Glossary of AI agent terms: short definitions and where each is explained

This page collects the terms that come up when AI agents work on real tasks, and that our articles use. Each entry is one or two sentences and points to the page that explains it in full. Terms about the product and editing, such as judge, ledger, receipt and uncertain, are defined in the Glossary.

🧠 Models and context

• Agent — A program in which a model chooses the next step and calls tools to reach a goal, instead of only answering one question. What it may do is set by its permissions, not by its prompt. → Permissions and data flow
• Context window — The amount of text a model can take into account in one request. Instructions, history, retrieved passages and the answer all share it. → Context windows and tokens: what an agent can see and what it costs
• Embedding — A list of numbers that represents the meaning of a piece of text, so that texts with similar meaning end up close together. → A vector base is a map, not a source: what we learned from retrieval
• Hallucination — A confident statement that nothing supports, such as an invented source or number. It is checked, not argued with. → Why AI agents make things up, and how to check an answer before you use it
• RAG (retrieval-augmented generation) — Looking up passages from your own documents first and giving them to the model together with the question, so the answer can rest on them. → A vector base is a map, not a source: what we learned from retrieval
• Token — The unit a model reads and is billed in: a short chunk of text, often part of a word. Limits and prices are counted in tokens. → Context windows and tokens: what an agent can see and what it costs
• Vector base — A store of embeddings that finds passages close in meaning to a question. In this wiki it is treated as a map to sources, not as a source. → A vector base is a map, not a source: what we learned from retrieval
• Vibe coding — Accepting code an AI wrote because it seems to work, without reading it. Fine for a throwaway script, risky for shared code. → Reviewing AI-written code: why we test it in a clean checkout

🧰 Tools and capabilities

• AGENTS.md — A rules file in a repository that a coding agent loads at the start: its scope, the commands to use and the things not to touch. → AGENTS.md and rules files: set a coding agent’s scope
• MCP (Model Context Protocol) — An open protocol that lets an AI application connect to tools and data through servers. → What is MCP? Servers, clients, tools and resources in plain words
• MCP tool — A named function on an MCP server that an agent can call, with parameters and a return value. A tool acts: it reads, searches or writes. → Skills, MCP tools and rules: three ways to give an agent capabilities
• Rule — An instruction that always applies and limits behaviour, such as never staging everything. It does nothing by itself. → Skills, MCP tools and rules: three ways to give an agent capabilities
• Skill — A packaged way of doing a job: a folder of instructions an agent loads when the task matches. It either advises or is mandatory, depending on its authority. → Skills, MCP tools and rules: three ways to give an agent capabilities
• Task packet — A work order handed from one agent or person to another: the specification, the acceptance criteria and the limits, in one file. → Spec-driven development with existing task packets
• Unit of work — The smallest piece of input that produces a result on its own, such as one file or one country. Big jobs are split by unit. → Splitting a big task for a cheap model: the 24,000-byte lesson

🛡️ Safety and permissions

• Audit record — A row written for every tool call: what was called, with what status and for how long. It lets you reconstruct what happened. → Skills, MCP tools and rules: three ways to give an agent capabilities
• Authority (canon or advisory) — Whether an instruction is our own mandatory rule (canon) or outside advice that may be ignored (advisory). Outside advice never becomes mandatory. → An AI usage policy and register a small team can enforce
• Fail closed — When a check cannot run or a setting is missing, refuse instead of proceeding. The opposite, failing open, lets the work through. → A daily AI budget that fails closed: caps, session ids and a gap we found
• Guardrail — A check on text going into or out of a model, such as masking secrets or flagging known injection phrases. → Prompt injection in agents: what a filter catches and what it misses
• Promotion (approval gate) — The separate, logged action by which a named person approves a work order before it can run. An agent never promotes its own. → The promotion gate: an agent never approves its own work order
• Prompt injection — Text from outside, such as a web page or a ticket, that tries to give the agent new orders. A filter detects known phrases; narrow permissions limit the damage. → Prompt injection in agents: what a filter catches and what it misses
• Register — A file listing every AI capability a team uses, with its authority, risk class, lowest executor and whether a person must approve. → An AI usage policy and register a small team can enforce
• Risk class — The worst thing a capability can touch: read only, repository write, remote change, or money and irreversible actions. → An AI usage policy and register a small team can enforce
• Sandbox — An operating-system box around a command that limits what it can read, write and reach on the network. No sandbox, no run. → Letting an agent run shell commands: use a sandbox or refuse
• Scoped token — A token issued for one task. It carries a budget and an expiry, and it closes with the task. → Keep provider keys out of the agent: one gateway, one token per task

💵 Money and limits

• Budget reservation — Setting aside a task's maximum cost before its first request, so one task cannot consume everything. → The promotion gate: an agent never approves its own work order
• Daily cap — A limit on spend per day for an automatic job. A missing cap must mean refuse. → A daily AI budget that fails closed: caps, session ids and a gap we found
• Escalation reason — A code from a short closed list that must accompany a call to a more senior executor. “Just in case” is not on the list. → A ladder of executors: cheap first, escalate only with a reason
• Executor level — A rung of the ladder: level zero is a script, then a low-cost model, a mid-level model and a senior arbiter. → A ladder of executors: cheap first, escalate only with a reason
• Freeze — Stopping new paid calls on a lane until a named person reconciles an unknown cost. → When you cannot tell what a model call cost: freeze, then reconcile
• Session id — A label on every model call that names the job, not the person, that made it. Without it, spend cannot be attributed. → A daily AI budget that fails closed: caps, session ids and a gap we found

✅ Checking work

• Acceptance — The decision that a result is accepted, made by checks and evidence, not by the model saying it is done. → AI judging: why “it says it is done” is not acceptance
• Acceptance criteria — Machine-checkable conditions, written before the work starts, that a result must meet. → Spec-driven development with existing task packets
• Citation gate — A pre-publication check that finds every number in a text and requires it to appear in the evidence, character for character. → A citation gate: every number in published text must be found in the evidence
• Clean checkout — A fresh copy of the target branch with none of your local files, used to test a change as a teammate would receive it. → Reviewing AI-written code: why we test it in a clean checkout
• Deterministic check — A script, schema or test that gives the same answer every time. Run it before asking a model to judge. → Calibrate your AI judge before you let it accept work
• Evidence — An artifact with a date that supports a claim: a record, a measurement, a file. A claim without one is only a statement. → Sources, dates and what “verified” means
• Held-out set — Test cases kept out of a judge's prompt, so that measuring the judge does not just measure memory. → Calibrate your AI judge before you let it accept work
• Surface check — A script that crawls a site's sitemap and robots file and reads the values a contract defines, so a verdict rests on an artifact and not on a first screen. → Check what a website really serves before you call it empty

🗂️ Working together and operations

• Cull criterion — The fact that, declared before a trial starts, would end it. Without one, ideas never die. → A portfolio of experiments with a death criterion declared in advance
• Load shedding — Refusing to start a scheduled job when the host is overloaded or short of disk, logging the skip and trying again on the next tick. → Do not start the job: load shedding for scheduled batch work
• Online backup — Copying a live SQLite database through its backup interface, page by page, so the copy stays consistent while writers continue. → Backing up a live SQLite database: use the backup API, not a file copy
• Watchdog — A monitor that records load and lowers the priority of batch processes, but never kills anything. → Do not start the job: load shedding for scheduled batch work
• Worktree — A separate working folder of the same repository, so that each agent edits its own copy. → Several agents, one repository: ownership rules from real incidents

📊 Evidence

Each definition restates what the article it links to says. No figures are included in the definitions. Terms in total: 44.

➡️ Next

Start with An AI usage policy and register a small team can enforce, then read Prompt injection in agents: what a filter catches and what it misses and A daily AI budget that fails closed: caps, session ids and a gap we found.

Sources

• Glossary: product and editorial terms.
• What is MCP? Servers, clients, tools and resources in plain words: MCP basics.
• AI judging: why “it says it is done” is not acceptance: acceptance by checks.
• Context windows and tokens: what an agent can see and what it costs: context and tokens.