AI agent glossary

A

A2A (Agent2Agent protocol)

An open protocol, announced by Google in April 2025, for independent agents to discover each other and exchange tasks. Each agent publishes an Agent Card describing its skills and endpoint, and callers interact with it without seeing its internals. It complements MCP, which connects an agent to tools rather than to other agents.

Agent

A system in which a language model decides, at run time, which actions to take and when to stop, usually by calling tools in a loop and reading their results. The defining property is that the model, not the code, chooses the path.

Agentic workflow

A system where code fixes the sequence of steps and a model performs some of them, such as a chain of prompts or a router that picks a branch. It is cheaper and more predictable than a fully autonomous agent, and often the better choice.

Agent loop

The cycle at the core of every agent: call the model, execute any tool calls it requests, append the results to the context and call the model again, until it returns a final answer or a stop condition fires.

C

Compaction

Replacing older parts of an agent's context with a shorter summary that keeps decisions, open threads and key facts, so a long run can continue without overflowing the context window or degrading quality.

Computer use

An agent that operates a graphical interface from screenshots, moving the pointer, clicking and typing like a person. It reaches systems that have no API, at the cost of more steps, more latency and new injection risks from on-screen content.

Context engineering

Deciding which tokens the model sees at each step of a task, including instructions, tool definitions, retrieved data, history and memory, to give it the smallest set of high-signal information it needs to act well.

Context rot

The drop in a model's accuracy as its context grows longer and fills with irrelevant or stale material. It is why bigger context windows do not remove the need for context engineering.

Context window

The maximum number of tokens a model can take as input in one call. For an agent it holds the instructions, tool definitions and the whole history of the run, so it fills up as the run goes on.

D

Durable execution

Running a long agent task so that every step is persisted as it completes. After a crash, the run resumes from its recorded history without repeating completed steps or their side effects.

E

Escalation

Handing a case from the agent to a human, ideally with a structured summary and a recommendation. Escalating cleanly when uncertain is a sign of a well-designed agent, not a failure.

Eval (evaluation)

A repeatable test of an agent's behaviour: a set of tasks, an environment to run them in and graders that score the results. Evals act as the regression suite for prompts, tools and model changes.

F

Function calling

A model API feature where the model returns a structured request to call a named function with JSON arguments matching a supplied schema, instead of free text. The application runs the function and sends back the result. Also called tool calling.

G

Guardrail

A check outside the model that constrains what an agent may receive or do, such as input filters, output validation, policy limits on actions or approval requirements. Effective guardrails work even when the model has been misled.

H

Handoff

Transferring control of a conversation from one agent to another, usually a more specialised one. Unlike calling an agent as a tool, the original agent does not wait for a result.

Human-in-the-loop

A design where a person reviews or approves certain agent actions before they take effect, typically irreversible, costly or external ones.

I

Idempotency key

A unique key sent with a write so the receiving system performs the operation at most once, however many times the request is repeated. For agents it is best derived from the business intent, such as the order and action, rather than from the individual call.

Indirect prompt injection

An attack in which instructions are hidden in content an agent reads during its task, such as a web page, email, document or tool result, rather than typed by the user. The model may follow them as if they came from the user.

L

Least privilege

Giving an agent only the permissions its current task needs, enforced in the tool layer and credentials rather than in the prompt.

Lethal trifecta

Simon Willison's term for an agent that combines access to private data, exposure to untrusted content and the ability to send data externally. With all three present, a single injected instruction can exfiltrate data. The defence is to remove at least one leg.

LLM-as-judge

Using a language model to grade outputs or trajectories against a rubric. It is only trustworthy once its scores have been checked against human labels and audited for biases such as preferring the first or the longer answer.

M

MCP (Model Context Protocol)

An open protocol introduced by Anthropic in November 2024 that standardises how AI applications connect to external tools and data. A host runs MCP clients that connect to MCP servers, which expose tools, resources and prompts.

MCP server

A program that exposes capabilities to AI applications over the Model Context Protocol: tools the model can invoke, resources the application can read and prompt templates. It can run locally over stdio or remotely over HTTP.

Memory (long-term)

Information an agent system stores across sessions, such as user preferences, facts and summaries of past interactions, and retrieves in later runs. It needs explicit rules for writing, updating, expiring and deleting entries.

Model routing

Sending each request or step to a different model based on its difficulty, cost or latency needs, for example a small fast model for classification and a larger one for planning.

Multi-agent system

A design in which several model-driven agents, each with its own context, instructions and tools, work together on a task. Common shapes are orchestrator-worker, handoff chains and parallel subagents.

O

Orchestrator-worker

A multi-agent pattern in which one agent breaks a task into subtasks, delegates them to worker agents, often in parallel, and combines their results.

P

pass@k

The share of tasks where at least one of k attempts succeeds. It suits settings where attempts can be verified and the best one picked, such as generating code against tests.

pass^k

The share of tasks where all k attempts succeed, introduced with the τ-bench benchmark. It measures consistency, which matters for agents that must work every time a user relies on them.

Plan-and-execute

An agent pattern that produces a plan of steps first and then carries them out, revising the plan when results require it. It contrasts with deciding one step at a time.

Prompt caching

Reusing the computation for a prompt prefix that is identical to one sent recently, which lowers cost and latency. Agents benefit because they resend a growing, mostly unchanged prefix on every turn.

Prompt injection

Text that causes a model to follow instructions the application did not intend. Direct injection comes from the user. Indirect injection comes from content the agent reads.

R

ReAct

A prompting pattern from Yao et al. (2022) that interleaves reasoning with actions, so the model reasons, acts, observes the result and reasons again. Native tool calling has absorbed its format, but the pattern underlies most agent loops.

Reasoning model

A model trained to produce an internal chain of reasoning before answering, often with a configurable budget of thinking tokens. Agents use reasoning for hard decisions and limit it on routine steps to control cost and latency.

Reflection

A step in which an agent reviews its own output or trajectory and revises it. It works best when it has new evidence to act on, such as a failing test or a tool error.

S

Sandbox

An isolated execution environment, such as a container or microVM with limited network and credentials, in which an agent runs code or commands so that mistakes or attacks cannot reach production systems.

Stop condition

Any rule that ends an agent loop: a final answer, a terminal tool call, a step, token, time or cost budget, a guardrail violation or a cancellation.

Structured outputs

Constraining a model's output to match a given schema, such as JSON with required fields, so downstream code can parse it reliably.

Subagent

An agent started by another agent to handle a subtask with its own fresh context, returning a condensed result. Subagents keep the parent's context clean and allow parallel work.

T

Tool

A function an agent can call, described to the model by a name, a description and a parameter schema. Tools are how an agent reads from and acts on the world.

Tool poisoning

An attack in which a malicious tool's description or metadata, often from a third-party MCP server, carries hidden instructions that steer the agent when the tool list is loaded into context.

Trace

The recorded history of an agent run: every model call, tool call, result, token count and timing, organised as spans. Traces are the primary debugging and evaluation data for agents.

Trajectory

The sequence of steps an agent took on a task: its reasoning, tool calls and observations. Trajectory evaluation grades how the agent worked, not only the final result.