Definitions for the words that actually come up when you are evaluating an AI business platform in India. Where a term is commonly misunderstood, we say what it is not.
India data protection
Data Fiduciary
The organisation that decides why and how personal data is processed. Under India's DPDP Act the Data Fiduciary carries the obligations to the individual — not its vendors. If your CRM cannot delete a person's record, that remains your problem, not your CRM's. What to ask your vendors →
Data Principal
The individual whose personal data is being processed — the person the obligations exist to protect. India's DPDP Act uses this term where GDPR says 'data subject'.
Significant Data Fiduciary (SDF)
A Data Fiduciary designated by the government as carrying heavier obligations, based on the volume and sensitivity of the data it handles. SDFs face additional duties including data protection impact assessments, an independent audit, and a named Data Protection Officer. No public numeric threshold defines designation.
Consent Manager
A registered intermediary that gives people one place to grant, review and withdraw consent across the organisations they deal with. It is a licensed role, not a compliance feature: the DPDP Rules require a Consent Manager to be a company incorporated in India with net worth of at least two crore rupees. Ordinary businesses are Data Fiduciaries and do not register as Consent Managers. Why you're probably not one →
Purpose limitation
The principle that personal data may be held only for the purpose the person consented to, and no longer. It applies to every Data Fiduciary from the start, and in practice it is a stricter retention test than any fixed time limit — it asks why you still hold something, rather than how long you have held it. Building a retention workflow →
Data localisation
A requirement to keep data physically inside a country. India's DPDP Act does not impose one generally: it permits transfer abroad by default and lets the government restrict named destinations — a negative list rather than an adequacy list. Sectoral regulators such as the RBI can and do impose stricter localisation within their domains. What DPDP actually requires →
AI agents
AI agent
Software that carries out multi-step work on your systems, rather than only answering questions about them. The distinction that matters commercially is whether it can execute — create the record, send the message, update the deal — or only draft something a human then does. How agents fit the platform →
AI assistant or copilot
An AI feature that suggests, summarises or drafts inside an existing interface, leaving execution to the person. Useful, but a different category from an agent — and the word 'agent' is now applied to both, so ask any vendor to demonstrate execution rather than accepting the label.
Agentic AI
A system where AI plans and takes actions toward a goal across multiple steps and tools, instead of responding turn by turn. The governance questions — what it may touch, what needs approval, what gets logged — matter more than the capability claim.
Human-in-the-loop (approval gate)
A control requiring a person to approve an agent action before it commits. The practical test is which actions are gated by default: if an agent can write to customer records without one, the gate is decorative. Our security model →
Agent audit log
An immutable record of every action an AI agent took — what it did, on whose authority, against which record. It is the difference between being able to answer 'what did the agent do last week' and hoping the question is never asked. The part vendors skip →
Shared memory
Agents reading and writing the same records as the people they work alongside, rather than keeping a private copy of context. Without it, an agent's view of a customer drifts from the team's, and the drift is invisible until it produces a wrong answer. How agents remember →
Platform architecture
Shared data model
One schema underneath every function, so the customer record sales edits is the same row support and any AI agent read. There is no sync because there is no second copy. Contrast with a suite, where separately-built applications share a login and a bill but keep their own data models. How KaryaFlow is built →
AI operating system
A platform where business functions and AI agents run on one shared data model, so agents can act across the whole business rather than inside one application's slice. The term is a category claim rather than a standard — the useful test is whether adding a function adds a subscription. A working definition →
SaaS sprawl
The accumulation of overlapping SaaS tools, each with its own data model, contract and integration surface. The cost people notice is the invoices; the cost that hurts is that no system holds the whole picture, so both people and AI act on partial information. The consolidation guide →
All-employee pricing
A licensing model requiring a licence for every employee in the company, whether or not they use the software, usually in exchange for a lower headline rate. Zoho One offers this alongside a flexible per-user plan; whether it is cheaper depends entirely on how many of your people actually need access. The licensing math →
