The vocabulary around agents is a mess, and the mess is expensive. When “agent” means a chatbot to one person and an unattended process with write access to another, a design review produces agreement that turns out not to exist.
These are the terms as I use them across the rest of these guides, defined precisely enough to argue with. Where a term is routinely conflated with another, I’ve said which and why the distinction matters — that’s usually where the real content is.
The system itself
Agent
A system that selects and executes actions in a loop toward a goal, using a model to decide what to do next. The load-bearing word is selects. If you determined the sequence of steps in advance, you have a workflow with a model inside it, which is often the better design and should not be called an agent.
Autonomy level
How much the system does without human approval. Worth treating as a dimension with several settings — proposes only, proposes and executes with approval, executes unattended within a scope, executes unattended — rather than a boolean. Most production systems should sit in the middle and stay there.
Harness
Everything around the model that makes it an agent: the loop, the tool-calling machinery, context assembly, policy checks, logging. The model is a component of the harness, and in production the harness is where most of your engineering lives and most of your bugs originate.
Orchestrator
The component that runs the loop — decides when to call the model, dispatches tool calls, feeds results back, and decides when to stop. It owns the stop conditions, which makes it the place where runaway behaviour is prevented or isn’t.
Multi-agent system
Several agents whose outputs feed each other, usually specialised by role. Adds a failure class that single agents don’t have: cascading escalation, where each component behaves reasonably given its input and the aggregate is wrong. Adopt it because the tasks genuinely decompose, not because the architecture diagram looks better.
Plan
The agent’s intended sequence of steps toward the goal. May be explicit and inspectable, or implicit in a chain of tool calls. Explicit plans are much easier to gate, because a policy layer can evaluate a plan before any of it executes.
Step / turn
One model call and its resulting tool calls. The unit that budgets, timeouts, and retry limits are usually counted in.
Run
One complete execution from trigger to termination, comprising many steps. The unit that matters for accountability: run records, replay, cost ceilings, and blast radius are all reasoned about per run.
What the agent is allowed to do
Tool
A function the agent can call to read or change something outside itself. Every tool is a hole in the boundary between reasoning and consequence, which is why the description of a tool is a safety artifact rather than documentation.
Tool contract
The full specification of a tool: inputs, outputs, declared side effects, reversibility, idempotency semantics, failure states, cost, required authority, and who recovers when it fails. Distinct from a tool schema, which is usually only the input types. The gap between the two is where boundary failures live. Covered at length in Tool Contracts.
Side effect
Any change a tool causes beyond its stated purpose — the webhook, the email, the enqueued job, the invalidated cache. Undeclared side effects are contract bugs, not model mistakes: the agent acted correctly on the information it was given.
Idempotency key
A caller-supplied identifier that lets a service recognise a repeated request and apply it once. The mechanism that makes retries safe. Worth verifying rather than believing — the key is frequently accepted at the edge and ignored by the datastore, which produces retry amplification with clean-looking logs.
Capability
A specific thing the agent can do, at a specific scope. “Can refund up to $500 on orders from the last 30 days” is a capability. “Has API access” is not — it’s a credential, and describing it as a capability is how blast radius gets underestimated.
Capability token
A credential scoped to a narrow set of actions on a narrow set of resources, ideally expiring with the run. The alternative to role-based access, which breaks down for autonomous systems because roles are designed around what a person might need over a career rather than what a process needs for the next ninety seconds.
Blast radius
The worst-case set of effects a single run could produce if every decision in it were wrong. Expressed as a bounded quantity — records touched, dollars moved, customers contacted — not as an adjective. If you can’t state it as a number, you haven’t scoped the authority.
Action firewall
A layer that sits between the agent’s decision and its execution, evaluating each proposed action against policy and allowing, blocking, or escalating it. The defining property is that it is not part of the reasoning loop: nothing the model outputs and nothing the agent retrieves can alter its verdict.
Policy layer
The rules the action firewall enforces — limits, prohibitions, and escalation triggers, held as configuration rather than embedded in prompts. A rule stated in a prompt is a request. A rule enforced outside the loop is a constraint.
Guardrail
A broad, popular, and unhelpfully vague term. It gets used for prompt instructions, output filters, and hard policy enforcement, which have wildly different strength. When someone says guardrail, the useful follow-up is: is that enforced inside the model’s context, or outside it?
Human-in-the-loop gate
A required human approval before a specific action class executes. Effective, and degrades in a predictable way: gate too much and approval becomes rubber-stamping, at which point you have the cost of the gate and none of the protection. Gate by consequence, not by uncertainty.
Governing behaviour over time
Shadow mode
Running the agent against real production traffic with its actions recorded rather than executed. The bridge between “works in testing” and “allowed to act,” and the only way to observe behaviour on the real input distribution without consequences. See Shadow Mode.
Progressive rollout
Expanding autonomy in stages, each with a defined promotion criterion and a one-flag path back. For agents the useful axis is action type rather than traffic percentage — a 5% traffic rollout exposes you to every action class at once, just less frequently.
Circuit breaker
An automatic halt when a threshold is crossed — error rate, action count, spend, elapsed time. Distinct from a retry limit in that it stops the whole run or the whole system rather than one call.
Retry budget
A hard cap on how many times a run may retry. Without one, an agent that can’t recognise its own loop will keep going until something external stops it, and the something external is usually a bill.
Compensation / undo path
The counter-action that reverses a completed action, and the mechanism that runs it. “Reversible” is only a meaningful claim if the reversal is named, implemented, and tested. Build it before the action it reverses, not after the first time you need it.
Kill switch
A single control that stops all agent execution immediately, without a deploy. Sounds obvious; frequently missing. Test that it works on a schedule, because an untested kill switch is a belief rather than a control.
What the agent knows
Context window
The total text the model can consider in one call. Commonly mistaken for working memory. It’s a budget, not a filing cabinet — material placed in it is available, not necessarily attended to.
Context dilution
The degradation of instruction-following as context grows. A constraint stated once at position 40,000 may simply not govern behaviour. Reads as disobedience; is actually attention. The reason a bigger context window is not a substitute for retrieval.
Retrieval (RAG)
Fetching relevant material at query time and placing it in context. Optimises for relevance, which is why it is good at “find me something about X” and bad at “how many X are there” — retrieval is not aggregation. See Why LLMs Are Bad at Big Data.
Grounding
Tying a model’s output to verifiable source material — a retrieved document, a query result, a system of record. Reduces fabrication but does not eliminate it, since a model can cite a real source and still misstate what it says.
Semantic layer
A governed definition of business entities and metrics — what “active customer” or “revenue” means — sitting between raw data and anything that queries it. For agents it functions as a guardrail: it constrains the space of expressible questions to the ones with defined answers, and it can refuse.
Prompt injection
Content the agent reads being treated as instruction. Best understood as privilege escalation through an input channel rather than as a prompting problem — the fix is architectural (the agent shouldn’t have had that authority reachable from that channel), not lexical.
Context poisoning
Planting corrupted content where it will be read later — the retrieval corpus, persistent memory, a tool description. Differs from injection in timing: the effect is detached from the cause, which makes attribution hard.
Memory
State persisted across runs. Useful and quietly dangerous: it converts a one-time error into a durable fact, and it’s a poisoning target. Mark agent-generated memory as agent-generated, so a later run can weight it appropriately instead of treating its own past guess as ground truth.
Evidence and evaluation
Run record
The structured artifact written for every run: inputs, plan, tool calls with arguments, policy evaluations, outputs, outcome. Not the same as application logs — a log tells you what happened, a run record lets you reconstruct why. Retention on run records is a compliance question, not a storage question.
Trace
The step-by-step execution path within one run. A component of the run record, and the part people look at first during an incident.
Deterministic replay
Re-executing a recorded run in a sandbox and reproducing the same decisions. Requires that every input be captured, including retrieved content and tool responses. The capability that turns a postmortem into a regression test.
Eval set
A fixed collection of cases with known-good outcomes, run on a schedule to detect regressions. Reflects the failures you already know about, which is its value and its limit. Complements shadow mode; does not replace it.
Golden question
A query with a verified correct answer, used to check that a data-touching agent still gets the basics right. Cheap, boring, and the fastest way to detect that something upstream changed.
Invariant
A property asserted to hold across all runs regardless of correctness — never exceeds budget, never acts outside declared scope, always terminates. Cheaper to check than correctness and catches the failures that hurt most.
Calibration
Whether stated confidence matches observed frequency: of the things called 80% likely, roughly 80% should occur. Distinct from accuracy, and more useful when a system decides how much authority to exercise. See What Horse Racing Taught Me About Model Confidence.
Abstention
The system declining to answer or act. A first-class output, not a failure. An agent that cannot refuse will answer every question, including the ones it has no basis for — which is precisely the behaviour people label hallucination.
Drift
Gradual behaviour change from a model update, schema change, or shifting data distribution, with nothing failing loudly. Only detectable against a fixed baseline run on a schedule. Without one, you learn about it from a customer.
A note on “hallucination”
I’ve left it out of the list on purpose. It’s used for at least four different things — fabricated facts, incorrect aggregation over real data, misuse of a tool, and confident action on stale state — with four different causes and four different fixes. Naming any of them “hallucination” ends the investigation at the point where it should start.
The more precise vocabulary is in Agent Failure Modes, which is the companion to this page: this one defines the parts, that one names the ways they break.
The practices these terms describe are collected in The Agent Reliability Handbook, and their adversarial counterparts in Threat Modeling an AI Agent.