The language of operating on agents.
A
AI Guardrail
An AI guardrail is a programmable check that runs outside the model to validate its inputs and outputs, then blocks, redacts, rewrites, or escalates anything that violates policy — keeping an agentic system inside defined safety, scope, and correctness boundaries regardless of what the model itself decides to do.
Read definitionAI agent framework
An AI agent framework is the software layer of prebuilt building blocks — an agent loop, tool interfaces, memory, and orchestration — that sits between a raw LLM API and a production agent, giving builders a standardized way to develop, deploy, and manage systems that reason, plan, and execute multi-step tasks.
Read definitionAI audit trail
An AI audit trail is a connected, durable record of an AI action that links the request, initiating actor, delegated authority, applicable controls, execution steps, approvals, supporting evidence, and resulting state so an operator can reconstruct what happened, assess whether it was authorized, and recover safely.
Read definitionAI delegation
AI delegation is the controlled transfer of a goal and limited decision authority to an agent, allowing it to choose steps and invoke tools within explicit permissions, budgets, approval rules, and stop conditions while the surrounding harness preserves oversight, evidence, and recovery paths.
Read definitionAgent Design Pattern
An agent design pattern is a reusable shape for organizing an agentic system's components and orchestrating how its agents coordinate, chosen to fit a task's structure rather than switched on as a feature; common shapes include ReAct, orchestrator-worker, evaluator-optimizer, and reflection loops.
Read definitionAgent Evaluation
Agent evaluation is the practice of systematically judging whether an agent completed its task, using repeatable tests, graded trajectories, and outcome measures instead of a single successful demo. It scores real behavior across many runs so you can catch regressions, compare changes, and defend the claim that the agent works.
Read definitionAgent Sandboxing
Agent sandboxing confines an autonomous agent's actions inside an enforced boundary — an OS-level container, a filesystem jail, or an in-harness tool-call block hook — so an unattended run cannot read, write, or reach any resource you have not explicitly granted, even when the model behaves unpredictably.
Read definitionAgent Skill
An Agent Skill is a self-contained folder packaging a procedure, domain knowledge, or instruction set that an agent loads into context only when a task makes it relevant, and otherwise leaves on disk. It extends the agent's competence on demand without permanently inflating the prompt every request pays for.
Read definitionAgent Team
An agent team is a coordination pattern where several agents run in parallel, each holding its own context window, message one another directly, and self-organize around a shared task list, rather than routing every decision and hand-off through a single lead or orchestrator agent.
Read definitionAgent Tracing
Agent tracing is the structured recording of an agent run across model calls, context assembly, tool invocations, guardrail results, decisions, state changes, and handoffs, so an operator can reconstruct what happened, identify where control was lost, and evaluate whether the harness behaved as intended.
Read definitionAgent handoff
An agent handoff is the controlled transfer of a task from one agent to another, including the context, workflow state, evidence, authority, and completion criteria the receiving agent needs to continue safely without guessing, silently expanding its permissions, or repeating work whose outcome is already known.
Read definitionAgent harness
An agent harness is the software infrastructure wrapping a language model—supplying tools, memory, execution environments, and guardrails—that turns a text predictor into a system able to take actions, observe their results, and iterate toward a task while staying controllable, observable, and reversible.
Read definitionAgent hooks
Agent hooks are user-defined handlers — a script, HTTP endpoint, or MCP tool — that fire at the exact point an agent takes an action, letting you inspect, block, modify, or log that action before or after it runs, turning implicit model behavior into an explicit, programmable control surface you own in code.
Read definitionAgent loop
An agent loop is the cycle a harness runs between a model and the outside world: it assembles context, lets the model choose an action or tool call, executes that action, and feeds the result back as new context, repeating until a goal, budget, or guard condition stops it.
Read definitionAgent observability
Agent observability is the ability to reconstruct an agent’s inputs, assembled context, decisions, tool calls, outputs, and execution state so an operator can explain what happened, identify where control failed, and determine whether a run can be trusted, resumed, corrected, or safely reversed.
Read definitionAgent orchestration
Agent orchestration is the coordination layer that routes work, state, and control across multiple specialized AI agents so they pursue a shared goal, using patterns such as sequential pipelines, hierarchical or supervisor structures, and swarms to decide who acts, in what order, and under which permissions.
Read definitionAgent scaffolding
Agent scaffolding is the set of instructions, context, tools, interfaces, and execution controls arranged around a language model so it can pursue a goal, inspect results, manage state, and act within explicit limits rather than producing an isolated response to a prompt.
Read definitionAgent trace
An agent trace is the ordered record of an agent run, linking model decisions, tool calls, returned results, state changes, and subsequent interpretations so an operator can reconstruct what happened, locate failures, evaluate behavior, and distinguish the agent’s reasoning path from the effects it produced.
Read definitionAgent-computer interface
An agent-computer interface is the documented contract through which an agent discovers and invokes computer capabilities, supplies typed arguments, and receives structured results or errors, giving the harness a stable point to validate intent, constrain authority, record effects, and decide whether execution may continue.
Read definitionAgent-run contract
An agent-run contract is a machine-checkable record of what an agent run may accomplish, which resources and permissions it may use, when it must stop, what evidence counts as completion, and where control should pass when the run encounters ambiguity, failure, or a decision outside its delegated authority.
Read definitionAgentic AI
Agentic AI is a system you hand a goal rather than a single prompt: it plans across many steps, calls real tools to act on the world, observes each result, and iterates until it satisfies the goal or exhausts a budget — trading single-shot predictability for autonomous, multi-step problem solving.
Read definitionAgentic Design Patterns
Agentic design patterns are reusable, named solutions to recurring problems in building agent systems—loops, orchestration, reflection, tool use, verification—that give teams a shared vocabulary for describing structure and tradeoffs. They name what tends to work so design decisions stay legible and comparable, rather than serving as a framework, a…
Read definitionAgentic RAG
Agentic RAG is a retrieval-augmented generation architecture in which an agent iteratively decides what information it needs, selects retrieval tools, refines queries, evaluates returned evidence, and stops when a defined condition is met, rather than accepting a single fixed retrieval pass as sufficient context for generation.
Read definitionAgentic Workflow
An agentic workflow is a predefined process that gives an AI agent bounded discretion within selected steps while the harness retains control over sequencing, permissions, state transitions, and completion. It combines model-driven decisions with deterministic constraints so useful variation does not make the overall execution path ungovernable.
Read definitionAgentwashing
Agentwashing is the practice of marketing a dependent assistant — one that needs a human to approve or drive every step — as if it were an autonomous agent, a positioning failure named by Gartner that overstates a system's real autonomy and hides where control, judgment, and accountability actually live.
Read definitionApplication Permissions
Application permissions are an authorization model in which an application authenticates as itself, using client credentials rather than a signed-in user, so the scopes granted to that identity alone determine everything it can reach. No user context narrows access, so the grant itself is the full boundary.
Read definitionApproval checkpoint
An approval checkpoint is a defined execution transition where an agent persists its current state and pauses until an authorized person reviews the proposed action and explicitly permits, rejects, or redirects it, preventing consequential work from proceeding solely on the model’s judgment.
Read definitionApproval flow
Approval flow is a workflow control that suspends an agent before a consequential action, presents a decision with enough context for informed review, records the response, and either resumes, redirects, or terminates execution without losing authoritative state or expanding the authority originally delegated to the agent.
Read definitionApproval gate
An approval gate is a wired-in checkpoint that pauses an agent run before a designated tool call executes, holds the run until a human signs off, and then resumes deterministically from saved state once the operator approves or rejects the action — turning an otherwise irreversible step into a reviewable decision.
Read definitionApproval policy
Approval policy is the enforceable rule set that determines which proposed agent actions may execute automatically, which require a decision from an authorized actor, and which must be denied, using factors such as action type, permission scope, risk, system state, and the reversibility of the expected effect.
Read definitionArbitrary code execution
Arbitrary code execution is when a system runs code it was handed without restricting what that code can reach. In an agent harness it happens when an LLM generates code that executes against your environment — a Blender scene, a shell, a database — with no boundary constraining which data, files, or side effects it can touch.
Read definitionAudit trail
An audit trail is a durable, ordered record of agent actions, approvals, denials, overrides, and relevant state changes that lets an operator reconstruct who or what made each operational decision, under which authority, with which inputs, and what effect the decision had.
Read definitionAuthoritative Workflow State
Authoritative workflow state is the trusted record a harness consults to determine which side effects are committed, where execution currently stands, and which recovery transitions are legal, so retries, resumes, approvals, and cancellations act on durable facts rather than model output, process memory, or an incomplete trace.
Read definitionAuthorization boundary
An authorization boundary is a control point that determines which tools, actions, resources, and side effects an agent may access within delegated work, enforcing the operator’s authority at execution time so that a valid goal, persuasive prompt, or compromised context cannot silently expand what the agent is allowed to do.
Read definitionAutonomous agent
An autonomous agent is an AI system that takes a goal and carries it out end to end — planning, calling tools, and acting over many steps without a human driving each move — in contrast to an assist tool that only responds while a person stays in the loop and makes every decision.
Read definitionAutonomy level
Autonomy level specifies how far an agent may progress through a defined action or workflow without human intervention, by binding execution to explicit permissions, approval conditions, limits, and recovery rules rather than treating autonomy as a general property of the model.
Read definition
B
Behavioral evaluation
Behavioral evaluation is a test that grades an agent’s recorded actions, decisions, and execution trajectory against explicit expectations, turning observed operating failures into repeatable checks that can detect regressions even when the agent’s final answer or task outcome appears acceptable.
Read definitionBlast Radius
Blast radius is the scope of harm a wrong or malicious agent output can reach before something stops it — the set of systems, data, and users a single bad action can touch. Engineers use it to decide where an expensive guard earns its added latency and where cheap containment is enough.
Read definitionBounded Agent
A bounded agent is an agent whose adaptive decisions remain inside explicit limits on workflow, authority, execution, and escalation, so the harness can permit useful autonomy while constraining what the agent may change, which tools it may invoke, how long it may continue, and when control must return to an operator.
Read definitionBounded autonomy
Bounded autonomy is an operating posture where an agent acts freely inside explicit, pre-declared limits — permitted tools, scopes, budgets, and reversible actions — instead of pausing for human approval on every step, so oversight shifts from per-action gates to boundary design and after-the-fact review of what happened.
Read definition
C
Capability Discovery
Capability discovery is the process by which an AI application inspects advertised tools, resources, or prompts, compares their declared interfaces and constraints with the current task, and identifies suitable capabilities without treating discovery as authorization to invoke them or as proof that they will behave safely.
Read definitionCheckpoint
A checkpoint is a saved snapshot of an agent's state — its files, working tree, or task context — captured immediately before a mutating action, giving the harness a known-good point it can restore to if the change turns out to be wrong, unsafe, or incomplete.
Read definitionCheckpointed execution
Checkpointed execution is an execution model that periodically records validated workflow state so an interrupted agent run can resume from a known boundary without repeating completed work, losing required context, or guessing whether earlier tool calls and external side effects succeeded.
Read definitionCheckpointing
Checkpointing is the practice of persisting an agent's working state to durable storage after each completed step, so a long-running run can resume from its last saved point instead of restarting from scratch when the process crashes, is preempted, or is deliberately paused and later rehydrated.
Read definitionCompaction
Compaction is the harness technique of compressing a long agent session's accumulated turns — tool calls, results, and messages — into a shorter summary, so the conversation keeps fitting inside the model's finite context window while preserving the facts, decisions, and state the agent still needs to keep acting correctly.
Read definitionCompensating Action
Compensating action is a predefined corrective operation that semantically reverses or neutralizes a completed side effect when a later step fails, allowing a distributed or agentic workflow to recover without assuming that every participating tool supports transactions, exact rollback, or restoration of its previous state.
Read definitionConfused deputy
A confused deputy is an authorization flaw in which a privileged service accepts a request from a less-privileged caller, then exercises its own authority without proving that the caller is entitled to the target action, allowing the caller to reach data or effects outside its permission scope.
Read definitionContext Engineering
Context engineering is the practice of deliberately controlling exactly what enters a model's context window — which instructions, tools, retrieved data, and history are visible on each turn — treating that visibility as an engineering constraint that governs output quality rather than leaving it to accumulation or chance.
Read definitionContext assembly
Context assembly is the per-step process of selecting, ordering, transforming, and labeling the instructions, state, evidence, tool descriptions, and prior results a model receives, so each invocation has enough relevant information to act while excluding stale, untrusted, unauthorized, or unnecessary material.
Read definitionContext compaction
Context compaction is the automatic summarization or pruning of an agent's earlier turns and tool output so a long session stays inside the model's context window. It buys runway to keep the loop running, but because it replaces raw history with a lossy summary, it can silently drop details the agent later needs.
Read definitionContext management
Context management is the set of harness techniques that compact, trim, summarize, and re-inject an agent's working state across a long task, so the model keeps the relevant facts, goals, and constraints inside a bounded context window without drifting off-task or discarding earlier decisions it still needs.
Read definitionContext propagation
Context propagation is the deliberate transfer of correlation, execution, and authority metadata across process or network boundaries, allowing each downstream agent, tool call, and event to be connected to its originating request while preserving the information needed to observe, constrain, and recover the run.
Read definitionControl boundary
A control boundary is the defined limit around an automated step that constrains what it may receive, decide, change, and retain, while specifying the permissions, oversight, stop conditions, and recovery behavior that keep failures contained and operator intervention effective.
Read definitionControl contract
A control contract is an explicit, inspectable agreement that defines which actions an agent may take, which controls govern execution, what evidence constitutes acceptable completion, and how operators can interrupt, recover, or audit the run when its behavior or outcome departs from expectations.
Read definitionControl plane
A control plane is the part of an agent harness that applies policies, permissions, limits, oversight, and recovery controls to execution, determining what work may run, which tools and resources it may use, when it must stop or seek approval, and how operators can inspect or intervene.
Read definitionControl surface
A control surface is an enforceable point in an agent system where the harness constrains or directs inputs, actions, authority, execution, or human intervention, turning an operating policy into a runtime decision that can allow, deny, pause, narrow, record, or safely redirect the agent’s next move.
Read definitionCoordination Budget
Coordination budget is a design limit for the communication, state transfer, verification, recovery, and authority management introduced when work is split across agents, used to decide whether decomposition improves the system enough to justify its added operating obligations and failure paths.
Read definitionCoordination Cost
Coordination cost is the overhead a multi-agent system pays to pass, reconcile, and re-synchronize state across agent boundaries—serialization, misreads, redundant retrieval, and conflicting edits—that a single agent holding one continuous context never incurs. It frequently grows faster than the parallelism it was meant to buy.
Read definition
D
Data Locality
Data locality is the deliberate control decision about where an agent's data physically resides and how it flows — kept on hardware and networks you govern versus routed to external models, tools, and services — so you can bound exposure, satisfy residency rules, and keep sensitive context out of systems you cannot audit or revoke.
Read definitionDelegated authority
Delegated authority is the bounded set of resources and actions an agent may access through connected tools and credentials, constrained by permission scope, operating policy, and runtime controls so the agent can act for an operator without inheriting the operator’s full power.
Read definitionDeterminism
Determinism is the property of a process producing identical output for identical input on every run, making behavior predictable, reproducible, and testable. In an agent harness it names the parts you can pin down — tool calls, verifiers, control flow — around a probabilistic model that offers no such guarantee.
Read definitionDeterministic Verifier
A deterministic verifier is the single automated check with sole authority to mark agent work complete, running the same inputs to the same pass/fail verdict every time, so success is decided by a reproducible test against a defined property rather than by the agent's own judgment that it succeeded.
Read definitionDeterministic guardrail
A deterministic guardrail is a fixed, repeatable check — schema validation, an explicit rule, or a required human sign-off — placed in front of a consequential action so a non-deterministic model output cannot exceed defined bounds. Given the same input it returns the same verdict every time, and it either passes the action unchanged or blocks it.
Read definitionDiff Review
Diff Review is the practice of reading the exact set of changes an agent or tool produced — line by line, as you would a teammate's pull request — and deciding to accept, amend, or reject them before they merge into a project's working state.
Read definitionDurable Checkpoint
A durable checkpoint is a persisted, validated record of completed workflow state that lets an agent harness resume after interruption without treating prior work as unknown, repeating confirmed side effects, or relying on the failed process’s memory to determine what happened.
Read definitionDurable Execution
Durable execution is an engineered property—not a model capability—that lets long-running agent work survive process restarts, crashes, and failures by persisting each step's state and scheduling, so a resumed run continues from its last committed checkpoint instead of restarting from zero or silently losing progress.
Read definition
E
Eval
An eval is a repeatable test for an AI system that supplies a fixed input, applies grading logic to the output or trajectory, and scores it against a success criterion you define — turning subjective judgments about quality, safety, or behavior into a measurable signal you can compare across model, prompt, and code changes.
Read definitionEvaluation Harness
An evaluation harness is a repeatable suite of test cases run against an agent to catch regressions before users do, treating known-good inputs and expected behaviors as a fixed correctness bar so you can change models, prompts, or tools and measure whether the system got better or worse.
Read definitionEvaluator-Optimizer
Evaluator-Optimizer is an agent design pattern that pairs a generator with a separate evaluator: the generator proposes an output, the evaluator scores it against an explicit target or rubric, and that feedback drives repeated regeneration until the output clears a threshold or an iteration budget is spent.
Read definitionEvaluator-optimizer pattern
The evaluator-optimizer pattern is a harness-improvement loop in which structured evaluation of observed agent behavior identifies failures, ranks candidate interventions, and determines the next bounded change to prompts, tools, permissions, context, or control logic, with that change tested against the same criteria before adoption.
Read definitionExecution journal
An execution journal is a durable, ordered record of workflow actions, their completion status, and the identifiers needed to reconcile effects, allowing an agent harness to determine what happened, resume from a known point, and retry interrupted work without blindly repeating operations.
Read definitionExecution limit
An execution limit is a deterministic bound on an agent run that transfers control or stops further work after a maximum number of steps, actions, retries, tokens, or elapsed time, preventing an open-ended loop from consuming resources or extending delegated authority indefinitely.
Read definitionExecution replay
Execution replay is the controlled reconstruction of a prior agent workflow from recorded inputs, context, decisions, tool calls, outputs, and state transitions, allowing operators to inspect what happened, reproduce a failure, or resume work while preventing repeated side effects and making any unavoidable differences visible.
Read definitionExecution trace
An execution trace is a preserved, ordered record of an agent run that connects model decisions, tool calls, state changes, control decisions, and outcomes, allowing operators to reconstruct what happened, evaluate the path taken, and identify where a failure or unexpected result entered the system.
Read definitionExecution trajectory
Execution trajectory is the ordered path of decisions, tool calls, observations, and state transitions an agent takes through a multi-step run, including branches, retries, approvals, and termination, so operators can reason about how an outcome was produced instead of inspecting only the final result.
Read definition
F
Fail-Closed Control
Fail-closed control is a deterministic enforcement rule that blocks an action when required approval, validation, authorization, or policy evidence is missing, invalid, expired, or unresolved, ensuring that uncertainty cannot silently expand an agent’s effective permissions or allow an irreversible operation to proceed.
Read definitionFailure isolation
Failure isolation is an architectural boundary that contains a fault within one agent, tool call, workflow stage, or resource scope, preventing corrupted state, excessive retries, or unauthorized effects from spreading while preserving enough evidence and resumable state to diagnose and recover the affected work.
Read definitionFault Injection Testing
Fault injection testing is a testing method that deliberately interrupts an agentic workflow at predefined execution boundaries to verify that the harness preserves authoritative state, contains side effects, classifies uncertain outcomes, and resumes, compensates, or stops according to an explicit recovery contract.
Read definitionFeedback Loop
A feedback loop is a control mechanism that observes the outcome of an agent’s action, converts that observation into a usable signal, and feeds it into a later decision so the harness can reinforce useful behavior, correct errors, or stop execution within an explicit scope.
Read definition
G
Git worktrees
Git worktrees are a Git feature that checks out multiple branches of one repository into separate working directories that share a single object store, giving each parallel agent an isolated file tree so concurrent coding agents never overwrite each other's uncommitted changes or contend for the same checkout.
Read definitionGuardrail
A guardrail is a deliberate constraint on what an agent may do — keeping a server read-only, blocking a destructive call, or capping spend — chosen to bound risk rather than because the capability is missing. It narrows the action space by policy and is enforced outside the model, so a misfire cannot cross the line you set.
Read definition
H
Hallucination Propagation
Hallucination propagation is a multi-agent failure mode in which one agent's fabricated or unverified output enters shared context and is treated as ground truth by every downstream agent that reads it, so a single false claim compounds into coordinated, confident errors that no later step questions or corrects.
Read definitionHarness engineering
Harness engineering is the discipline of building function-level, reversible, legible control layers around AI agents — the loops, permissions, checkpoints, and approval gates — so that an operator's carried judgment stays in force during execution and nothing irreversible happens without a deliberate, informed sign-off.
Read definitionHuman-in-the-loop
Human-in-the-loop is a control pattern where an agent pauses at a defined decision point and waits for a person to approve, edit, or reject its proposed action before execution, typically gating irreversible or high-blast-radius operations so a confident but wrong plan cannot run unchecked.
Read definition
I
Idempotency
Idempotency is the property whereby an operation produces the same end state whether it runs once or many times, so a safe retry cannot cause duplicate side effects. It is usually achieved by keying the operation on a stable identifier and deduplicating repeats, or by writing an absolute target state instead of a relative delta.
Read definitionInterrupt
An interrupt is a deliberate execution pause that persists a workflow’s resumable state at a defined control point, allowing the harness to inspect conditions, obtain input or approval, and continue from the recorded boundary without restarting the entire run or guessing what completed before the pause.
Read definitionIteration budget
An iteration budget is a hard cap on how much work an agent may spend on one task—counted in loop turns, wall-clock time, or tokens—so a stuck or looping agent halts and yields control instead of consuming resources and taking actions indefinitely.
Read definition
K
L
LLM-as-judge
LLM-as-judge is an evaluation method where a second language model grades another system's output against a rubric, scoring open-ended qualities like tone, helpfulness, or faithfulness that no exact rule can capture. It trades the precision of a deterministic check for broad coverage of subjective dimensions at scale.
Read definitionLeast privilege
Least privilege is the practice of granting an agent only the minimum access required for its current task—read before write, one resource before a whole class—and widening scope only when a specific, justified need appears. It shrinks the damage any single action, model error, or hijacked step can cause.
Read definitionLoop engineering
Loop engineering is the discipline of shaping an agent loop's hidden mechanics — how memory carries across turns, how tool failures trigger retries or fallbacks, and how the loop reliably decides to stop — so that an otherwise open-ended agent stays controllable, terminates predictably, and behaves the same way under repeated runs.
Read definition
M
MCP Sampling
MCP Sampling is a Model Context Protocol feature that lets a server ask the connected client to run a model completion on its behalf, so the client selects the model, pays for the inference, and can insert approval — keeping language work under the operator's control rather than the server's.
Read definitionMCP Server
An MCP Server is a small program that exposes a defined set of tools, resources, and prompts to AI agents through the Model Context Protocol, a standard request/response contract. It runs as a separate process the agent connects to, so one integration can serve any MCP-compatible model or harness.
Read definitionMCP Transport
MCP Transport is the channel that carries JSON-RPC messages between an MCP client and server: local servers attach natively over stdio as a spawned subprocess, while remote servers are reached over HTTP as a network endpoint, each imposing a different trust boundary on the same protocol.
Read definitionMCP elicitation
MCP elicitation is a synchronous control mechanism that pauses an active tool call to request human input, returns the response to the calling operation, and lets the harness continue, revise, cancel, or fail according to an explicit policy rather than forcing the model to guess.
Read definitionMacro evaluation
Macro evaluation measures how agent behaviors, controls, and local failure modes combine to affect outcomes across an entire agentic system, using end-to-end scenarios and system-level criteria to reveal risks that isolated model, tool, or trajectory checks can miss.
Read definitionMemory Provenance
Memory provenance is the recorded origin, acquisition path, transformation history, and authority of information retained in an agent’s memory, allowing the harness to judge whether later retrievals are current, trustworthy, and permitted for a decision instead of treating every remembered item as equally reliable state.
Read definitionModel Context Protocol
Model Context Protocol (MCP) is an open protocol that standardizes how AI agents connect to external tools and data through a uniform server interface, so a model can discover and invoke capabilities without bespoke integration code — turning any tool, datasource, or API into a swappable, self-describing server the harness can wire in.
Read definitionModel routing
Model routing directs different parts of a task — planning, execution, verification, or classification — to different models selected for their cost, latency, or capability, so a single agent loop draws on a fast, cheap model where that suffices and a stronger, more expensive model only where the work actually demands it.
Read definitionModel-based Check
A model-based check is a guardrail that uses an LLM or trained classifier to read the meaning of an agent's input, plan, or output and flag nuanced violations — intent, tone, policy breach, unsafe reasoning — that literal pattern rules miss, trading higher latency and cost for semantic judgment.
Read definitionMulti-Agent System
A multi-agent system is an agentic architecture that splits work across two or more coordinating agents, each owning distinct tools, instructions, or a separable subtask, so an orchestrator or peer protocol routes context and results between them instead of one agent carrying the whole task alone.
Read definition
N
O
Observability
Observability is the ability to reconstruct an agent's behavior from the signals it emits — traces, tool calls, prompts, and state transitions — so you can see what a run did, diagnose why it failed, and confirm it is working, without attaching a debugger to a live production system.
Read definitionOrchestrator-Worker
Orchestrator-Worker is a multi-agent pattern that splits an agent system into a planning orchestrator, which decomposes a goal into bounded subtasks and assigns them, and workers, which each execute one subtask and return a result — separating the authority that decides work from the capacity that performs it.
Read definition
P
Per-call attribution
Per-call attribution records the actor identity, delegated authority, and relevant decision context for every model or tool invocation, so operators can explain individual actions without relying on a coarse session-level record that hides changes in callers, permissions, inputs, or intent.
Read definitionPermission Boundary
A permission boundary is the enforced limit on which tools, files, network endpoints, and resources an agent may touch, backed by sandboxing so a prompt-injected or mistaken tool call is contained rather than executed. It defines the outer edge of what an agent can do, independent of what it decides to do.
Read definitionPermission Scope
Permission scope is the precise set of resources, actions, and conditions an agent is authorized to use through a tool or system connection, enforced independently of the model so that each run can exercise only the authority required for its assigned work.
Read definitionPlan Mode
Plan Mode is a constrained agent phase that may inspect context and formulate a proposed execution strategy but cannot perform the state-changing actions reserved for execution, creating an explicit boundary where scope, permissions, risks, and validation can be checked before authority is exercised.
Read definitionPrinciple of least privilege
Principle of least privilege grants an agent only the narrowest set of tools, permissions, and data scopes required for its current task, rather than the widest surface available. It shrinks the blast radius of any error, hallucination, or prompt injection by making unauthorized actions structurally impossible instead of merely discouraged by instructions.
Read definitionPrompt Injection
Prompt injection is an attack where crafted input — often hidden inside retrieved data, tool output, or third-party text — manipulates a language model into ignoring its governing instructions, leaking data, or taking unauthorized actions, exploiting the model's inability to reliably separate trusted instructions from the untrusted content it reads.
Read definitionPrompt engineering
Prompt engineering is the design and testing of model instructions, examples, roles, constraints, and output guidance to shape behavior within a specific task. In an agent harness, it defines the model’s working policy, while deterministic controls remain responsible for permissions, state transitions, validation, and execution limits.
Read definitionProposal hash
Proposal hash is a stored cryptographic digest of a canonical action proposal, recorded at approval time and recomputed before execution, so a harness can fail closed when the resumed target, arguments, constraints, or other approval-bound details differ from what a reviewer actually authorized.
Read definition
R
ReAct
ReAct is an agent pattern that interleaves explicit reasoning steps with tool actions in a single loop: the model thinks, acts by calling a tool, observes the result, then reasons again — grounding each next step in fresh evidence instead of committing to one upfront plan.
Read definitionRead/Write Scope
Read/write scope is the permission boundary that separates an agent's ability to read data from its ability to change it — create, update, or delete live records — so that read-only observation and mutating action are granted, tracked, and revoked independently instead of bundled into one access grant.
Read definitionRecovery Contract
A recovery contract explicitly defines which execution state survives interruption, how uncertain side effects are reconciled, when retries are safe, which approvals remain valid, and whether the harness should resume, compensate, escalate, or terminate each interrupted unit of work.
Read definitionReflection
Reflection is an agentic design pattern in which an agent evaluates and critiques its own output against explicit criteria, then revises it across one or more passes before finishing. It trades extra tokens and latency for higher answer quality by separating generation from a review-and-repair step.
Read definitionRegression eval
A regression eval is a frozen test case — a fixed input paired with an expected outcome — kept in a reusable registry and re-run on every change, so a previously fixed agent failure that silently returns is caught at the point of reintroduction rather than in production.
Read definitionResumable state
Resumable state is persisted, authoritative run data that lets an interrupted agent continue from a known execution boundary, with enough context to identify completed work, pending work, side effects, permissions, and recovery rules without restarting the whole task or blindly repeating actions.
Read definitionRetrieval-augmented generation
Retrieval-augmented generation (RAG) is a pattern that grounds a model in external, private, or real-time data by fetching relevant passages and injecting them into the context before the model generates, so an agent works from what it looked up instead of guessing at facts it should have retrieved.
Read definitionReversibility
Reversibility is a design property of an agent harness that lets an operator inspect an autonomous action and cleanly undo it, so work can be tried, checked, and rolled back instead of accumulating irreversibly — keeping the system controllable even when the model acts without a human in the loop.
Read definitionRollback
Rollback is the mechanism that undoes an action and restores an agentic system to a known prior state — reverting files, data, or external side effects — so that a bad automated change costs a bounded recovery step instead of a permanent, unrecoverable loss you cannot walk back.
Read definition
S
SWE-bench Verified
SWE-bench Verified is a human-validated subset of the SWE-bench benchmark that measures how reliably a coding agent resolves real GitHub issues by generating a repository patch that passes the project's hidden test suite, reported as a pass@1 score and used as a shared capability comparison across agents and models.
Read definitionSandboxing
Sandboxing runs untrusted or model-generated code inside an isolated environment—a container, virtual machine, or restricted process—so it cannot read data, reach networks, or touch systems outside that boundary. The sandbox constrains what executing code can observe and mutate, containing mistakes and attacks to a disposable, revocable space.
Read definitionScoped credentials
Scoped credentials are authentication material whose usable authority is restricted by resource, action, environment, tenant, or time, so an agent receives only the access needed for a specific run or tool call and loses that authority when the assigned work or validity window ends.
Read definitionScoped permissions
Scoped permissions limit an agent’s access to the specific tools, data, actions, resources, and duration required for a defined task, reducing the authority available to misuse or error while giving the harness an enforceable boundary for authorization, containment, and review.
Read definitionSemantic Search
Semantic search ranks items you already hold by meaning: it embeds both the query and each candidate into vectors, then returns the nearest neighbors by distance rather than by exact keyword overlap. It retrieves conceptually related results across paraphrase and synonym, trading literal-match precision for recall.
Read definitionSession affinity
Session affinity is a routing requirement that sends a client’s later requests to the same server instance because that instance holds session state needed to continue the interaction, reducing repeated state transfer while creating an explicit dependency on instance availability, routing correctness, and a defined recovery path.
Read definitionSession contamination
Session contamination is the accidental inclusion of conversation history, retrieved memory, tool output, or working state from separate work in an agent’s active context, causing the agent to reason from instructions, assumptions, permissions, or evidence that do not belong to the current run.
Read definitionShadow IT
Shadow IT is the set of tools, services, and MCP servers an agent or operator can reach without governance — no inventory of where they run, what data they expose, or which actions they permit — so their risk stays invisible until an agent invokes one and something leaks, breaks, or exceeds its intended scope.
Read definitionSingle-writer principle
The single-writer principle is a coordination rule that gives one authority exclusive permission to modify a shared state domain, while other actors submit proposals or remain read-only. Serializing mutations through that authority prevents conflicting updates, preserves invariants, and creates a clear record of which decision produced each state transition.
Read definitionSpec-Driven Development
Spec-Driven Development is a practice where you write down what to build and why in a reviewed specification before an agent implements it, so intent lives in a durable artifact instead of being reverse-engineered from generated code that no human ever read line by line.
Read definitionState Merge
State merge is the defined process that validates, reconciles, and commits concurrent workflow updates into one authoritative state after parallel agent branches complete, using explicit conflict rules, version checks, and provenance so that no branch can silently overwrite another branch’s work or exceed its permitted write scope.
Read definitionStateless Server
A stateless server handles each request independently, holding no client-specific memory between calls; every request carries or references its own context, so any instance can serve any call. That property makes the system easier to scale horizontally, reason about, and reproduce, because behavior depends on supplied inputs, not accumulated hidden state.
Read definitionStateless Transport
Stateless transport is a communication layer where any server instance can handle any request without pinned sessions or a shared in-memory store, so agent traffic rides ordinary HTTP and horizontal scaling, restarts, and failover work without losing conversational continuity or requiring sticky routing.
Read definitionStochastic process
A stochastic process is a system whose behavior includes genuine randomness — a real element of chance in one or more transitions — so identical inputs can produce different outputs. It names randomness as one specific, locatable cause of non-determinism rather than treating the two words as synonyms.
Read definitionStop condition
A stop condition is a declared rule that ends an agent run when it reaches a defined completion, failure, budget, safety, or operational threshold, giving the harness an explicit and inspectable basis for halting further model calls, tool use, retries, or delegated work.
Read definitionSubagent
A subagent is a helper agent that a parent agent spawns to handle one scoped, independent slice of work and return a single result. It runs in its own context and cannot message sibling subagents directly, so all coordination flows back through the parent that created it.
Read definition
T
Token passthrough
Token passthrough is a credential flow in which an intermediary forwards a client-supplied token directly to a downstream service without validating or exchanging it, leaving the downstream service responsible for authenticating the caller and enforcing the token’s permissions while the intermediary controls only the surrounding request path.
Read definitionTool Budget
A tool budget is a hard cap on the tool calls or tokens an agent may spend in a single run, tracked as a spend signal separate from correctness — because a run can reach a right answer and still be a costly failure that the harness should have stopped.
Read definitionTool Description
Tool Description is the natural-language text attached to each tool that an agent reads to decide when and how to call it; it maps the tool's name, purpose, parameters, and boundaries into the model's decision, so vague or overlapping descriptions push the agent toward wrong-tool calls.
Read definitionTool Poisoning
Tool poisoning is an attack that places adversarial instructions inside tool descriptions or discovery metadata, causing a model to select, parameterize, or trust a tool for reasons unrelated to the operator’s request, while the surrounding harness may mistake the resulting invocation for an ordinary model decision.
Read definitionTool surface
A tool surface is the complete set of tools an agent is registered to call at a given moment. It defines the outer boundary of possible actions: whatever is not on the surface cannot be invoked, no matter what the model decides. Narrowing the surface directly constrains what the agent is able to do.
Read definitionTool use
Tool use is an agent's ability to call external functions — search, code execution, file edits, API requests — and act on its environment instead of only emitting text. It is the baseline capability that turns a language model into an agent, letting it observe real results and take further steps toward a goal.
Read definitionTool-invocation blast radius
Tool-invocation blast radius is the full set of systems, data, identities, and consequential actions an agent can reach through a tool call, including transitive effects. It is determined by the tool interface, runtime credentials, argument constraints, network access, approval policy, and the reversibility of the operation.
Read definitionTool-use hook
A tool-use hook is a pre-action or post-action handler that receives structured tool-call context and applies a narrow control, such as validating arguments, checking authority, recording an outcome, or halting execution, where an agent’s proposed action crosses into an external system.
Read definitionTrajectory evaluation
Trajectory evaluation grades a multi-step agent on the path it took — its decisions, tool calls, retries, and recovery — not only its final answer. It scores whether each step was justified and the sequence was efficient and safe, so you can debug how an agent behaves instead of judging outcomes alone.
Read definitionTranscript replay
Transcript replay is the controlled re-running of a recorded agent conversation so engineers can observe how changes to prompts, context assembly, memory, models, or harness policies alter behavior while holding the original interaction—and any explicitly frozen inputs—constant enough for meaningful comparison.
Read definition