Glossary

How to read this

These are the definitions I use. They are not the only reasonable ones, and where common usage differs I have said so rather than pretending there is consensus.

The grouping is by area rather than alphabetical, because most confusion in this vocabulary comes from pairs of terms that are related and different. Reading a group together makes the distinctions clearer than looking up one word at a time.

Agents and runtimes

Agent. A system that pursues a goal by taking actions, observing results, and deciding what to do next. The defining property is the loop, not the intelligence. A program that calls a model once and returns the answer is not an agent regardless of how capable the model is.

Harness. The software that runs an agent: the loop, context assembly, tool execution, state, limits, recording, and termination. Most of the engineering in an agentic system lives here.

Broker. A component that decides which harness or agent should receive a piece of work, dispatches it, and collects the result. It does not run the loop. A broker that grows a loop has become a harness.

Bot. In my tooling specifically, a profile bound to a preferred harness with an optional fallback. The definition plus the routing preference.

Subagent. An agent spawned by another to handle a subtask, with its own context and usually its own limits.

Termination reason. Why a loop ended: completed, step limit, spend limit, time limit, policy denial, error, or cancellation. One recorded field with disproportionate diagnostic value.

Models and inference

Model. The trained artifact that produces output from input. It contributes judgment and nothing else. It holds no state, executes nothing, and enforces nothing.

Provider. An organization operating models and selling access.

Router. A layer presenting one interface over several providers or models, applying policy, fallback, and cost decisions. Can be a service, a proxy, or a function in your own code.

Capability tier. A normalized description of how strong a model needs to be for a task, so a portable artifact can express a requirement without naming a model. Used in both the profile and graph specifications for the same reason.

Fallback. Routing to an alternative when the primary is unavailable. Falling back to a different model is a silent quality change and should be an explicit recorded field rather than something inferred.

Context and memory

Context. Everything sent to the model for one call: instructions, tool definitions, retrieved facts, prior steps, and the current request. Assembled fresh each step, and where most quality is won or lost.

Context assembly. The harness work of deciding what goes into context and in what order. Most problems that look like model problems are context assembly problems.

Working state. The current task: steps taken, results so far, the goal. Belongs to the harness and should survive a restart if the task is long.

Conversation history. What was said. Grows without bound, has to be trimmed, and is mostly disposable.

Long-term memory. What persists across tasks: preferences, prior decisions, learned facts. The hardest of the three, because writing indiscriminately produces noise that degrades every future retrieval.

Promotion. The deliberate act of writing something into long-term memory, with a reason. My position is that this should be explicit rather than automatic, because memory that accumulates by default gets worse as it grows.

Supersession. Marking that a new fact replaces an old one. More work at write time and the thing that keeps a long-lived memory store coherent.

Recall bundle. A retrieved subgraph rather than a ranked list of fragments. Returns connected context, including the reasoning behind a fact rather than only the fact.

Compaction. Summarizing earlier context to make room. Lossy by construction, and the loss is silent, which is why durable things should not live only in conversation history.

Tools and capability

Tool. A function an agent can call, with described arguments. Model-controlled: the agent decides when to invoke it. Where side effects live.

Resource. Data a client can read, addressed by identifier. Application-controlled: the client decides what to include rather than the model deciding to fetch.

Skill. Packaged procedural knowledge: a folder with instructions and optional supporting files, loaded when relevant. Know-how, not capability.

Progressive disclosure. Loading only names and descriptions until a task matches, then loading full instructions. What lets a large library of skills cost almost nothing until used.

Recipe. In my tooling, a saved reusable workflow for a repeated operation. Procedure with parameters, closer to a script than to a skill.

MCP server. A process exposing tools, resources, and prompts over the Model Context Protocol, usable by any conformant client.

Contracts and artifacts

Specification.A document complete enough that someone can build a compatible implementation without reading the reference implementation's source. A published document that does not meet that bar is documentation.

Profile. A document describing a named agent: role, model or tier, tool surface, permissions, and accumulated state. Who an agent is, as distinct from what it knows or what it can reach.

Delta. A structured description of what a session learned, applied to produce a new profile revision. Restricting deltas to the state section is what prevents an agent rewriting its own contract.

Proposal. A recorded request for a capability change, with a written rationale, held for human review. The mechanism that turns a refusal into a decision with evidence.

Narrowing. The rule that a profile can only reduce capability relative to what the harness already allows, never expand it. The property that makes a portable agent file safe to accept from anyone.

Digest. A stable content identifier computed canonically, so formatting and field order do not change it. What lets an approval refer to exactly the artifact that was reviewed.

Conformance level. A declared subset of a specification that an implementation supports. Useful only when implementations also publish what they do not support.

Projection. Mapping a portable artifact onto a runtime supporting only part of it. Should be reported as native, approximated, degraded, or unsupported rather than silently applied.

Agentic graph. A directed acyclic graph where nodes are bounded units of agentic work and edges are control-flow dependencies, written down so the plan can be reviewed before it runs.

Gate. A node that holds for an explicit human decision. Most valuable before the first irreversible action and before an expensive fan-out.

Success condition. A declared criterion for completion, evaluated by the harness rather than asserted by the model. Without one, done is a claim.

Authority and accountability

Authority. What an agent is permitted to do, enforced by the code that executes actions rather than requested in a prompt.

Capability scoping. Giving an agent only the tools it should have. A tool that is not registered cannot be called.

Credential vending. A service issuing short-lived, scoped credentials to an authorized caller instead of clients holding long-lived keys.

Approval gate. A pause before a class of action, displaying the specific proposed action. Only meaningful if it shows the real action and is rare enough that people still read them.

Delegated authority. An agent acting on behalf of a person, scoped to what that person could do. What prevents an agent from becoming a privilege escalation path.

Trace. The recorded sequence of a run: context, calls, results, decisions, termination. The primary debugging artifact.

Provenance. A record connecting an artifact or a written row back to the run that produced it, usually bound by checksum or identifier.

Prompt injection. Content placed where an agent will read it, written to influence its behavior. Defended against by treating everything a tool returns as data, never by prompt instructions.

Data and semantics

Table format. Metadata making a collection of files behave like a table, with atomic commits, schema evolution, and history. Not a file format and not a catalog.

Catalog. The service that resolves table names, performs atomic commits, enforces access, and vends credentials. The control point of the data layer, and distinct from a business glossary, which is also commonly called a catalog.

Snapshot. A point-in-time state of a table. Recording a snapshot identifier alongside an answer is what makes that answer reproducible later.

Semantic layer. Written definitions of what data means: authoritative sources, metric definitions, relationships, grain, freshness, and trust level.

Grounding. Working from retrieved facts and written meaning rather than from model recall. What makes an answer checkable rather than merely plausible.

Kinds of open

Open source. Source available under a license permitting use, modification, and redistribution, including by competitors.

Open weights. Trained parameters downloadable and runnable on your own hardware. Says nothing about training code, training data, or license terms.

Open format. A documented data or file format multiple implementations can read.

Open interface. A documented API implemented by more than one provider, which makes clients portable regardless of what is behind it.

Open standard. A specification complete enough to implement from, with more than one independent implementation, changed in public under a stated process.

Distinctions worth keeping

The pairs that get collapsed, and what is lost when they are.

Most of the circular architecture arguments I have been in resolved once one of these pairs was separated. If a discussion is going nowhere, checking whether two things in one row are being treated as one is usually productive.