Plain words

The glossary: every technical term in this guide in one plain sentence, grouped by theme, with a link to the page that explains it.

This guide is written for everyone who will work with agents, not only the people who build them. That includes leaders, managers, and specialists in finance, risk, legal and operations. Every technical word in the guide has a plain meaning. This page is the glossary. It gives each term in one plain sentence.

How terms work on the pages

A word with a dotted underline has a glossary entry. Hover over it, or tap it on a phone, to see its plain meaning. Where a term has its own page, the tooltip links to that page.

The main ideas get a real link the first time a page mentions them. Those ideas include the fourteen layers, the agent lifecycle and the seven capabilities. Each page also shows a row of related concepts, one click away.

The six groups

The entries fall into six groups:

agents and autonomy
control and security
data and knowledge
learning and quality
running it day to day
standards and regulation

Agents and autonomy

Agent: Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it.
Agent lifecycle: The nine stages an agent passes through: register, sponsor and owner, entitle, evaluate, approve, operate, change, periodic review, retire. The registry record carries it.
Agent platform: The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change.
Agent registry: The official list of agents: what each is for, who owns it, what it may touch, and which version is live.
Agentic OS: The runtime you buy plus the harness you build around it.
Autonomy level (A0 to A5): How much an agent may do without a person in the loop, from manual (A0) to governed lights-out operation (A5). Set per task, not per agent.
Build thin: A small agent that keeps no business rules of its own, so you can switch it off when a vendor agent covers the job.
Change trigger: A change that forces an agent to be re-evaluated and re-profiled before release: a new model, prompt, tool, permission, data source, memory policy, autonomy level or sponsor.
Context window: The model's working memory for one task. It is limited in size, so what goes in and what gets left out is a design decision.
Cross-cutting concern: A requirement every layer must honour, such as identity, privacy, or cost, that no single team owns end to end.
Designed, permitted and exercised autonomy: Three readings of one autonomy level: what the build allows, what the contract permits, and what the logs show the agent doing. Controls follow the higher of permitted and exercised.
Evaluation and release: How behaviour changes safely: evaluations, judges, promotion gates and staged release. One of the seven capabilities.
Harness: The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails.
Human oversight: Who decides and who answers for an agent. The EU AI Act's term, from Article 14, and the seventh of the seven capabilities.
Identity and policy: Who the agent is and what it may do: its identity, the registry, the policy decision point and its budget. One of the seven capabilities.
Impact (what the agent can damage): What an agent can damage: the deterministic zones it touches, whether it can delete anything, whether it shapes a decision about a person, whether the effect can be undone, and how far it reaches. With its permissions, impact sets the risk tier.
Layer (the fourteen layers): One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14). The layers are what you already own.
Learning level (L0 to L3): How an agent's behaviour is allowed to change over time: fixed (L0), curated learning (L1), reviewed learning (L2), continuous learning inside limits (L3).
Model: The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do.
Multi-agent: Several agents splitting one job. It costs many times more than one agent and pays off only when the work is wide and the parts are independent.
One Platform, Three Lanes: This guide's design for organising agent work: a thin technology office, one platform team, three delivery lanes (AI, cloud, integration), and agents owned by the business.
Orchestration: Coordinating several agents or steps so they work together on one job. Useful for breadth; it does not make any single step smarter.
Packaged application (COTS): Software bought and run largely as the vendor ships it, such as billing, finance or customer systems. You cannot rewrite it, so ask whether the process sits inside one package or across several, and whether the vendor has a shipped agent on your edition.
Prompt: The instructions and information given to the model for a task. A prompt is advice to the model, not a control on it.
Release state: One version's release status: draft, approved, published, deprecated or retired. Draft and approved fall in the evaluate and approve stages of the lifecycle; published means the registry state active.
Role (what the agent does for people): What an agent does for people: converse, create, assist or coordinate, plus the business area it works in. A label only. It grants nothing and sets no controls.
Runtime: Where agents run: sandboxes, sessions that survive a pause, and model serving. The first of the seven capabilities.
Sponsor and owner: The sponsor is the business person accountable for why an agent exists and whether it keeps running. The owner is the technical person who keeps it configured and secure.
The seven capabilities: What an agent platform provides and every lifecycle stage calls on: a runtime, a tool gateway, knowledge and memory, identity and policy, evaluation and release, observability and an audit trail, and human oversight. The fourteen layers are what you own; these are what you add.
Tool: A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems.
Workflow: A fixed sequence of steps written in code. Cheaper and more predictable than an agent, and preferred whenever the task allows.
Your own agents and vendor-embedded agents: Agents you build run through your own gateway, so you can govern every action. Agents embedded in vendor products run on the vendor's platform, so you govern them only through its settings and the records it exports.

Control and security

Abuse case: One way an attacker could use an agent's permissions to cause a harmful effect.
Agent identity: A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked.
Agent user account: A directory account that makes an agent addressable like a colleague: a mailbox, a seat in a meeting, a place in the org chart. Granted rarely, because it widens what the agent can reach.
Delegation chain: The record that traces every agent action back to the person who asked: who delegated, to which agent, with which permissions, for which task. Built from the agent's own identity and short-lived tokens exchanged at the gateway.
Destruction rule: Deleting or resetting production data or systems is its own rule, never part of a wider permission. The agent proposes, a fixed system applies after a named person approves that exact action, and backups sit where the agent cannot reach them.
Deterministic: Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary.
Deterministic zone: One of four areas (access, money, safety actuation, formal regulatory records) where the final decision comes from a fixed rule or a named person, never from a model.
Egress control: Rules about what a sandbox or agent is allowed to send out to the internet or to other systems.
Entitlement: A specific permission a person or agent holds in a system, such as the right to approve an invoice.
Gateway: The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded.
Guardrail: A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action.
Hallucination: When a model states something false with confidence. Grounding and refusal rules reduce it; verification catches the rest.
Identity levels (ID1 to ID3): Shared credentials (ID1), the agent's own identity (ID2), and the agent's own identity plus an agent user account (ID3). ID2 is the production minimum.
Invariant: A rule about an outcome that must stay true whatever the model does.
Just-in-time access: Access granted for a short window when it is needed, then withdrawn automatically.
Kill switch: A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it.
Least privilege: Giving an agent only the access its current task needs, and taking it back when the task ends.
Mandate (payments): A signed, scoped permission to spend: how much, with whom, for what, until when. The payment network checks it, and the agent cannot change it.
MCP (Model Context Protocol): An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug.
Permissions (what its credentials let it do): Everything an agent's own credentials let it do: read, write, delete, run code, browse, send, pay, change access or actuate. Plus three flags: whether it takes untrusted input, the most sensitive data it can reach, and whether it writes long-term memory. Controls follow this list, not the product's name, and the list is scored again on every new tool grant.
Plan-then-apply: The agent writes a plan; a deterministic system carries it out after approval. The agent never holds the authority to change production directly.
Policy decision point: The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.
Policy-as-code: Rules written as versioned code that a computer evaluates the same way every time, reviewed and deployed like any software change.
Probabilistic: Produces a best guess that can vary from run to run. AI models are probabilistic, which is why their output informs decisions rather than making them in the four zones.
Prompt injection: An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for.
Risk tier: One of three levels, Tier 1 (basic), Tier 2 (enhanced) or Tier 3 (strict), set by the worst of nine factors. The tier picks the controls, who signs, and how often the agent is reviewed.
Rule of Two: One session should hold at most two of three things: untrusted input, sensitive data, and the power to change state or send things out. All three together means a person approves each action.
Run-as-user: Making the agent operate inside a business system exactly as the requesting person would, with that person's permissions, so nothing is visible or changeable that the person could not see or change.
Sandbox: An isolated environment where agent code runs with limited access to the network and the rest of the machine, so mistakes and attacks stay contained.
SIEM: The security team's central system for collecting and analysing security events.
SOC (security operations centre): The team that watches for and responds to security incidents.
The rule for decisions about people: When an agent makes or shapes a significant decision about a person, such as credit, work, benefits, health, housing or hardship, a named person with authority to change the outcome decides. The person affected gets the notice the law requires, and the decision is logged with the model's inputs.
Token exchange (on-behalf-of): Swapping one credential for another so an agent acts with the permissions of the person who asked, not with its own broader powers.
Workload identity: Proof of who a piece of running software is, issued by the platform rather than typed in as a password. The machine equivalent of an ID badge.
Zone register: The signed list of every zone action and who decides it.

Data and knowledge

ACL-aware retrieval: Retrieval that checks the requester's permissions before returning information, so an agent cannot surface documents its user could not open.
Agent memory: What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries.
API: A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens.
Aspect (of a document): One of the distinct things a document is about. An email that confirms a delivery date, flags a billing error, and asks for a contract change has three aspects; a question usually targets one of them.
BM25 (keyword search): The classic keyword ranking formula behind most search engines. It matches exact words, so it wins on names, codes, and quotations, where meaning-based search is weak.
Business definitions (semantic layer): One set of business definitions that every reporting agent uses, so two agents never compute revenue two ways.
Change data capture (CDC): Streaming each change in a database as it happens, so copies, including agent indexes, stay current.
Chunking: Splitting documents into pieces small enough for retrieval. How you split changes what the agent finds.
Classification (data): A label for how sensitive data is. Anything derived from data inherits the strictest label of its sources.
Curation: Preparing data for a specific purpose before agents use it, with a named owner responsible for its quality.
Data residency and sovereignty: Rules about which country or region data may be stored and processed in, including the copies created for agents.
Diversity selection (MMR, DPP, harvest): Rules for choosing which ten candidates to pass on so that they cover different sub-topics rather than repeating the top hit. MMR and DPP re-rank the whole list; the harvest keeps the most relevant head and spends a fixed quota on the least similar tail.
Embedding: A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from.
Entity resolution: Working out that records in different systems refer to the same real customer, asset, or case.
Erasure cascade: When a record is deleted, every copy derived from it (embeddings, memories, traces, test data) is deleted too.
ESB (enterprise service bus): An older central integration system that many companies still run.
Grounding: Making an agent answer from trusted company sources it can point to, and refusing when the evidence is weak.
Hybrid retrieval (reciprocal rank fusion): Running keyword search and meaning-based search side by side and merging the two ranked lists by rank position, so each covers the other's blind spots.
Instruction-following retriever: An embedding model trained so that a stated instruction (for example, only reports from outside the UK) changes what it ranks as relevant, instead of only the query words.
Lineage: The chain of steps data went through to reach its current form.
Long-term memory: What an agent keeps for later tasks. Once kept, it is a record with ownership, consent, retention and deletion duties.
Multi-view (multi-card) embeddings: Giving one document several numeric fingerprints instead of one, each built from the text about one purpose (what is asked, what was promised, what went wrong), so a question about one aspect matches that aspect rather than a blurred average.
Pooled (single-vector) embedding: One numeric fingerprint for a whole document. Cheap and standard, but for a document about several things it is an average of all of them, so it matches each of them weakly.
Provenance: The record of where a piece of information came from, carried with it so every answer can be traced back to its source.
Relevance gate: A cheap first pass that scores every document against a few anchor phrases in embedding space and sets aside the off-purpose ones before any expensive processing. Discarded items are quarantined, not deleted.
Retrieval: Finding the few relevant pieces of company information for a task and placing them in front of the model.
RPA (robotic process automation): Older software bots that click through screens on fixed scripts. Kept alongside agents rather than replaced on day one.
Thread memory: Keeps one case or conversation going across a pause, so the agent resumes where it stopped.
Topic modelling: Grouping documents into themes automatically by clustering their embeddings, then naming each group. Here a model names and merges the groups from keyword lists; it never reads every document.
Vector index: A database of embeddings built for finding similar meaning fast. The storage behind most retrieval.

Learning and quality

Benchmark: A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements.
Canary release: Letting a small share of traffic (1 to 5 percent) use a change first, watching the results, then widening it.
Counterexample: A test case built from a real failure, used to prove that a proposed rule or change actually holds.
Coverage metrics (S-recall, alpha-nDCG): Scores that reward a result list for covering different sub-topics rather than repeating the same one. S-recall is the share of known sub-topics that appear in the top ten; alpha-nDCG discounts repeats.
Distillation: Teaching a smaller, cheaper model to imitate a larger one on a narrow task once enough good examples exist.
Eval (evaluation suite): A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.
Fine-tuning: Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step.
Judge (model judge): An AI model used to grade another model's answers at scale. Checked regularly against human graders, and never allowed to grade its own work.
Learning flywheel: The controlled loop that makes agents better over time: collect evidence, test, approve, roll out in stages, and pull back what fails.
Matched control: A comparison arm given the same budget as the method under test, here the same number of embeddings per document, so the experiment measures the idea rather than the extra capacity.
nDCG@10: A 0 to 1 score of how good the first ten search results are. It rewards putting the right documents near the top and counts every relevant document the judges marked. A difference of 0.03 is small but real on a few hundred queries; 0.2 is large.
p-MRR (instruction following score): A FollowIR benchmark score of whether a search system changes its ranking the right way when the instruction changes. Zero means the system ignores the instruction.
Paired permutation test (p-value): A statistical check that compares two systems query by query and asks how often a difference this large would appear by chance. A p-value of 0.0001 means almost never; 0.35 means the difference is within noise. Holm correction raises the bar when many comparisons run at once.
Promotion and demotion: Promotion moves a proven improvement into production. Demotion pulls it back out when it stops passing.
Reward hacking: When a model learns to score well on the measure rather than do the task. The reason measures are protected and humans spot-check.
Shadow mode: Running a change alongside production without it affecting anything, to see what it would have done.

Running it day to day

Agent budget: A spending allowance for an agent with hard caps per run and alarms, owned by its business sponsor.
Audit trail baseline: The minimum records every production agent keeps: a registry entry, action logs collected where the agent cannot write, named oversight, and sources it can be traced back to. High-risk uses keep the deeper records the EU AI Act asks for.
Burst rate: Demand measured at its busiest moments rather than averaged over a day. Oversight capacity is planned against bursts.
Calibrated oversight: As operators gain experience they grant broader standing permission and also step in more often, rather than supervising less.
Containment versus resolution: Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution.
Cost per resolved outcome: What it costs to actually solve one case, including supervision time and the cost of wrong answers, rather than what one run costs.
Customer edge: The parts only a customer-facing agent needs: channels, AI disclosure, hand-over to a person, hardening, and a record of what was said.
Degraded mode: What a system does when a part fails. For agents, that means falling back to a human queue rather than guessing.
Discriminator: The one test that separates the options in a decision record, applied to your own case.
Durable execution: Running long jobs so they survive a crash or restart and pick up where they left off.
Evidence level: One of two levels of records: the audit trail baseline for every production agent, and EU AI Act record keeping for agents that could be high-risk.
FinOps: The discipline of tracking and controlling cloud and AI spend and attributing it to the people who own it.
Latency: How long a request takes to come back.
Observability: Being able to see what agents did, step by step, from records the agent cannot alter.
Oversight capacity: How much exception work people can clear in time, measured in the busiest ten minutes rather than on an average day.
Span of control: How many agents or tasks one person can supervise at once. It shrinks as waiting times grow.
Supervision gate: Before managed autonomy (A4), people must be able to keep up with the agent's exceptions at the busiest ten minutes, not on an average day.
Support level: How much help a team gets when it builds an agent: self-serve, assisted or reviewed. It is separate from the agent's risk tier.
Telemetry: The stream of measurements a system emits about itself, collected centrally.
Token: The unit AI usage is measured and billed in, roughly three-quarters of a word.
Trace: The step-by-step log of one agent run: what it read, what it called, and what it decided.

Standards and regulation

Attestation: A named person formally confirming that a record is true and taking responsibility for it. A model can draft; only a person can attest.
Digital twin: A simulation of a real asset or process, used to test a proposed action before it reaches the real thing.
Enterprise asset management (EAM): The system of record for equipment, notifications, work orders and maintenance history.
EU AI Act: The European Union's AI regulation. Most duties fall on high-risk uses; this guide keeps an evidence floor for every agent and deeper records for the tier that could classify as high-risk.
FHIR: The HL7 standard health systems use to exchange records through web interfaces.
Information path and control path: Agents may read, check and draft (the information path). They never move equipment (the control path). A person or a certified system makes every physical change.
Metal accounting: Balancing tonnes and grade across a mine's process to produce the official production figure.
Multidisciplinary meeting (MDT): A meeting where specialists decide a patient's treatment together.
OT (operational technology): The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop.
Process historian: The system that stores every plant sensor reading over time.
Read broker: A service in the network between plant and business systems that serves plant data to agents, read only.
Safety instrumented system (SIS): Certified equipment that shuts a process down safely when limits are crossed. Standards exclude AI from it.
Validation loop: Checking an agent's proposal against rules or a simulation before a person sees it, so only options that pass are shown.

Next step: return to Start here or the architecture overview.

Explore this topic