Glossary

How to read this

These are the definitions this site uses. They are not the only reasonable ones, and where common usage differs, that is noted rather than ignored.

The entries are grouped by area rather than alphabetically, because most of the confusion in this vocabulary comes from pairs of terms that are related and different. Reading a group together makes the distinctions clearer than looking up one word at a time.

Agents and runtimes

Agent. A system that pursues a goal by taking actions, observing results, and deciding what to do next. The defining property is the loop, not the intelligence. A program that calls a model once and returns the answer is not an agent regardless of how capable the model is.

Agentic. Describing systems built around that loop. Used here as an architectural adjective rather than a marketing one.

Harness. The software that runs an agent. It assembles context, calls a model, executes tool calls, holds state, enforces limits, records what happened, and decides when to stop. Most of the engineering in an agentic system lives here. Also called a runtime or, loosely, a framework.

Broker. A component that decides which harness, agent, or model-powered tool should receive a piece of work, dispatches it, and collects the result. It does not run the loop. A broker that grows a loop has become a harness.

Agent loop. The cycle of assembling context, asking the model what to do, executing a proposed action, appending the result, and repeating until termination.

Subagent. An agent spawned by another agent to handle a subtask, with its own context and usually its own limits.

Termination reason. Why a loop ended: completed, step limit, spend limit, time limit, policy denial, error, or cancellation. Recording this is disproportionately useful for diagnosis.

Models and inference

Model. The trained artifact that produces output from input. It contributes judgment and nothing else. It does not hold state, execute anything, or enforce limits.

Weights. The trained parameters. Open weights means these are downloadable, which is a claim about the artifact and not about training code, training data, or licensing.

Inference. Running a model to produce output. Distinct from training, which produces the model.

Provider. An organization operating models and selling access. A provider API is a hosted endpoint reaching models the provider runs.

Router. A layer that presents one interface over several providers or models, applying policy, fallback, and cost decisions. Can be a hosted service, a self-hosted proxy, or an internal abstraction.

Serving engine. Software that runs open weights with production characteristics, batching many concurrent requests. Distinct from a workstation runtime, which serves one user well and does not attempt concurrency.

Quantization. Reducing the numeric precision of weights to lower memory requirements, at some cost in quality that becomes noticeable below roughly four bits for demanding tasks.

Capability tier. A normalized description of how strong a model needs to be for a task, used so that a portable artifact can express a requirement without naming a specific model.

Context and memory

Context. Everything sent to the model for one call: instructions, tool definitions, retrieved facts, prior steps, and the current request. In agentic systems this is assembled fresh each step and is where most quality is won or lost.

Context window. The maximum context a model accepts. Larger windows let you supply more; they do not guarantee even attention across all of it, and filling one because it is available usually lowers quality.

Context assembly. The harness work of deciding what goes into context and in what order. Most problems that look like model problems are context assembly problems.

Prompt caching. Reusing a previously processed prefix at reduced cost and latency. Requires stable content first and volatile content last, which is a design rule worth following regardless of provider.

Working state. The current task: steps taken, results so far, the goal. Lives for the duration of the task.

Conversation history. What was said. Grows without bound and must be trimmed, summarized, or selectively recalled.

Long-term memory. What persists across tasks: preferences, prior decisions, learned facts. The hardest of the three, because writing to it indiscriminately produces noise that degrades every future retrieval.

Compaction. Summarizing earlier context to make room. Lossy by construction, and the loss is silent.

Tools and capability

Tool. A function an agent can call, with described arguments. Model-controlled: the agent decides when to invoke it. Where side effects live.

Resource. Data a client can read, addressed by identifier. Application-controlled: the client decides what to include rather than the model deciding to fetch.

Tool calling. A model returning a structured request to invoke a tool, rather than prose describing one. Far more reliable than asking for a format in a prompt.

Structured output. Model output constrained to a schema. Mechanisms range from instruction, which is weakest, through native tool calling, to constrained decoding, which is strongest and generally requires controlling serving.

Skill. Packaged procedural knowledge: a folder with instructions and optional supporting files, loaded when relevant. Know-how, not capability.

Progressive disclosure. Loading only names and descriptions until a task matches, then loading full instructions. What allows a large library of skills to cost almost nothing until used.

MCP server. A process exposing tools, resources, and prompts over the Model Context Protocol, usable by any conformant client.

Data and semantics

File format. How records are stored in a file. Parquet and ORC are columnar file formats.

Table format. Metadata making a collection of files behave like a table, with atomic commits, schema evolution, and history. Iceberg is a table format. A table format is not a file format and not a catalog.

Catalog. The service that resolves table names, performs atomic commits, enforces access, and vends credentials. The control point of the data layer. Distinct from a business glossary or data discovery product, which is also often called a catalog.

Snapshot. A point-in-time state of a table. Recording a snapshot identifier alongside an answer is what makes that answer reproducible later.

Semantic layer. Written definitions of what data means: authoritative sources, metric definitions, relationships, grain, freshness, and trust level.

Grain. What one row represents. Undocumented grain is a common cause of aggregations that double count.

Credential vending. A catalog issuing short-lived, scoped credentials to an authorized caller instead of clients holding long-lived storage keys.

Retrieval. Finding relevant unstructured material, usually by similarity. Good at finding text, poor at producing numbers.

Authority and accountability

Authority. What an agent is permitted to do, enforced by the code that executes actions rather than requested in a prompt.

Capability scoping. Giving an agent only the tools it should have. A tool that is not registered cannot be called.

Approval gate. A pause before a class of action, displaying the specific proposed action for a person to judge. Only meaningful if it shows the actual action and is rare enough to still be read.

Delegated authority. An agent acting on behalf of a person, with access scoped to what that person could do. The arrangement that prevents an agent from becoming a privilege escalation path.

Trace. The recorded sequence of a run: context, calls, results, decisions, and termination. The primary debugging artifact for agentic systems.

Provenance. A record connecting an artifact or a written record back to the run that produced it, usually bound by checksum or identifier.

Prompt injection. Content placed where an agent will read it, written to influence its behavior. Defended against by treating everything a tool returns as data rather than instruction, never by prompt instructions.

Standards and artifacts

Specification.A document complete enough that someone can build a compatible implementation from it without reading the reference implementation's source. A published document that does not meet that bar is documentation rather than a specification.

Conformance level. A declared subset of a specification that an implementation supports. Useful only when implementations also publish what they do not support, since partial support that looks complete is worse than partial support that is labelled.

Projection. Mapping a portable artifact onto a runtime that supports only part of it. Should be reported honestly as native, approximated, degraded, or unsupported, rather than silently applied.

Profile. A document describing a named agent: role, model or tier, tool surface, permissions, and accumulated state. Answers who an agent is, as distinct from what it knows how to do or what it can reach.

Delta. A structured description of what a session learned, applied to produce a new revision of a profile. Restricting deltas to a state section is what prevents an agent from rewriting its own contract.

Digest. A stable identifier for the content of an artifact, computed canonically so that formatting and field order do not change it. What lets an approval refer to exactly the artifact that was reviewed.

Agentic graph. A directed acyclic graph where nodes are bounded units of agentic work and edges are control-flow dependencies, written down so the plan can be reviewed before it runs.

Gate. A node in a plan that holds for an explicit human decision. Most valuable placed before the first irreversible action and before an expensive fan-out.

Success condition. A declared criterion for whether a unit of work completed, evaluated by the harness rather than asserted by the model. Without one, completion is a claim.

Cost and operations

Step. One iteration of the agent loop. Cost and latency in agentic systems scale with steps rather than with user requests, which is why step counts are the number worth watching.

Input and output tokens. What is sent and what is generated. In agentic loops the input side usually dominates, sometimes heavily, because accumulated context is resent every step. This inverts the usual instinct to optimize response length.

Fallback. Routing to an alternative provider or model when the primary is unavailable. Falling back to a different model is a silent quality change and should be recorded as an explicit field rather than inferred.

Budget. A declared ceiling on steps, wall-clock time, or spend for a unit of work. Three dimensions rather than one, because each catches a different failure: loops, hung external calls, and expensive contexts.

Evaluation set. A small collection of real tasks with recorded expected outcomes, run against every candidate model or configuration. The only reliable basis for model decisions, and the artifact whose absence quietly prevents ever changing anything.

Sandbox. Process-level isolation bounding what an agent can reach regardless of what it attempts. Necessary wherever capability is broad enough that argument-level constraints are meaningless, such as shell access or code execution.

Kinds of open

Open source. Source available under a license permitting use, modification, and redistribution, including by competitors.

Open weights. Trained parameters downloadable and runnable on your own hardware. Says nothing about training code, training data, or license terms.

Open format. A documented data or file format that multiple implementations can read.

Open interface. A documented API implemented by more than one provider, which makes clients portable regardless of what is behind it.

Open standard. A specification complete enough to implement from, with more than one independent implementation, changed in public under a stated process.

Distinctions worth keeping

A short list of pairs that get collapsed, and what is lost when they are.

Most of the confused architecture arguments in this field resolve once one of these pairs is separated. If a discussion is going in circles, checking whether two things in one row are being treated as one is usually productive.