Shared AI Taxonomy

Expanded Definition

A shared AI taxonomy is the agreed language an organisation uses to classify AI systems, their intended use, sensitivity, autonomy, model exposure, and control expectations. In NHI security and agentic ai governance, it reduces ambiguity between engineering, security, legal, procurement, and audit by making one label mean one thing.

Definitions vary across vendors and internal governance teams, so a shared taxonomy is not just a naming exercise. It usually covers system type, data handling class, risk tier, human oversight level, and evidence requirements, but no single standard governs this yet. That is why many teams map it to broader control languages such as the NIST Cybersecurity Framework 2.0 while maintaining their own AI-specific terms.

The distinction from an ordinary glossary is operational use: a shared AI taxonomy is intended to drive decisions, not just definitions. It becomes the reference point for policy, inventory, risk acceptance, and control selection across AI and NHI workflows. The most common misapplication is treating it as a static documentation artifact, which occurs when teams publish terms once but do not enforce them in governance reviews, ticketing, and control evidence.

Examples and Use Cases

Implementing a shared AI taxonomy rigorously often introduces overhead in classification and review, requiring organisations to weigh faster delivery against more consistent governance.

• A platform team labels an internal model as "high autonomy" only after it can call tools and modify production records, which changes the review path and approval evidence required.
• A security team classifies service accounts used by AI agents separately from human users so that access reviews, secrets handling, and escalation rules are applied correctly.
• Legal and data governance teams use the same taxonomy to distinguish public, internal, regulated, and restricted AI use cases, reducing contradictory sign-off decisions.
• NHIMG research on the DeepSeek breach shows why a shared classification of model exposure and data sensitivity matters when AI systems inherit hidden risk from training data and connected repositories.
• Where taxonomy terms map to technical evidence, teams can align asset inventories and control testing with the NIST Cybersecurity Framework 2.0 instead of relying on inconsistent local labels.

In practice, the taxonomy should be embedded into intake forms, architecture review gates, and exception workflows so that the same language appears in approvals, logs, and audit trails.

Why It Matters in NHI Security

Shared AI taxonomy matters because NHI incidents often begin as a terminology failure: one team says a workload is a "bot," another treats it as a "service account," and a third assumes it is a low-risk internal tool. That mismatch affects how secrets are issued, how identity is monitored, and whether privileged actions are reviewed. In governance terms, a taxonomy becomes the bridge between AI behavior and NHI control design.

NHIMG research in The State of Secrets in AppSec reports that only 44% of developers follow security best practices for secrets management, which shows how easily inconsistent language turns into inconsistent handling. The same report also notes that organisations maintain an average of 6 distinct secrets manager instances, a fragmentation pattern that makes shared labels even more important for inventory and accountability.

Without a shared taxonomy, teams cannot reliably compare risk, evidence, or ownership across models, agents, and supporting credentials. Organisations typically encounter the cost of this confusion only after a breach review, at which point shared AI taxonomy becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Shared Responsibility Model
• How should security teams govern AI agents in shared workspaces?
• How should security teams govern shared AI agents that can inherit hidden proxy settings?
• When should organisations block a shared AI agent from production use?