Glossary
The language of the agent economy, without the theatre.
The same term is often used to describe different products, architectures and levels of autonomy. This glossary explains how The Agentic Observer uses the most important words. Definitions describe functions, not endorsements of any particular implementation.
A
- Agent
- Software that pursues a goal through some combination of reasoning, planning, tool use, state and action. The term does not imply full autonomy, reliability or authority.
- Agent card
- A machine-readable description of an agent’s identity, capabilities, skills, endpoint and interaction requirements within the A2A ecosystem. A card describes a claim about capability; it is not automatically proof of performance or trustworthiness.
- Agent economy
- The market of applications, infrastructure, services and institutions created as agents perform work and interact with people, systems, organisations and other agents.
- Agent identity
- The identifiers and credentials used to distinguish an agent or agent instance. Identity should be connected to a principal, owner and deployment context to become economically meaningful.
- Agentic
- Describes software behaviour involving goal pursuit, planning, tool use and action. It should not be used as a synonym for every feature that contains a language model.
- Agentic commerce
- Commerce in which agents participate in product discovery, selection, negotiation, checkout, payment, order management or post-purchase activity on behalf of people or organisations.
- Agentic Map
- The Agentic Observer’s taxonomy of the application, infrastructure, trust and commercial layers forming around the agent economy.
- Agent-to-Agent Protocol (A2A)
- An open standard enabling independent agents to discover capabilities, communicate, exchange tasks and collaborate across frameworks and vendors.
- Approval gate
- A point in a workflow where the agent cannot continue until an authorised person or system permits the proposed action.
- Attestation
- Evidence about the identity, integrity, configuration or execution environment of a software component. Attestation can help a relying party decide whether to trust an agent or workload.
- Autonomous agent
- An agent able to complete meaningful parts of a workflow without case-by-case human instruction. Autonomy is a degree, not a binary state.
B
- Benchmark
- A repeatable test used to compare performance against a task or reference set. A benchmark is useful only to the extent that it represents the buyer’s real workflow and remains resistant to gaming or contamination.
- Bounded autonomy
- Authority to act independently inside explicit limits such as value, time, data, audience, counterparty or action type.
C
- Capability
- A task or function an agent is designed to perform. Public capability descriptions should be treated as claims until supported by evidence in the intended environment.
- Computer use
- An agent’s ability to interact with a graphical user interface through actions such as viewing, clicking, typing and navigating, rather than through a dedicated API.
- Confidence
- An estimate or signal about uncertainty. Model confidence should not be treated as a calibrated probability of correctness unless specifically validated.
- Consent
- Permission from the relevant person or organisation for data use, communication or action. Consent must be connected to scope, purpose and withdrawal where required.
- Context
- The instructions, conversation, retrieved information, tool results and state available to a model or agent while it performs a task.
- Control plane
- The layer used to configure, govern, observe and change the behaviour and authority of agents across an organisation.
- Credential
- A secret, token, certificate or verifiable assertion used to authenticate a person, service, workload or agent.
D
- Determinism
- The degree to which the same input produces the same behaviour or result. Agent systems are often non-deterministic because models, tools and environmental state can vary.
- Digital worker
- A commercial label commonly used for agent systems designed to perform a job-like collection of tasks. The term does not establish employment status, accountability or human-equivalent capability.
- Dispute resolution
- The process for investigating and resolving disagreement about an agent-mediated action, service or transaction.
E
- Escalation
- Transfer of a task, decision or exception from an agent to an authorised person or higher-control process.
- Evaluation
- Structured measurement of an agent’s quality, reliability, policy compliance, trajectory, outcome and economics before and during deployment.
- Evidence label
- The Agentic Observer’s visible classification of a material statement as Verified, Supported, Vendor Claim or Unknown.
- Exception
- A case that cannot safely or correctly follow the normal workflow because information, policy, risk or circumstances differ.
F
- Forensic replay
- Reconstruction of an agent’s instruction, evidence, tool calls, decisions, approvals and actions after an incident or disputed result.
- Foundation model
- A model trained broadly enough to support many downstream tasks and applications, often through prompting, retrieval, tools or fine-tuning.
G
- Goal
- The outcome an agent is instructed to pursue. A well-specified goal includes constraints and acceptance criteria, not only an aspirational result.
- Guardrail
- A control intended to reduce unsafe, incorrect or unwanted behaviour. Guardrails may be advisory, detective or enforcing; the term should not imply a hard boundary without evidence.
H
- Hallucination
- Plausible-seeming output not grounded in reliable evidence. In an agent workflow, hallucination can influence tool use and actions, not only text.
- Hand-off
- Transfer of work and context between agents or from an agent to a person. A good hand-off preserves state, evidence, ownership and next action.
- Human in the loop
- A workflow in which a person reviews, approves, corrects or completes some part of agent work. The phrase should specify when the person enters and what decision they make.
- Human on the loop
- A supervisory model in which people monitor and intervene in agent operation rather than approving every normal action.
I
- Identity provider
- A system that authenticates identities and supplies credentials or assertions used by relying applications.
- Inference
- The process of running a trained model to produce an output from an input.
- Intent mandate
- Within AP2, a signed representation of a user’s instruction and constraints for an agent-mediated transaction.
- Interoperability
- The ability of systems, tools and agents from different vendors or frameworks to communicate and work together through shared formats and protocols.
K
- Know Your Agent (KYA)
- An emerging and non-standardised phrase for identifying, credentialing or assessing an AI agent. The term may refer to different controls across vendors and should be inspected carefully.
- Kill switch
- A mechanism for suspending an agent, revoking authority or preventing further action. A credible kill path should be tested, not merely documented.
L
- Large language model (LLM)
- A model trained on large text and data corpora to predict and generate language and related representations. An LLM may be a component of an agent; it is not the complete agent system.
- Least privilege
- The principle that an identity should receive only the access necessary for the task, for no longer than necessary.
M
- Mandate
- A recorded instruction and set of constraints defining what an agent is authorised to do for a principal.
- Machine-readable contract
- A structured representation of commercial terms, scope, service levels or acceptance conditions that software can interpret. Machine-readable does not automatically mean legally enforceable.
- Memory
- State retained across interactions or tasks. Agent memory may include conversation, preferences, facts, summaries or workflow state and requires controls for accuracy, privacy and deletion.
- Metering
- Measurement of usage, work or outcomes for billing, cost allocation or operational management.
- Model Context Protocol (MCP)
- An open protocol for connecting AI applications to external tools and data through a standard client-server model.
- Multi-agent system
- A system in which several agents coordinate or divide work. Multiple agents increase the need for ownership, hand-off, state, conflict and failure controls.
N
- Non-human identity
- An identity assigned to software, a workload, service, machine or agent rather than a person.
O
- Observability
- The ability to understand internal behaviour from traces, logs, metrics, state and outcomes. For agents, this includes trajectories, tool calls, policy decisions and hand-offs.
- Orchestration
- Coordination of tasks, state, tools, models, agents and people across a workflow.
- Outcome verification
- The process of determining whether agreed work or a commercial result was actually completed to the acceptance standard.
P
- Policy engine
- A system that evaluates rules and context to decide whether an action should be allowed, denied or escalated.
- Principal
- The person or legal entity on whose behalf an agent acts.
- Prompt injection
- An attack or failure mode in which untrusted content attempts to alter an agent’s instructions or induce unintended behaviour.
- Provenance
- The recorded origin and history of data, evidence, instructions and outputs used in an agent decision.
R
- Red teaming
- Structured adversarial testing intended to expose unsafe behaviour, security weaknesses and failure modes before attackers or production conditions do.
- Reputation
- An assessment of expected reliability based on past behaviour, evidence or third-party signals. Agent reputation is difficult because identities, models, owners and configurations can change.
- Retrieval-augmented generation (RAG)
- An architecture that retrieves relevant information and supplies it to a model at run time to ground or improve a response.
- Revocation
- Withdrawal of a credential, permission or mandate so an agent can no longer perform an action.
- Runtime
- The environment in which an agent executes, maintains state, calls tools and coordinates work.
S
- Sandbox
- An isolated environment used to limit the systems, files, network or actions available during agent execution.
- Service level agreement (SLA)
- Contractual commitments about service availability, response, quality or remedies. Agent-delivered work may require task- and outcome-specific service levels beyond uptime.
- Software actor
- A useful neutral term for software capable of performing actions in a system. It avoids implying personhood or legal status.
- Spending control
- A rule limiting the value, category, counterparty, frequency or timing of agent-initiated financial action.
- Stateful agent
- An agent that retains workflow or interaction state across steps or sessions.
- Stateless agent
- An agent or protocol interaction that does not depend on server-retained state between requests, unless state is supplied externally.
- Structured output
- Model output constrained to a defined schema so software can parse and use it more reliably.
- Supervisor agent
- An agent responsible for routing, reviewing or coordinating the work of other agents. A software supervisor does not remove the need for human accountability.
T
- Task
- A bounded unit of work with inputs, actions, result and completion state.
- Tool
- An external function, API, application or interface an agent can invoke to obtain information or take action.
- Tool call
- A structured request by a model or agent to invoke a tool with specified arguments.
- Trace
- A record of steps taken during a model or agent execution, often including inputs, outputs, tool calls, timing and nested operations.
- Trust boundary
- The point at which data, identity or control passes between systems or parties with different trust assumptions.
U
- Universal Commerce Protocol (UCP)
- An open protocol for commerce capabilities such as discovery, checkout, identity linking, orders and payments across agentic shopping experiences.
- Usage-based pricing
- Charging according to consumption such as calls, tasks, tokens, minutes, records or transactions.
V
- Verifiable credential
- A cryptographically verifiable statement issued by one party about an identity or attribute and presented to another.
- Vendor claim
- An assertion made by a company that The Agentic Observer represents accurately but has not independently verified.
W
- Wallet
- A system for holding and using payment credentials or digital assets. Agent wallets require funding, policy, custody, spending limits and reconciliation.
- Workload identity
- An identity assigned to an application, service or computing workload so it can authenticate without using a person’s credentials.
X
- x402
- An open protocol that uses HTTP’s `402 Payment Required` flow to quote and settle payment for a digital resource inside the request interaction.
A definition should make the market clearer.
If a term is missing, contested or being used to conceal an important distinction, tell us.