Corporate AI glossary

AI Governance

AI governance is the set of policies, frameworks, processes and controls that an organization establishes to ensure that its use of AI is secure, ethical, transparent and compliant with applicable regulations.

An effective AI governance program defines who can use AI, with which tools, for which tasks, with which data and under what oversight. It also establishes accountability mechanisms and incident-response procedures for AI-related events.

In the European context, the AI Act (Regulation EU 2024/1689) requires organizations to implement risk-management systems for high-risk AI systems, making AI governance a regulatory necessity as well as a best practice.

DLP — Data Loss Prevention for AI

Data Loss Prevention (DLP) in the context of artificial intelligence refers to the technologies and policies that analyze the prompts and responses of language models to detect, alert on or prevent the unauthorized exposure of sensitive data.

Unlike traditional DLP (which protects files, emails and endpoints), AI DLP acts on the text of messages before they are sent to the models. It can detect Personally Identifiable Information (PII), financial data, credentials, trade secrets or health data, and apply actions such as blocking the request, warning the user, anonymizing sensitive data in real time or sending the prompt for manual review.

coordinat.io implements DLP through pattern analysis (regex) and configurable rules, applied at the gateway before any data reaches the AI provider.

BYOK — Bring Your Own Key

BYOK (Bring Your Own Key) is the model in which a company uses its own API keys and direct contracts with AI providers (OpenAI, Anthropic, Google, etc.), instead of consuming AI through an intermediary that bills for usage.

The main advantages of BYOK are: full control over costs (you pay the provider directly, with no markups), greater visibility over the applicable privacy terms, and the ability to negotiate corporate rates with providers.

In coordinat.io, BYOK is available from the Basic plan onwards. The platform acts as a transparent proxy: it receives the requests, applies the security policies and forwards them to the provider using the customer's own keys. The customer pays OpenAI, Anthropic or Google directly.

AI Gateway

An AI Gateway is an infrastructure component that acts as a centralized entry point for all requests to artificial intelligence models within an organization. Similar to an API Gateway in microservices architectures, the AI Gateway intercepts AI traffic before it reaches the providers.

Typical AI Gateway functions include: authentication and authorization, enforcement of security policies (DLP), activity logging, rate limiting, load balancing across providers, automatic fallback on failures and model optimization.

coordinat.io exposes an AI Gateway with an OpenAI-compatible API, which lets organizations adopt AI governance without modifying their existing applications: you simply point the base URL to coordinat.io.

Shadow AI

Shadow AI is the unauthorized or unsupervised use of artificial intelligence tools by employees, outside the knowledge and control of the IT, security or management functions of the organization.

The phenomenon is analogous to the "Shadow IT" that emerged with the mass adoption of cloud services. Recent studies indicate that between 70% and 80% of employees use AI tools at work, regardless of whether the company has authorized them.

The risks of Shadow AI include: leakage of confidential data through uncontrolled prompts, use of tools that do not comply with GDPR or other regulations, uncontrolled costs when employees use paid tools on a corporate card, and a total lack of traceability for audits.

The most effective solution is not to block access to AI (which reduces productivity without eliminating the risk), but to centralize access through a governance platform that enables controlled and audited use.

Intelligent AI model routing

Intelligent model routing is the automatic selection of the most suitable language model for each individual request, with the goal of minimizing cost without sacrificing the quality of the response.

The routing logic is based on classifying the complexity of each request before sending it to a model. A simple question ("translate this sentence") does not need the same model as a complex task ("analyze this contract and detect abusive clauses"). "Nano" models (the most economical versions from each provider) cost up to 10 times less than "top" models (the most advanced versions), for tasks where the difference in quality is imperceptible.

coordinat.io implements heuristic routing based on the content of the prompt: length, vocabulary, type of task requested and context. Classification is instantaneous, with no additional API calls, and can save between 20% and 40% on AI costs for organizations with intensive use of premium models.

AI Act — European AI Regulation

The AI Act (Regulation EU 2024/1689 of the European Parliament and of the Council) is the world's first comprehensive regulatory framework on artificial intelligence. Published in the Official Journal of the EU in July 2024, it establishes obligations for providers, deployers and users of AI systems according to their level of risk.

The Regulation classifies AI systems into four risk categories: unacceptable (prohibited), high risk (with strict obligations for transparency, risk management and documentation), limited risk (with transparency obligations), and minimal risk (with no specific obligations).

For companies that use general-purpose models (such as those from OpenAI, Anthropic or Google) in internal contexts, the main obligations are: documenting usage, implementing risk management, ensuring human oversight and keeping auditable activity logs.

coordinat.io helps organizations comply with the AI Act by providing complete logging of all AI activity, exportable compliance reports and configurable policy controls.

Prompt Injection

Prompt injection is an attack technique in which malicious instructions are embedded within a prompt to manipulate the behavior of a language model (LLM) and get it to perform unauthorized actions, reveal confidential system information or bypass security controls.

There are two main variants: direct prompt injection (the user embeds adversarial instructions directly in their message) and indirect prompt injection (the malicious instructions are introduced through external content that the model processes, such as a web page or a document).

For organizations that deploy AI assistants or use LLMs in automated processes, prompt injection represents a real attack vector that can compromise the confidentiality of system prompts, the data being processed or the integrity of workflows. Defenses include input sanitization, clear separation of instructions and data, and monitoring for anomalous patterns in prompts.

AI FinOps — Chargeback

AI FinOps applies the financial management discipline of cloud computing to artificial intelligence consumption: measuring real spend, attributing it to whoever generates it and optimizing it continuously. Chargeback is its central mechanism: attributing AI cost to the client, project or department that consumes it.

For services companies (consultancies, agencies, law firms) it is especially critical: if AI is used for client work but its cost is not attributed to each account, that spend erodes margin invisibly. An AI FinOps program also distinguishes billable from internal cost and detects unassigned spend.

coordinat.io implements AI FinOps natively: every request is associated with a user, project and department, with attribution rules (overhead, billable/internal) and CSV accounting export.

AI Agent Governance

AI agent governance is the set of controls that supervise autonomous agents: AI systems that do not just answer questions but execute actions — calling tools, querying APIs, modifying data.

Unlike a chat, an agent acts. That demands additional controls: human approval before sensitive actions (human-in-the-loop), a log of every tool executed with its parameters and results, and limits on which tools each agent may use.

coordinat.io records every agent session with full traceability of its tool calls and applies configurable human-approval flows before an agent executes external actions.

RAG — Retrieval-Augmented Generation

RAG (Retrieval-Augmented Generation) is the technique that lets a language model answer using an organization's own knowledge: before generating the answer, the system retrieves the relevant fragments from company documents and provides them to the model as context.

Without RAG, a model only knows what it learned in training: it answers well about general knowledge and poorly about the specific business. With RAG, answers cite real procedures, contracts or internal documentation, which reduces hallucinations and makes AI useful for daily work.

In coordinat.io, knowledge bases let you upload corporate documents that assistants use as a source, always inside the organization's security perimeter: the knowledge never leaves company policy.