Glossary A2A (Agent2Agent): Open protocol that lets agents from different vendors discover each other through Agent Cards and delegate tasks over standard web transports. MCP connects an agent to tools; A2A connects agents to one another. Agent: A system in which a language model uses tools in a loop to reach a goal, choosing its own next steps. It differs from a workflow, where your code fixes the path in advance. Agent Card: A JSON description that an A2A agent publishes about itself: its name, the skills it offers, the address to reach it and how to authenticate. Other agents read it to discover what the agent can do before they delegate a task. Agentic AI: Umbrella term for AI systems that pursue goals with some autonomy by planning and taking actions, rather than only answering questions. Agentic AI Foundation (AAIF): A foundation under the Linux Foundation, formed in December 2025, that hosts open agent projects, among them MCP and AGENTS.md. It gives shared standards a neutral home outside any single company. Agentic coding: Developing software by directing a coding agent that reads the project, edits files, runs tests and iterates, while the developer sets goals, reviews changes and decides. It differs from autocomplete, which only suggests the next lines. Agentic RAG: Retrieval used as a tool inside the agent loop, so the agent decides when and what to retrieve and can refine its queries. It handles questions that one search cannot answer, at the price of extra model calls. Agentic search: Finding information with ordinary tools (list files, grep, read, web search) step by step, instead of a pre-built index. It needs no indexing and always sees the current state, but it uses more steps. Agent loop: The cycle that turns a model into an agent: look, act, see the result, repeat. Agent SDK: A software library that provides the parts of an agent so you do not build them from scratch: the loop, tool calling, context handling, guardrails, hand-offs and tracing. Model vendors and independent projects both publish them; the choice mostly decides how much of the loop you control yourself. AGENTS.md: An open, cross-tool Markdown file of instructions for coding agents, placed in a repository. It holds what an agent cannot guess, such as how to build and test, conventions and what to avoid. Agent teams: Several full agents coordinated by a lead that share a task list and message each other, unlike sub-agents, which only report back to their caller. AI assistant: A system that helps a person with tasks on request, using a language model plus some tools and context. Copilot is a common name for an assistant built into an application that suggests while the person stays in control; an agent is instead given a goal and acts on its own. AI browser: A web browser with an AI agent built in, which reads pages and can click, fill in forms and carry out multi-step tasks for the person. It acts inside the person's signed-in sessions, so indirect-prompt-injection from web pages is its main risk. AI search: Search that retrieves sources and has a language model write a direct answer with citations, rather than only listing links. It combines rag with a search index, and its quality depends on retrieval, source quality and checking the citations. Alignment: Making an AI system pursue the goals and values its builders and users intend, and behave safely when instructions are incomplete or in conflict. In practice it covers training methods such as RLHF, testing for bad behaviour, and research into why models act as they do. API: A defined way for one piece of software to ask another to do something, usually as an HTTP request that returns structured data, as in a REST API. Most agent tools are thin wrappers around APIs, and most models are used through one. Approval fatigue: The habit of clicking approve without reading when an agent asks for permission too often. Constant prompts teach people to say yes, which defeats the check. Better designs ask rarely, for risky actions, and make safe actions automatic inside a sandbox. Attention: The mechanism in a transformer that lets each token weigh every other token in the context when deciding what comes next. It is how a model links a pronoun to its noun, or an instruction to a detail far earlier in the text. Audit log: A tamper-resistant, time-ordered record of who or what did what: each tool call, approval, access and change an agent made. It supports investigation, compliance and accountability, and should be kept where the agent itself cannot edit it. Autonomous agent: An agent that carries out a long task on its own, deciding steps and using tools with little or no human input along the way. Autonomy is a dial, not a switch: more of it saves effort and also raises the cost of a mistake, so it is paired with permissions and limits. Background agents & triggers: A background agent starts on its own, works while nobody watches and reports back when it is done. Batch processing: Sending many requests together for asynchronous processing instead of waiting for each answer. Providers often offer batch interfaces at a discount, with results returned within hours, which suits large jobs that are not urgent, such as classifying a backlog. Benchmark: A public, standardised set of tasks used to compare models or agents. Scores are useful for a first shortlist but say little about how a model will do on your own work, so test candidates on your own examples. Benchmark contamination: When test questions or their answers have leaked into a model's training data, so that its score reflects memory and not ability. It inflates public benchmark results, and is one reason to evaluate on private examples of your own. Browser agent: An agent that works in a web browser: it loads pages, reads their content or a screenshot, clicks, types and fills in forms to finish a task. It can use any website without an API, but it is slower and is exposed to prompt injection from page content. Chain of thought: The intermediate reasoning steps a model writes before its final answer. Writing the steps out gives the model room to work through a problem, which usually improves accuracy on maths, logic and planning. Chatbot: A program that holds a conversation in text or speech. Older chatbots followed scripts and decision trees; today the word usually means a language-model assistant that answers in a chat window and, unlike an agent, normally only talks and does not act. Checkpoint: A saved snapshot of an agent's state, such as the conversation and the changes made to files, so that a run can resume after a failure or be rolled back to an earlier point. It makes long runs recoverable and mistakes reversible. Chunking: Splitting documents into smaller pieces, called chunks, before embedding and indexing them. Chunks must be small enough to be specific and large enough to make sense alone; common choices split by heading or paragraph, often with some overlap. Citation: A reference that points from a claim in an answer to the source it came from, such as a link, a page or a passage. Citations let a reader verify the answer, but they must be checked: a model can cite a source that does not support the claim. Code execution: A tool that lets a model write and run code in an isolated environment and read the output. It adds exact calculation, data analysis and file handling that text prediction alone cannot give, and it must run in a sandbox because the model wrote the code. Coding agent: An agent specialised in software work: it reads and edits code, runs commands and tests, and opens pull requests. Tests give it a clear signal of success, which is one reason coding was an early use for agents. Coding assistant: A tool inside an editor or terminal that helps write code: completions, questions about the codebase, explanations and edits the developer accepts. It is the less autonomous end of a range that runs up to a coding-agent. Compaction: Summarising older parts of a conversation so that a long run keeps fitting into the context window. The summary keeps decisions and open items and drops detail, so what is lost is a trade-off to design for. Computer use: A model operating a graphical interface by looking at screenshots and sending mouse and keyboard actions. It works with any application, even without an API, but is slower and less reliable than calling a tool directly. Confused deputy: A security flaw in which a program with legitimate authority is tricked by a less privileged party into using that authority on its behalf. An agent holding a person's credentials and steered by a malicious page or message is a classic case. Connector: A ready-made integration, usually an MCP server, that links an AI app to a service such as a drive, a calendar or a CRM. Setting one up normally means signing in and granting it access to that account. Constitutional AI: A training method published by Anthropic in which a model critiques and revises its own answers against a written list of principles, the constitution, and is then trained on the improved answers and on AI-generated preference labels. It reduces the need for people to label harmful content. Container: A lightweight isolated environment that packages a program with its dependencies and gives it a private view of files, processes and network. Agents use containers as a sandbox; they start fast, but they share the host's kernel, so their isolation is weaker than a virtual machine's. Context engineering: Curating the full set of tokens a model sees at each step: instructions, tools, knowledge, history and results. The aim is the smallest set of information that makes the right answer likely. Context rot: The decline in a model's accuracy as its context grows longer and noisier. Relevant details get harder to find among the clutter, so more context is not always better. Context window: The context is everything the model sees in one request; the context window is its size limit. Cost & providers: AI is billed per token: the small pieces of text that go in and come out. Cron (scheduled task): A scheduler that starts a job at fixed times, such as every weekday at eight; the name comes from the Unix tool cron. Scheduled agent runs use it for recurring work like reports, checks and clean-ups, with nobody present to start them. Customer-service agent: An agent that handles support requests: it reads the customer's message, looks up the account and policies, answers or takes actions such as a refund, and hands over to a person when unsure or when the case is sensitive. Success is measured by resolution rate, quality and escalations. DAG (directed acyclic graph): A graph whose steps are joined by one-way arrows that never loop back. Workflow engines use a DAG to say which steps depend on which, so independent steps run in parallel and each runs once its inputs are ready. Agent loops are not DAGs, because they repeat. Data agent: An agent that answers questions about an organisation's data: it writes and runs queries or code, reads the results and explains them, often with charts. Reliability depends on a clear data model, access limits and checking the queries it ran. Data exfiltration: Getting private information out of a system to a place the owner did not intend. With agents it usually means a hidden instruction makes the agent send secrets out through a request, a link, an image or a message. Debate: Having several model instances argue for different answers over a few rounds, with a judge or a vote choosing the outcome. It can surface errors a single attempt misses, but it multiplies cost and does not guarantee that the right answer wins. Deep research: Long-running agentic search that reads many sources and synthesises a report with citations. It trades minutes of waiting and many tokens for breadth, and its claims still need checking against the sources. Diffusion model: A generative model that learns to turn random noise into an image, audio or video by removing noise step by step, guided by a text description. It is the basis of most image generators; text models mostly use transformers instead. Distillation: Training a smaller student model to imitate the outputs of a larger teacher model. The student keeps much of the teacher's quality at a fraction of the size, cost and delay. Drift: A gradual change in a system's behaviour or in the world it works in, so that quality declines without any change of your own. Causes include a provider updating a model, shifting questions and outdated knowledge; regular evals on fresh samples catch it. Durable execution: A way of running long workflows so that progress is saved after each step and the run survives crashes, restarts and waits of days. After a failure it resumes where it stopped, and finished steps are not repeated. Long-running agents need it to be reliable. Effort: A setting that tells a model how much reasoning, and therefore how many tokens, to spend on a task. Higher effort suits hard, multi-step problems; lower effort is faster and cheaper for simple ones. Egress filtering: Controlling which destinations a system may send traffic to, usually with an allowlist of approved domains. For an agent in a sandbox it closes the main route for stolen information to leave, even when the agent has been tricked. Embedding: A vector of numbers that represents the meaning of a piece of text, an image or code, placed so that similar meanings lie close together. It lets software compare meaning by measuring distance. EU AI Act: The European Union's law that regulates AI by risk level: some uses are banned, high-risk uses face strict duties, and some systems must be transparent, for example by telling people they are talking to an AI. It entered into force in 2024 and its duties apply in stages. Evals & observability: Evals are tests for AI: real tasks with clear pass or fail criteria. Evaluator-optimizer: A workflow in which one call generates and another critiques, repeating until the result passes. It works best when the critic has clear criteria or an objective check. Event trigger: A rule that starts an agent or workflow when something happens, such as a new email, a pull request or a payment. Events usually arrive as webhooks, HTTP calls that one service sends to another, so the agent reacts within moments and does not need to poll. Fan-out: Sending one task out to many parallel workers or model calls, then gathering ('fan-in') their results. It cuts the waiting time of broad jobs such as searching many sources, at the price of more tokens in total. Few-shot prompting: Putting a few worked examples of the task into the prompt so that the model copies their format and style. With no examples it is called zero-shot, with one, one-shot. Examples often steer output more reliably than a description alone. Fine-tuning: Further training of a model's weights on your own examples, so that its behaviour changes for good and not only for one request. It is usually tried after better instructions, context and tools, since those are cheaper to change and to undo. Foundation model: A large model trained on broad data so that it can be adapted to many tasks, through prompting, fine-tuning or tools. Language models are the best-known kind; others handle images, audio, video or several at once. Function calling: Another name for tool use: the model returns a structured request to call a named function with arguments, which your code executes, and the result is sent back to the model. Generative AI: AI that creates new content, such as text, images, audio, video and code, rather than only classifying or predicting a label. Language models and diffusion models are its main kinds. Golden set: A curated set of inputs with known good answers or accepted criteria, used to measure a system every time it changes. It is built from real cases, kept stable, and grown whenever a new failure turns up. Governance & regulation: Governance means the policies, records and legal duties around using AI in an organisation. Grounding: Tying a model's answer to supplied sources, such as retrieved passages, tool results or search hits, rather than to its memory alone. A grounded answer can be checked against what was supplied, and grounding is a main defence against hallucination. Guardrails: Checks around a model or agent that block or correct unsafe, off-topic or malformed inputs and outputs. They can be rules, classifiers or other models, and work best as one layer among several, not as the only defence. Hallucination: A confident but false or unsupported statement produced by a model, such as an invented fact, a made-up quotation or a function that does not exist. It happens because the model predicts plausible text and has no built-in check of truth. Handoff: Passing control of a task from one agent to another, with the context it needs, for example from a general agent to a specialist, or from an agent to a person. A clean handoff carries the goal, the current state and what has already been tried. Harness (the agent app): The harness is the app around the model: it runs the agent loop and does what the model cannot. Hooks & guardrails: Hooks are small programs the harness (the app around the model) runs automatically at fixed moments. Guardrails check what goes into and comes out of the model. Human-in-the-loop: Explicit points where a person approves, corrects or takes over an agent's work. Human oversight is most valuable at actions that are costly or hard to undo, and least valuable when approvals are so frequent that nobody reads them. Hybrid search: Combining keyword search, which finds exact words and names, with semantic search, which finds similar meaning, and merging the two result lists. Each catches what the other misses, so hybrid search usually beats either alone. In-context learning: A model's ability to pick up a task from instructions and examples placed in its context, without any change to its weights. The learning lasts only for that request: the next request starts from the same unchanged model. Indirect prompt injection: Prompt injection where the malicious instruction does not come from the person but is hidden in content the agent reads: a web page, an email, a document or a tool result. It is the main practical risk of agents that read untrusted content. Inference: Running a trained model to produce output, as opposed to training it. Every request is an inference call, and its cost and speed depend on model size, context length and output length. Most of the ongoing expense of an AI product is inference. Instruction files: Instruction files hold standing rules in plain text. The harness puts them in the context at the start of every new chat or job. Interpretability: Research into how a model computes its answers, by examining its internal activations and circuits rather than only its outputs. The aim is to explain, and eventually verify, why a model does what it does; today it gives partial insight, not full explanations. ISO/IEC 42001: An international standard, published in 2023, for an AI management system: the policies, roles, risk processes and controls an organisation sets up to develop or use AI responsibly. Organisations can be audited and certified against it. Jailbreak: A prompt crafted to make a model ignore its safety training or rules and produce content it would normally refuse. Providers patch known jailbreaks but new ones keep appearing, so refusals are not a reliable security control. JSON-RPC: A small protocol for calling remote functions by sending JSON messages that carry a method name, parameters and an id, and receiving a result or an error. MCP uses JSON-RPC 2.0 for the messages between client and server. Knowledge cutoff: The date after which a model has seen no training data, so it knows nothing about later events unless they are given in the context or fetched by search. Models are usually released months after their cutoff, and used for a long time after that. Knowledge graph: A store of facts as entities and the relationships between them, such as a person who works at a company. Queries can follow links across several steps, and GraphRAG uses such a graph, often built by a model from text, to retrieve connected facts and not only similar passages. KV cache (key-value cache): Memory in which a model keeps the intermediate attention results, the keys and values, of tokens it has already processed, so it does not recompute them for every new token. It makes generation fast, and it is what prompt-caching reuses across requests. Language model (LLM): A program trained on huge amounts of text to predict what comes next. It reads and writes text, piece by piece. Latency: How long a system takes to respond. For models it is usually split into the time to the first token and the speed of generation after that. Latency rises with context length, reasoning effort and the number of tool calls, and it is traded against quality and cost. Least privilege: The rule that something gets only the access it needs for its task, and only for as long as it needs it. For agents that means narrow tool lists, read-only access where possible and short-lived credentials, so a mistake or an attack can do limited harm. Lethal trifecta: A name for the dangerous combination of three things in one agent: access to private data, exposure to untrusted content and a way to communicate outside. With all three, a hidden instruction can steal the data. Removing any one of them breaks the attack. LLM-as-judge: Using a language model to grade another model's output against a rubric, for example for correctness, helpfulness or tone. It scales to cases that no exact check can score, but it needs calibration against human ratings, since judges tend to favour longer answers and their own style. Long context: The ability of a model to take very large inputs, from hundreds of thousands of tokens up to a million or more, in one request. It lets a model read a whole codebase or report at once, but cost grows with length and accuracy on details can still drop. Long-horizon task: A task that takes many steps, often hours of work, with later steps depending on earlier ones. Small errors compound over such a task, so it needs planning, memory, checkpoints and regular checks, and it is where agents most often fail. Long-term memory: Information an agent keeps across sessions, stored outside the context window in files, notes or a database and loaded back when relevant. It lets an assistant remember preferences and past work, and it needs rules for what to save, update and forget. Looking things up (search & RAG): Looking things up gives the agent facts it was never trained on, from the web, your files or a company knowledge base. Lost in the middle: The finding, first reported in 2023, that models use information at the start and end of a long context more reliably than information in the middle. It is one reason to put key instructions and facts at the edges, and not to rely on a large window alone. Map-reduce: A pattern in which a large input is split into pieces, each processed independently by a model call (map), and the partial results are then combined by one final call (reduce). It is used to summarise or analyse material that does not fit in one context window. MCP client: The part of an AI application that opens a connection to one MCP server and speaks the protocol with it: listing its tools and sending calls. A host application usually runs one client for each server it connects to. MCP host: The AI application that a person uses and that runs one or more MCP clients, for example a chat app, a code editor or an agent harness. It decides which servers to connect, shows approval prompts and passes tool results to the model. MCP (Model Context Protocol): MCP, the Model Context Protocol, is an open standard for connecting AI apps to other software. MCP server: A program that exposes tools, resources and prompts to AI applications over the Model Context Protocol. One server can be used by any application that speaks the protocol. Memory & compaction: The model remembers nothing between requests, so memory means notes kept outside the context and loaded again when needed. MicroVM: A very small virtual machine that boots quickly and runs its own kernel, so a program inside is separated from the host by hardware virtualisation. It gives stronger isolation than a container and is a common choice for running untrusted agent code. Mixture of experts (MoE): A model design with many specialised sub-networks, called experts, where a learned router activates only a few of them for each token. The model can be very large in total yet cost less to run per token, since only part of it works at a time. Model routing: Sending each request to the model best suited to it, usually a small, fast model for easy cases and a larger one for hard cases. Done well it cuts cost and latency with little loss of quality, but it needs a reliable way to judge difficulty. Multi-agent system: Several agents cooperating on a task, typically a lead agent coordinating specialists. It helps when work splits into independent parts or needs fresh context, and it costs more tokens than a single agent. Multimodal model: A model that takes more than one kind of input, such as text, images, audio or video, and sometimes produces more than one kind of output. A vision-language model handles images together with text, for example to read a screenshot or a chart. NIST AI RMF: A voluntary framework from the US National Institute of Standards and Technology, published in January 2023, that helps organisations manage AI risk through four functions: govern, map, measure and manage. OAuth: A standard that lets a person grant an application limited access to their account on another service without sharing their password. The application receives a token with specific scopes that can expire or be revoked, and the MCP specification uses it for remote servers. Observability: Recording traces, metrics and logs of agent runs so you can inspect and improve them. It shows what an agent did and why, what each run cost, and where it is slow or failing. Open-weight model: A model whose trained weights are published so that anyone can download and run them on their own hardware, under a licence that sets the terms. Open-weight is not the same as open source: training data and training code are often not released. Orchestrator: The agent or program that breaks a goal into parts, assigns them to other agents or tools, collects the results and decides what to do next. Some frameworks call it a supervisor or manager. It holds the overall plan, so it is also a single point of failure. Orchestrator-workers: A pattern in which a lead model breaks a task down at run time and delegates the parts to workers. Unlike fixed parallel branches, the number and kind of sub-tasks are decided by the model for each input. Parallelization: Running independent sub-tasks, or several attempts at one task, at the same time. It shortens waiting time and can raise reliability, but total cost and load on rate limits go up. Parameters: The numbers inside a neural network that training adjusts; together they hold everything the model has learned. Modern language models have billions or trillions of them, and size is a rough guide to capability, memory needs and running cost. pass@k: A score for tasks with checkable answers, such as code with tests: the chance that at least one of k attempts succeeds. Pass@1 is success on the first try, and the gap between pass@1 and pass@k shows how much repeated attempts help. Permission mode: A harness setting that decides which actions an agent may take without asking first. Typical modes range from asking before every change to running freely inside a sandbox. Permissions & approval: Permissions decide what an agent may do alone, what needs your approval and what is forbidden. Persona: A role or character a model is told to take, such as a reviewer, a tutor or a support agent, usually set in the system prompt. It shifts tone, vocabulary and focus, but does not give the model skills or facts it lacks. PII (personally identifiable information): Information that identifies a person, alone or in combination, such as a name, email address, ID number or health record. Privacy laws such as the GDPR limit how it is processed, so systems often detect and mask it before it reaches a model or a log. Planning: Having an agent write a plan, a list of steps or sub-goals, before acting, and revise it as results come in. Breaking a goal into checkable parts helps on long tasks. Some systems plan once up front; others re-plan after every step. Playbook: A written, reusable procedure for a recurring task, with steps, checks and a definition of done. Packaged as a skill, an agent can load it only when the task calls for it. Plugin: An installable bundle of skills, commands, sub-agents, hooks and MCP servers, so that a whole setup can be shared with one install. Plugins can run code with your permissions, so install only ones you trust. Post-training: All training after pre-training that shapes how a model behaves: supervised examples of good answers, preference tuning such as RLHF, and reinforcement learning on tasks with checkable results. It turns a text predictor into an assistant that follows instructions and uses tools. Pre-training: The first and largest training stage, in which a model learns to predict the next token across huge amounts of text, code and other data. It gives the model its general knowledge and language ability, and it sets the knowledge cutoff. Prompt caching: Re-using the processed form of an unchanged prompt prefix, which cuts cost and latency. A request that matches a cached prefix is a cache hit and is billed at a lower rate, so keep stable text first and changing text last. Prompt chaining: A workflow that splits a task into fixed, sequential calls with checks between them. Each call is simpler than the whole task, so it is easier to test and cheaper to fix. Prompt engineering: Writing and refining the instructions, examples and structure given to a model so that it produces the result you want. It is done by testing variations against sample inputs, and it overlaps with context-engineering, which also covers what else the model sees. Prompt injection: An attack in which text the model processes overrides its intended instructions. Models cannot reliably tell instructions from data in their context, so no filter removes the risk completely; the strongest defence is to limit what a fooled agent can do. Prompt injection & security: Prompt injection hides instructions in text an agent reads, to hijack what it does. Prompt & system prompt: A prompt is the message you send. The system prompt holds standing instructions from whoever built the app, sent with every request. Quantisation: Storing a model's weights with fewer bits, for example 8 or 4 instead of 16, so that it takes less memory and runs faster. Quality drops a little, often very little, which lets large open-weight models run on modest hardware. RAG (retrieval-augmented generation): Retrieving relevant passages from a knowledge base and adding them to the prompt before the model answers. It gives the model current or private facts without retraining, and lets answers point to their sources. Rate limit: A cap on how many requests or tokens an account may use per minute or per day. Going over it returns an error, commonly HTTP 429, and the client should wait and retry with growing delays. Agents running in parallel reach limits quickly. ReAct: Reason plus act: the 2022 research pattern of interleaving written reasoning with tool actions and observations. It is the template for today's agent loop. Reasoning model: A model trained to think step by step before answering, trading extra tokens and time for accuracy. It tends to do better on maths, code and multi-step planning, and needs less step-by-step coaching in the prompt. Reasoning (thinking models): A reasoning model, also called a thinking model, works through a problem step by step before it answers. Red teaming: Deliberately attacking a model or agent to find failures before real attackers do: eliciting harmful output, tricking it into misusing tools, extracting private information. It is done by people, by automated attack models, or both, and its findings feed fixes and evals. Reflection: Having a model review its own output or the result of an action, find faults and try again. It can catch simple mistakes, but without an outside check such as a test it can also talk itself into a wrong answer. Regression test: A test run after every change to confirm that what used to work still does. For AI systems it means re-running the golden-set after a change of model, prompt or tools, because a fix in one area often breaks another. Reinforcement learning: Training by trial and reward: the model tries something, receives a score for the outcome and is adjusted to make high-scoring behaviour more likely. In language models it is used to teach preferences, step-by-step reasoning and tool use. Reranking: A second step in retrieval: a model scores the top results of a fast first search against the query and reorders them, so that the best few reach the context. It is slower than the first search and noticeably improves relevance. Risk tier: A grouping of AI uses by how much harm they could cause, with duties that grow with the tier. The EU AI Act has unacceptable, high, limited and minimal risk; many organisations use similar tiers to decide how much testing and human oversight an agent needs. RLHF (reinforcement learning from human feedback): A post-training method in which people rank model answers, a reward model learns those preferences, and the language model is then tuned to produce answers that score higher. It is a main reason chat models follow instructions and sound helpful. RLVR (reinforcement learning with verifiable rewards): Reinforcement learning in which the reward comes from an automatic check, such as a passing unit test or a correct maths answer, rather than from a human or a learned judge. It is widely used to train reasoning models on maths and code. Routing: A workflow that classifies an input and sends it to a specialised path or model. It keeps each path simple and lets cheap models handle easy cases. RPA (robotic process automation): Software robots that copy a person's clicks and keystrokes in existing applications to run fixed, rule-based routines, such as moving values between systems. RPA breaks when screens change; agents add judgement for messy cases, and the two are often combined. Sandbox: A sandbox is an isolated computer where the agent runs code without touching the rest of your systems. Scaffold: The code around a model that turns it into an agent: the loop, the tools, the prompts and the handling of memory. Benchmark scores depend on the scaffold as well as the model, so one model can score very differently in different scaffolds. Harness is the common name for the same thing. Scratchpad: A place where a model writes intermediate notes, calculations or plans while it works, before the final answer. It can be the model's own reasoning text or a file the agent keeps updating; either way it holds working information apart from the final output. Secrets: Credentials such as API keys, passwords and access tokens that grant access. Keep them out of prompts, files the agent reads and logs; give tools short-lived, narrowly scoped credentials supplied at run time, because anything in the context can be repeated or leaked. Self-consistency: Asking a model the same question several times with some randomness, then taking the answer that most attempts agree on. It improves accuracy on reasoning problems, at several times the compute. Semantic search: Searching by meaning instead of exact words: the query and the documents are turned into embeddings and the closest ones are returned. A search for 'car repair' can find a page about 'fixing a vehicle', but it can miss exact names and codes, which keyword search handles well. Short-term memory: What an agent holds during a single session: the current context window with the conversation so far, tool results and any working notes. It is lost when the session ends unless something is saved to long-term-memory. Skills & saved prompts: A skill is written know-how for one kind of task. The agent loads it only when that task comes up. Slash command: A saved prompt template invoked by name, such as /review. In most harnesses custom commands are now written as skills. Small language model (SLM): A language model small enough to run cheaply, quickly or on a laptop or phone, typically from under one billion to a few billion parameters. On narrow tasks, especially after fine-tuning, it can match a larger model, so agents often use one for simple steps. Stop condition: The rule that ends an agent loop: the model says it is done, a goal check passes, or a limit on steps, time or budget is reached. Without a firm limit an agent can loop for ever, so harnesses always add one. Stop sequence: A string that ends the model's output the moment it is generated. Developers use stop sequences to cut a reply off at a delimiter, such as the end of a list, or to stop the model before it starts writing the next speaker's turn. Streaming: Sending a model's answer to the client piece by piece as it is generated, instead of waiting for the whole reply. The reader sees text start almost at once; agents also stream tool calls and progress events. Structured output: Making a model reply in a fixed machine-readable format, usually JSON that matches a given schema. Some systems enforce the format while the text is generated, so the result always parses; others only ask for it and validate afterwards. Sub-agent: A helper agent with its own fresh context window that handles one delegated task and returns a short result. It keeps the lead agent's context clean and allows several tasks to run side by side. Sub-agents, workflows & teams: Sub-agents are helper agents with their own fresh context; workflows run fixed steps in code. Swarm: A multi-agent style with no fixed boss: many simple agents hand control to one another by rules or by choice, each doing its own part. It suits work that splits into many independent pieces, and is harder to predict and debug than a central orchestrator. System prompt: Standing text, set by the developer or the app, placed at the start of the context to frame every turn: role, rules, tone and available tools. Models are usually trained to give it more weight than ordinary input, but it is not a security boundary. Temperature: A setting that controls how random a model's choice of the next token is. Low values make output more predictable and repeatable; high values make it more varied. Related settings, such as top-p, limit which candidate tokens may be picked at all. Test-time compute: Computing power spent while a model answers rather than while it is trained, usually by letting it write a longer chain of thought or try several answers. More of it often improves results on hard problems, at a cost in time and tokens. Token: The unit models read and write, roughly three quarters of an English word. Context limits, prices and speed are all counted in tokens. Token budget: A limit on how many tokens a request, a reasoning phase or a whole agent run may use. It caps cost and prevents runaway loops, and is often set together with limits on steps and time. Tokenizer: The component that splits text into tokens and maps each to a number before the model reads it, and turns the model's output numbers back into text. Each model family has its own tokenizer, so the same text can cost a different number of tokens in different models. Tool poisoning: An attack that hides malicious instructions in a tool's description or metadata, which the model reads but the person may never see. A tool from an untrusted source can steer the agent to leak data or misuse other tools. Tools: A tool is something the model can ask to have done, such as a web search or a new row in a spreadsheet. Tool schema: The description of a tool given to the model: its name, a plain-language purpose and the parameters it accepts, usually written as JSON Schema. The model reads it to decide when to call the tool and how to fill in the arguments, so clear names and descriptions matter as much as the code. Tool search: A way to avoid loading hundreds of tool definitions into the context: the model gets a search tool, looks up the tools a task needs and only those are added. It saves tokens and helps the model choose the right tool from a large set. Trace: The recorded path of one request or agent run as a tree of timed steps, called spans: each model call, tool call and decision with its inputs, outputs, duration and cost. Traces are the main tool for debugging agents. Trajectory: The full record of an agent run: every message, model call, tool call and result in order. Trajectories are what you read to debug an agent, grade with evals and, in training, use as examples to learn from. Transformer: The neural-network architecture behind modern language models, built on attention. It reads all tokens of its input in parallel and learns which ones matter for each other, which made training at very large scale practical. Tree of thoughts: A reasoning method in which a model explores several possible next steps, scores or prunes them and backtracks, like searching a tree, instead of following a single chain of thought. It helps on puzzles and planning problems and costs many more model calls. Turn: One round of a conversation: a message from the person and the model's reply. In an agent a single turn may contain several model calls and tool calls before the reply is complete, and limits are often set in turns. Unit economics: What one unit of work costs against what it earns, for example the cost per resolved support ticket against its value. For agents it shows whether automation pays off once model calls, retries, tool fees and human review are all counted. Vector database: A database built to store embeddings and quickly find those nearest to a query embedding. It is the usual store behind semantic search and rag, and many also add metadata filters and keyword search. Vibe coding: Building software by describing what you want in plain language and accepting the code the AI writes without reading it closely, judging only by whether it runs. It makes quick prototypes easy, but unreviewed code can hide bugs and security holes. Voice agent: An agent that talks by speech: speech is turned into text, a model decides the reply and any tool calls, and text is turned back into speech, or a speech-native model handles the audio directly. Delay and interruptions matter much more than in text. Workflow: A system in which your code orchestrates model calls along predefined paths. It is cheaper, faster and more predictable than an agent, and the right choice whenever the steps are known in advance.