speak the language

The agentic AI glossary

52 terms, defined in plain language, each linked to the guide that goes deep. Type to filter.

A2A (Agent2Agent)

An open protocol for delegation between agents built by different teams or vendors: task lifecycle, negotiation, and discovery (via Agent Cards) across trust boundaries. Stable since v1.0 and hosted by the Agentic AI Foundation. Protocol stack →

AG-UI

An open event-based protocol connecting agent backends to user-facing frontends: streaming state, intermediate steps, and interactive components. Reached 1.0 in 2026. Protocol stack →

Agent

Software that uses an AI model to decide its next action at runtime — calling tools, checking results, iterating — instead of following a fixed script. Build the loop →

Agent harness

The code that wraps a model into an agent: the loop, tool dispatch, retries, and budgets. Frameworks are pre-built harnesses. Build vs buy →

Agent Skill (SKILL.md)

A folder with a SKILL.md file: a short description the agent always sees, plus instructions and scripts that load only when the task matches. An open format read by most coding agents (Claude Code, Codex, Copilot, Cursor and others). Write a skill →

Agentic AI

The engineering discipline around agents: connecting them to tools, orchestrating several of them, giving them memory, and keeping them safe, observable, and affordable.

Agentic AI Foundation (AAIF)

A Linux Foundation fund, formed in December 2025, that hosts open agent standards so no single vendor controls them. Its projects include MCP, A2A, AGENTS.md and goose.

AGENTS.md

A plain Markdown file at the root of a repo telling coding agents how to build, test, and behave in that project. A vendor-neutral convention hosted by the Agentic AI Foundation. Template →

Approval tier

The oversight level assigned to an agent action class — autonomous, act-then-audit, batch review, or pre-approval — chosen by reversibility and blast radius. HITL patterns →

Blast radius

How much damage one wrong agent action can cause before anyone intervenes. The key input, with reversibility, for choosing approval tiers.

CIMD (Client ID Metadata Document)

A JSON document, hosted at a URL the client controls, that identifies an MCP client to an authorization server. The 2026-07-28 MCP spec prefers it to Dynamic Client Registration, which is now deprecated. Migrate a server →

Context engineering

Deciding what goes into the context window each turn: instructions, tool results, retrieved memories, summaries. Techniques include loading skills and tool definitions only when needed. The successor discipline to prompt engineering. Memory patterns →

Context window

The maximum text a model can attend to in one call — the agent's working memory. Everything else must be engineered in via retrieval or memory.

Drift

Gradual change in an agent's behavior or performance over time — from model updates, prompt edits, or changing inputs — caught by continuously running evals.

Durable execution

The ability of a long-running agent task to survive process restarts and resume mid-trajectory, by checkpointing each step. The strongest single reason to adopt a framework. Long-running tasks →

Embedding

A vector of numbers representing the meaning of text, letting you find related content by geometric similarity. The engine inside retrieval and vector stores.

Eval (evaluation)

A repeatable test of agent behavior: golden tasks plus checks, run on every change, with pass/fail criteria defined in advance. Build a harness →

Fine-tuning

Further training a model on your data to change its behavior. Right for style and domain reasoning moves; wrong for injecting facts. Which to use →

Function calling / tool calling

The model emitting a structured request ("call get_order with id 1001") that your code may execute. The model requests; your code decides.

Gateway (LLM gateway)

A proxy in front of all model traffic providing routing, per-team keys, budgets, fallbacks, and usage records. The enforcement point for cost and access. FinOps for agents →

Golden task

A curated test case with a known-good outcome, used to detect regressions. Every production incident should become one. Eval tutorial →

Grounding

Tying model output to verifiable sources — retrieved documents, tool results — instead of parametric memory. The antidote to hallucination.

Guardrail

A deterministic check around model behavior: input validation, output schema enforcement, action allowlists. Guarantees, where prompts are only suggestions.

Hallucination

Confident model output not supported by its inputs or reality. Managed with grounding, structured outputs, and verification — not by asking nicely.

Hook

A script your agent tool runs automatically at a fixed point, such as before a tool call or after a file edit. Unlike an instruction, the model cannot skip it; in Claude Code, a pre-tool hook that exits with code 2 blocks the call. Hooks template →

Human-in-the-loop (HITL)

Architecture where humans approve, audit, or steer agent actions. Effective HITL spends scarce reviewer attention where it changes outcomes. Patterns that scale →

Knowledge graph

Entities and relationships stored as a graph, answering relational questions ("what depends on X?") that similarity search cannot. Memory patterns →

Lethal trifecta

One agent context combining private-data access, untrusted content exposure, and an exfiltration channel. Break at least one leg architecturally. Threat model →

LLM (large language model)

The reasoning engine agents are built on — Claude, GPT, Gemini at the frontier; Qwen, DeepSeek, Llama, Mistral, Gemma and gpt-oss among open-weights. How to choose →

LLM-as-judge

Using a model to grade another model's output against a rubric. Scales fuzzy evaluation, provided you routinely calibrate the judge against humans.

Local serving

Running open-weights models on your own hardware (llama.cpp, vLLM) behind an OpenAI-compatible endpoint — data residency by construction. Run agents locally →

MCP (Model Context Protocol)

The open standard connecting agents to tools, resources, and prompts — the USB port of agentic AI. Supported across major clients and vendors, and hosted by the Agentic AI Foundation. The current spec revision is 2026-07-28. Build a server →

MCP Apps

An official MCP extension that lets a tool return an interactive HTML view, rendered by the host in a sandboxed frame. It adds UI to tools without replacing their plain-text result. Radar call →

MCP server

A program exposing tools/resources/prompts over MCP. Also your natural control point for validation, redaction, and audit logging. Wrap an API safely →

Memory (agent memory)

What the system learns by operating — preferences, decisions, outcomes — persisted across sessions. Distinct from retrieval over reference docs. The four patterns →

Multi-agent system

Several role-specialized agents coordinated by an orchestrator. Split by role when context, focus, or ownership demands it — not for fashion. Build one bare →

Open-weights model

A model whose weights you can download and run yourself (Qwen, DeepSeek, Llama, Mistral, Gemma, gpt-oss families). "Open source" is often a looser claim — check the license.

Orchestrator

The agent that plans, delegates to sub-agents, and synthesizes results. A loop that starts other loops — and where control lives. Orchestration tutorial →

Paved road

The approved, easy default path for building agents in a team: sanctioned models, data rules, starter templates. Make the safe path the easiest one and most people will take it. One-page template →

Prompt injection

Malicious instructions hidden in content an agent reads — email, web pages, documents — that hijack its behavior. An untrusted-input problem the model alone cannot solve. Working threat model →

Quantization

Compressing model weights to fewer bits (e.g. Q4) to fit smaller hardware, trading a little quality for a lot of memory. How 70B models run on desktops.

RAG (retrieval-augmented generation)

Fetching relevant documents at question time and giving them to the model as context. The right tool for facts that change and need citations. RAG vs memory vs tuning →

Scratchpad

Task-scoped working notes an agent maintains mid-job ("where was I?"). The cheapest memory pattern, and the one to build first.

Stateless MCP (2026-07-28 revision)

The MCP spec revision that removed the session handshake: each request carries its own protocol version and capabilities, and servers answer a server/discover call. Easier to scale behind load balancers. Good servers support both this and the older protocol. Migrate a server →

Structured output

Constraining model output to a schema (JSON with required fields) so downstream code can consume it without parse-and-pray. Make JSON reliable →

Sub-agent

A role-focused agent invoked by an orchestrator: own prompt, own tools, own context window. Returns conclusions, not transcripts.

System prompt

The standing instructions defining an agent's job, boundaries, and output contract — read every turn, and never a security control on its own. Template →

Token

The unit models read and emit (~¾ of an English word). Also the unit you pay in — which makes token flow an architectural concern. Metering spend →

Tool poisoning

Hiding malicious instructions in a tool's name, description, or schema, so the model is manipulated as soon as it reads the tool list. A rug pull is the same attack added later, after you approved the tool. Vet and pin the MCP servers you install. Supply-chain security →

Trajectory

The full sequence of one agent run: inputs, tool calls, results, and the outcome. The unit of agent debugging, evaluation, audit, and cost.

Vector store

A database indexing embeddings for fast similarity search (pgvector, Qdrant, Chroma…). The storage layer under RAG and retrieval memory.

Workflow engine

BPMN-style orchestration executing processes defined at design time. Deterministic paths belong here; dynamic reasoning belongs in agents. Workflow vs agent →