Plain words | The Agentic Enterprise Architecture Guide

Every technical term in this guide, explained for anyone in the organisation, with the group it belongs to.

If you read nothing else, read the six group headings below: agents and autonomy, control and security, data and knowledge, learning and quality, running it day to day, and standards and regulation. Together they are the vocabulary of the whole guide.

Agents and autonomy

Agent: Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it.
Agent platform: The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change.
Agent registry: The official list of agents: what each is for, who owns it, what it may touch, and which version is live.
Autonomy level (A0 to A5): How much an agent may do without a person in the loop, from manual (A0) to governed lights-out operation (A5). Set per task, not per agent.
Challenged default: A technology choice most people treat as obvious, re-examined here against the simplest credible alternative on evidence and cost.
Context window: The model's working memory for one task. It is limited in size, so what goes in and what gets left out is a design decision.
Cross-cutting concern: A requirement every layer must honour, such as identity, privacy, or cost, that no single team owns end to end.
Harness: The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails.
Layer (the fourteen layers): One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14).
Learning level (L0 to L3): How an agent's behaviour is allowed to change over time, from fixed (L0) to continuous learning inside guardrails (L3).
Model: The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do.
Multi-agent: Several agents splitting one job. It costs many times more than one agent and pays off only when the work is wide and the parts are independent.
Orchestration: Coordinating several agents or steps so they work together on one job. Useful for breadth; it does not make any single step smarter.
Plane (the seven planes): One of seven groups of capabilities in the agent system: execution, action, knowledge, control, improvement, evidence, and human. Planes are what you build; layers are what you already own.
Prompt: The instructions and information given to the model for a task. A prompt is advice to the model, not a control on it.
Sponsor and owner: The sponsor is the business person accountable for why an agent exists. The owner is the technical person who keeps it configured and secure.
Tool: A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems.
Two estates (metered and licensed): Metered: agent traffic that flows through your own gateway and can be fully governed. Licensed: agents inside vendor products that run on the vendor's controls, governed only through their settings and exports.
Workflow: A fixed sequence of steps written in code. Cheaper and more predictable than an agent, and preferred whenever the task allows.

Control and security

Agent identity: A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked.
Capability surface: Everything an agent can actually do: which systems it can read, write, send from, or appear in. Controls are chosen from this list, not from the product's name.
Deterministic: Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary.
Deterministic zone: One of four areas (access, money, safety actuation, formal records) where the final decision must come from fixed rules, never from a model.
Egress control: Rules about what a sandbox or agent is allowed to send out to the internet or to other systems.
Entitlement: A specific permission a person or agent holds in a system, such as the right to approve an invoice.
Gateway: The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded.
Guardrail: A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action.
Hallucination: When a model states something false with confidence. Grounding and refusal rules reduce it; verification catches the rest.
Just-in-time access: Access granted for a short window when it is needed, then withdrawn automatically.
Kill switch: A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it.
Least privilege: Giving an agent only the access its current task needs, and taking it back when the task ends.
Mandate (payments): A signed, scoped permission to spend: how much, with whom, for what, until when. The payment network checks it, and the agent cannot change it.
MCP (Model Context Protocol): An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug.
Policy decision point: The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.
Policy-as-code: Rules written as versioned code that a computer evaluates the same way every time, reviewed and deployed like any software change.
Probabilistic: Produces a best guess that can vary from run to run. AI models are probabilistic, which is why their output informs decisions rather than making them in the four zones.
Prompt injection: An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for.
Run-as-user: Making the agent operate inside a business system exactly as the requesting person would, with that person's permissions, so nothing is visible or changeable that the person could not see or change.
Sandbox: An isolated environment where agent code runs with limited access to the network and the rest of the machine, so mistakes and attacks stay contained.
SIEM: The security team's central system for collecting and analysing security events.
SOC (security operations centre): The team that watches for and responds to security incidents.
Token exchange (on-behalf-of): Swapping one credential for another so an agent acts with the permissions of the person who asked, not with its own broader powers.
Workload identity: Proof of who a piece of running software is, issued by the platform rather than typed in as a password. The machine equivalent of an ID badge.

Data and knowledge

ACL-aware retrieval: Retrieval that checks the requester's permissions before returning information, so an agent cannot surface documents its user could not open.
Agent memory: What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries.
API: A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens.
Aspect (of a document): One of the distinct things a document is about. An email that confirms a delivery date, flags a billing error, and asks for a contract change has three aspects; a question usually targets one of them.
BM25 (keyword search): The classic keyword ranking formula behind most search engines. It matches exact words, so it wins on names, codes, and quotations, where meaning-based search is weak.
Change data capture (CDC): Streaming each change in a database as it happens, so copies, including agent indexes, stay current.
Chunking: Splitting documents into pieces small enough for retrieval. How you split changes what the agent finds.
Classification (data): A label for how sensitive data is. Anything derived from data inherits the strictest label of its sources.
Curation: Preparing data for a specific purpose before agents use it, with a named owner responsible for its quality.
Data residency and sovereignty: Rules about which country or region data may be stored and processed in, including the copies created for agents.
Diversity selection (MMR, DPP, harvest): Rules for choosing which ten candidates to pass on so that they cover different sub-topics rather than repeating the top hit. MMR and DPP re-rank the whole list; the harvest keeps the most relevant head and spends a fixed quota on the least similar tail.
Embedding: A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from.
Entity resolution: Working out that records in different systems refer to the same real customer, asset, or case.
Erasure cascade: When a record is deleted, every copy derived from it (embeddings, memories, traces, test data) is deleted too.
ESB (enterprise service bus): An older central integration system that many companies still run.
Grounding: Making an agent answer from trusted company sources it can point to, and refusing when the evidence is weak.
Hybrid retrieval (reciprocal rank fusion): Running keyword search and meaning-based search side by side and merging the two ranked lists by rank position, so each covers the other's blind spots.
Instruction-following retriever: An embedding model trained so that a stated instruction (for example, only reports from outside the UK) changes what it ranks as relevant, instead of only the query words.
Lineage: The chain of steps data went through to reach its current form.
Multi-view (multi-card) embeddings: Giving one document several numeric fingerprints instead of one, each built from the text about one purpose (what is asked, what was promised, what went wrong), so a question about one aspect matches that aspect rather than a blurred average.
Pooled (single-vector) embedding: One numeric fingerprint for a whole document. Cheap and standard, but for a document about several things it is an average of all of them, so it matches each of them weakly.
Provenance: The record of where a piece of information came from, carried with it so every answer can be traced back to its source.
Relevance gate: A cheap first pass that scores every document against a few anchor phrases in embedding space and sets aside the off-purpose ones before any expensive processing. Discarded items are quarantined, not deleted.
Retrieval: Finding the few relevant pieces of company information for a task and placing them in front of the model.
RPA (robotic process automation): Older software bots that click through screens on fixed scripts. Kept alongside agents rather than replaced on day one.
Semantic layer: A shared set of business definitions (what counts as revenue, or an active customer) that keeps agents and reports using the same meaning.
Topic modelling: Grouping documents into themes automatically by clustering their embeddings, then naming each group. Here a model names and merges the groups from keyword lists; it never reads every document.
Vector index: A database of embeddings built for finding similar meaning fast. The storage behind most retrieval.

Learning and quality

Benchmark: A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements.
Canary release: Letting a small share of traffic (1 to 5 percent) use a change first, watching the results, then widening it.
Counterexample: A test case built from a real failure, used to prove that a proposed rule or change actually holds.
Coverage metrics (S-recall, alpha-nDCG): Scores that reward a result list for covering different sub-topics rather than repeating the same one. S-recall is the share of known sub-topics that appear in the top ten; alpha-nDCG discounts repeats.
Distillation: Teaching a smaller, cheaper model to imitate a larger one on a narrow task once enough good examples exist.
Eval (evaluation suite): A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.
Fine-tuning: Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step.
Judge (model judge): An AI model used to grade another model's answers at scale. Checked regularly against human graders, and never allowed to grade its own work.
Learning flywheel: The controlled loop that makes agents better over time: collect evidence, test, approve, roll out in stages, and pull back what fails.
Matched control: A comparison arm given the same budget as the method under test, here the same number of embeddings per document, so the experiment measures the idea rather than the extra capacity.
nDCG@10: A 0 to 1 score of how good the first ten search results are. It rewards putting the right documents near the top and counts every relevant document the judges marked. A difference of 0.03 is small but real on a few hundred queries; 0.2 is large.
p-MRR (instruction following score): A FollowIR benchmark score of whether a search system changes its ranking the right way when the instruction changes. Zero means the system ignores the instruction.
Paired permutation test (p-value): A statistical check that compares two systems query by query and asks how often a difference this large would appear by chance. A p-value of 0.0001 means almost never; 0.35 means the difference is within noise. Holm correction raises the bar when many comparisons run at once.
Promotion and demotion: Promotion moves a proven improvement into production. Demotion pulls it back out when it stops passing.
Reward hacking: When a model learns to score well on the measure rather than do the task. The reason measures are protected and humans spot-check.
Shadow mode: Running a change alongside production without it affecting anything, to see what it would have done.

Running it day to day

Budget envelope: A spending allowance for an agent with hard per-run caps and alarms, owned by its business sponsor.
Burst rate: Demand measured at its busiest moments rather than averaged over a day. Oversight capacity is planned against bursts.
Calibrated oversight: As operators gain experience they grant broader standing permission and also step in more often, rather than supervising less.
Containment versus resolution: Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution.
Cost per resolved outcome: What it costs to actually solve one case, including supervision time and the cost of wrong answers, rather than what one run costs.
Degraded mode: What a system does when a part fails. For agents, that means falling back to a human queue rather than guessing.
Durable execution: Running long jobs so they survive a crash or restart and pick up where they left off.
Evidence floor: The minimum records every production agent keeps: a registry entry, action logs, named oversight, and traceable sources.
Fan-out: How many agents or tasks one supervisor can watch at once, which shrinks as waiting times grow.
FinOps: The discipline of tracking and controlling cloud and AI spend and attributing it to the people who own it.
Latency: How long a request takes to come back.
Observability: Being able to see what agents did, step by step, from records the agent cannot alter.
Telemetry: The stream of measurements a system emits about itself, collected centrally.
Token: The unit AI usage is measured and billed in, roughly three-quarters of a word.
Trace: The step-by-step log of one agent run: what it read, what it called, and what it decided.

Standards and regulation

Attestation: A named person formally confirming that a record is true and taking responsibility for it. A model can draft; only a person can attest.
Digital twin: A simulation of a real asset or process, used to test a proposed action before it reaches the real thing.
EU AI Act: The European Union's AI regulation. Most duties fall on high-risk uses; this guide keeps an evidence floor for every agent and deeper records for the tier that could classify as high-risk.
OT (operational technology): The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop.
Safety instrumented system (SIS): Certified equipment that shuts a process down safely when limits are crossed. Standards exclude AI from it.
Validation loop: Checking an agent's proposal against rules or a simulation before a person sees it, so only options that pass are shown.

The research behind this page