Glossary of AI with control

The company’s own network and servers.

What is inside does not go out to the internet or the public cloud. At DEBIR, the model, the permissioned knowledge base and the audit log live there, on a segmented network with no internet egress. It is what many buyers call an on-premises deployment, with the governance around it.

An open-weight language model (Llama, Qwen, Mistral) from the generation available when each project starts.

It is installed on your own hardware and measured against the client’s own questions. It is not a frontier model like the latest from Anthropic, OpenAI or Google, and we say so. Each project names the specific model and its license.

The seal on every model DEBIR trains.

Each client receives its own: Dabar followed by the company’s name, a DEBIR model. In Hebrew it means “word”, from the same root as Debir. The model’s technical name follows the base model’s license.

A base of company documents the model searches before answering, and cites.

It lives outside the model, with role-based permissions, and is updated in minutes. Its technical name is retrieval-augmented generation (RAG). Sensitive data is consulted there, never inside the model.

Teaching the base model the company’s voice, format and vocabulary with thousands of approved examples.

The base model is frozen and small layers are trained (LoRA). It learns the craft; it does not memorize files. The result is the identity adapter.

The small file that results from training and is mounted on the base model.

It is the company’s identity in software form: it is versioned, signed, archived and owned by the client.

An automated procedure that uses the model to carry out a task.

Serving a policyholder, opening a file, preparing a proposal. At DEBIR, an agent gathers, organizes and hands off; it never decides alone. A person reviews before any effect on a customer or a core system.

The automatic record of every question, every document consulted, every answer and every action, with user and version.

It is the main evidence in an audit. Compliance reads it without intermediaries. Minimum retention of six months.

The ten governance documents that come with every system.

Use policy, impact assessment, responsibility matrix, datasheet, model and agent registry, model card per version, incident response protocol, data processing agreement, service level agreement and exit plan.

The document that describes what the system does, whom it affects, what data it uses and what risks it carries, with their mitigations.

Legal signs it before anything is built. In Mexico it is not mandatory for private companies; we do it because it turns an AI project into a company project.

A set of questions written by the company’s experts that the model never saw during training.

It is used to measure each version before release. The threshold is set in advance and results are reported by segment. The client’s team grades it.

Deliberate attempts to make the system reveal data, skip its rules or be manipulated.

Also called red teaming. It happens before the pilot and at every major version, the client’s security team leads it and findings are fixed before release.

The gradual change in the kind of questions or in answer quality over time.

It is monitored daily so retraining happens in time. Without operation, a model’s answers age within six months.

A person reviews before any action that affects a customer, an employee or a core system.

It is the second commitment of the governance framework and the way to meet, by design, the right to object to automated decisions (Mexico’s 2025 data protection law, article 27).

No one validates their own work.

The client grades the test, the client’s security team leads attack testing and the weekly review is done by a specialist other than the one who built it. A risk committee calls it effective challenge.

Each point in the method where someone signs before moving on.

Without a signature, the project does not advance. There are five: Discovery, final report, foundations, model and pilot; after that, operation with the monthly committee minutes.

A use case with a positive twelve-month business case and no block from Legal.

It is the condition of the Assessment guarantee: if the final report does not identify one, the final 50% is not charged.

DEBIR’s first three clients.

They pay the entry phases at an explicit discount from list price, in exchange for a publishable case, a reference and feedback. Continuous operation is paid at list price.

A figure under the data protection law: whoever processes personal data on the company’s behalf.

It implies a contract, security obligations and accountability before the authority. With your own hardware, you remain the controller and DEBIR accesses under a data processing agreement.

Delivery of the models and code to a neutral third party that releases them to the client if the vendor disappears or defaults.

Optional in deployments with DEBIR hardware, at the client’s cost. With your own hardware it is not needed: everything is already in the company.

The model itself.

Under the exit plan they belong to the client and are delivered in a standard format, at no cost, together with the identity adapter, the test and the audit log.

The Measurement and Update Unit, the reference used to calculate fines in Mexico.

In 2026 it equals MXN 117.31 per day (INEGI, Official Gazette, January 9, 2026). The maximum data protection fine, 320,000 UMA, is about MXN 37.5 million, double with sensitive data.