Terms and acronyms used here

A2A AGENT2AGENT

An open protocol for agents to discover each other and delegate work across framework and organizational boundaries. Reached v1.0 in April 2026 and is governed by the Linux Foundation. It mandates HTTPS, credentials in HTTP headers and authorization checks on protocol operations, while leaving the authorization model itself to the implementer.

Action envelope

The declared boundary a bounded-autonomy agent may act inside without per-action approval: named tools, parameter ranges, value ceilings, tenant scope, time window and step budget. Anything outside the envelope escalates rather than executes.

Agent card

Two meanings, both used here. In A2A, the machine-readable document a server publishes describing its skills and authentication schemes. In this governance model, the plain-language one-page record of an agent's purpose, owner, tier, tools and evaluation. Context distinguishes them.

Agent registry

The authoritative inventory of agents. Holds identity, accountable owner, purpose, autonomy tier, data classes, tools and expiry. Used as an allow-list: enforcement points reject identities that are not in it.

Agent sprawl

Uncontrolled growth in the number of agents, typically with unclear ownership and accumulated permissions. The agentic successor to service-account and application sprawl.

AIMS AI MANAGEMENT SYSTEM

The organizational management system defined by ISO/IEC 42001: policies, roles, risk processes and improvement cycles for AI. It governs how an organization manages AI, not how a specific agent is built.

Annex III

The EU AI Act list of standalone high-risk use areas, including biometrics, critical infrastructure, employment, education, essential services and law enforcement. Obligations for these systems apply from 2 December 2027 following the Digital Omnibus deferral.

ASI01–ASI10

The ten risk categories in the OWASP Top 10 for Agentic Applications, 2026 edition: goal hijack, tool misuse, identity and privilege abuse, supply chain compromise, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human–agent trust exploitation, rogue agents.

Audience-bound token

An access token that names the specific service it may be presented to. The receiver verifies it was issued for itself and rejects tokens minted for anything else, which stops a token leaked or borrowed from one service being replayed against another.

Autonomy tier (R0–R4)

How much an agent may do without a person in the loop, from R0 assisted through R1 read-only, R2 supervised action and R3 bounded autonomy to R4 delegated autonomy. Distinct from the action risk class: the tier describes the agent’s licence, the class describes the consequence of one action, and the lower of the two governs.

Blast radius

How far the damage reaches when an action is wrong: one record, one tenant, several systems, or the whole enterprise. One of the dimensions that sets an action's risk class.

CAISI NIST

NIST's Center for AI Standards and Innovation, which launched the AI Agent Standards Initiative in February 2026. Its agent identity and interoperability work is standards development in progress, not a finalized control set.

Circuit breaker

A control that halts an action path after repeated failures or repeated identical actions within a window, so a single bad decision cannot be amplified by retries or by a loop.

Compaction

Summarizing a conversation that is filling its context window, then restarting with the summary. What gets dropped is a design decision, and the compaction prompt is worth tuning against real traces.

Compensating action

The declared operation that reverses a mutating tool call. Required before a write is permitted at higher tiers, because a reversal has to exist before the thing it reverses.

Confused deputy

An attack where a component with legitimate authority is tricked into using it on an attacker's behalf. Agents are natural deputies, which is why delegated scope and audience-bound tokens matter more than usual.

Context engineering

Deciding what goes into the model's context window at each step: instructions, retrieved evidence, tool schemas, prior state, and what is compacted away. Usually a better lever than a larger window or a larger model.

Deployer

Under the EU AI Act, an organization using an AI system under its own authority. Deployer obligations differ from provider obligations, so the role has to be determined per system before controls are scoped.

Digital Omnibus

The EU package that deferred standalone high-risk obligations from August 2026 to 2 December 2027, and to 2 August 2028 for high-risk AI embedded in products regulated under Annex I.

Golden set

The curated evaluation cases an agent must pass before release, ideally drawn from real production traces and grown from every incident.

Grounding

Whether an output is actually supported by the sources cited. A grounding check is a useful probabilistic signal; it is not a guarantee, and it does not belong on the list of controls that stop an irreversible action.

Guardian agent

An agent whose purpose is to monitor, constrain or review other agents. Genuinely useful for detection and drift. Weak as a primary security boundary, because it can share failure modes with what it watches.

Hard control

A deterministic control implemented in code, configuration or infrastructure: allow-lists, value caps, tenant boundaries, egress rules, sandboxes, credential scope, idempotency. It behaves the same regardless of what the model produces.

Idempotency key

A caller-supplied identifier that lets a server recognize a repeated request as the same request. Without one, an agent retry becomes a duplicate payment.

IMDA SINGAPORE

The Infocomm Media Development Authority, which published the Model AI Governance Framework for Agentic AI in January 2026. Voluntary, and structured on four dimensions: bound the risk upfront, keep a human meaningfully accountable, enforce technical controls, enable end-user responsibility.

ISO/IEC 42001

The international AI management system standard. Thirty-eight Annex A controls across nine objectives, selected through a Statement of Applicability. Organizational rather than technical, which is why a crosswalk to it needs care.

LLM-as-judge

Using a model to score another model's output. Scales evaluation well and drifts from human judgment quietly, so agreement with human raters has to be measured as a metric in its own right.

MCP MODEL CONTEXT PROTOCOL

An open protocol standardizing how an agent reaches tools and context. Its authorization specification is OAuth 2.1 based, requires protected resource metadata, resource indicators, PKCE and audience validation, and explicitly forbids passing a received token through to downstream services.

Memory poisoning

Writing false facts into an agent's durable memory so they are treated as trusted later. Countered with provenance on every entry, scoped writes, expiry and a correction path.

NIST AI RMF

The NIST AI Risk Management Framework, organized around four functions: Govern, Map, Measure, Manage. Voluntary, widely used as the spine for AI control sets in the United States.

NIST AI 600-1

The Generative AI Profile that extends the AI RMF with more than two hundred suggested actions across twelve GenAI-specific risk categories.

OTel GenAI conventions

OpenTelemetry semantic conventions giving model and agent telemetry a shared vocabulary. Agent operations such as invoke_agent and execute_tool are still at Development stability, so pin a version and add your own extensions rather than assuming cross-vendor interoperability.

PAP POLICY ADMINISTRATION POINT

Where policies are authored, reviewed, tested and versioned. One authoritative PAP is what makes distributed enforcement coherent.

PDP POLICY DECISION POINT

The component that evaluates a request against policy and returns allow, deny, redact or escalate, together with the policy version that decided it.

PEP POLICY ENFORCEMENT POINT

Any component that actually applies a decision: the agent gateway, tool broker, memory service, retrieval layer, workflow engine, model gateway or egress proxy. There are many, deliberately.

PIP POLICY INFORMATION POINT

A source of the facts a decision needs: identity directory, data classification, agent registry, consent store, risk tier, transaction history.

PKCE PROOF KEY FOR CODE EXCHANGE

An OAuth mechanism binding an authorization code to the client that requested it, preventing interception and injection attacks. Required by the MCP authorization specification.

Prompt injection

Instructions hidden in content the agent processes, aiming to redirect it. Screening reduces frequency; channel separation and hard limits reduce impact. Only the second pair holds when screening misses.

Provider

Under the EU AI Act, the organization that develops an AI system, or substantially modifies one, and places it on the market under its own name. Building an agent on a third-party model often makes you a provider of the agent.

Reversibility

Whether an action can be undone, and at what cost: fully reversible, reversible through a compensating action, or irreversible. The single strongest input to an action's risk class.

Risk class (A1–A4)

The classification of an individual action rather than the agent as a whole, from informational reads through drafts and bounded state changes to money, entitlements and irreversible effects.

SBOM SOFTWARE BILL OF MATERIALS

The inventory of components in a release. Extended here to cover MCP servers, skills, prompt packs and pinned model versions.

Shadow mode

Running a new agent version, or a new policy, alongside the current one on live traffic without acting on its output. The cheapest confidence available before a switch.

Soft control

A probabilistic control such as injection screening, grounding scoring or guardian monitoring. Valuable for detection and drift. Never the last line in front of an irreversible action.

Subagent

A delegated agent given a narrow task and its own context, returning a condensed result. Keeps exploration detail out of the orchestrator's window.

Token passthrough

Forwarding a token received from a caller on to a downstream service unchanged. Explicitly forbidden by the MCP specification, because it makes the downstream service trust a credential neither party validated for that purpose.

Tool broker

The enforcement point in front of tool calls. Authorizes each call against live policy, exchanges the agent identity and delegated scope for a short-lived audience-bound credential, and enforces parameter and value limits.

Tool squatting

Registering a tool or server under a name an agent is likely to resolve, so calls route somewhere unintended. A reason to run a private registry rather than dynamic public discovery.

Trajectory evaluation

Scoring the whole path an agent took, not only its final answer. A correct outcome reached through an unsound path is a latent incident.

Write-ahead evidence

Recording intent, policy decision and inputs before an action executes, so that a failure to log is a failure to act. What makes an audit trail defensible rather than best-effort.

No terms match that filter. Try a shorter word.