussed supports self-managed deployment in the customer cloud, with configurable retention and data residency.