Enterprise AI agents glossary: the terms, A to Z

The shared language one agent uses to hand work to another agent built by a different team or vendor. Each agent publishes an agent card, work is exchanged as tasks, and version 1.0.0 (12 March 2026) supports signed cards. MCP connects an agent to its tools; A2A connects agents to each other.

Read more: MCP vs A2A

The written, testable statements of what an agent must do before it goes live: which cases it handles, how accurately, within what limits, and what it must never do. They are agreed before the build starts and become the evaluation set that every later change is tested against.

Read more: Acceptance criteria for AI agents

Software that takes a goal, decides the steps, calls tools and company systems to carry them out, checks the result, and stops or hands back to a person when it should. A language model does the reasoning; the company sets the limits.

Read more: What is an AI agent?

A short, self-describing document an agent publishes so other agents can find it and call it: name, skills, endpoints, supported protocol versions and how to authenticate. In A2A it is served at a well-known URL and may be signed so a caller can verify who published it.

Read more: MCP vs A2A

A login of the agent's own, distinct from any user or shared service account, so each action it takes can be allowed, limited, logged and revoked. Microsoft Entra Agent ID and Amazon Bedrock AgentCore Identity are generally available; Google's Agent Identity API was in preview on 2 November 2026.

Read more: What is agent identity?

A company's master list of agents, one record each, with a named owner, an identity, what it can reach, a risk tier and an approval state. The Microsoft Agent 365 registry, AWS Agent Registry and Google Agent Registry are the three cloud vendors' products.

Read more: What is an AI agent registry?

What happens when agents multiply faster than anyone records them: duplicates, ownerless agents and abandoned ones spread across platforms with no central list. The fix starts with a registry and with rules that reassign or block agents nobody owns.

Read more: Controlling agent sprawl

Calling a chatbot, a scripted flow or a plain automation an agent because the word sells. Gartner warned about the practice in June 2025. Ask whether the model chooses the next step and acts through tools; a system that only follows a script is automation under a new name.

Read more: Agents vs copilots, chatbots and RPA

The broader term for systems in which AI models plan and act with some independence rather than answering one question at a time. In practice it covers single agents, multi-agent systems and the workflows that mix fixed steps with model-driven ones.

Read more: What is an AI agent?

Retrieval in which the model plans its own searches: it breaks a hard question into sub-queries, runs them, checks whether it has enough, and searches again if it does not, before answering with citations. Conventional RAG follows a fixed retrieval path and answers from whatever it returns.

Read more: Agentic RAG vs RAG

Running agents the way production software is run: build, test, approve, deploy, watch, change and retire each one through a repeatable process. It borrows from DevOps and MLOps and adds steps of its own, such as evaluating tool use and revoking an agent's identity.

Read more: Agent lifecycle management

A point where the agent pauses and a named person decides whether it continues. Risky tools are marked as needing approval; the run stops, shows the person the proposed action and its arguments, and resumes only on approve. The decision is logged with the approver's identity.

Read more: Approval gates and limitscoming

A scale for how much an agent decides on its own, from a person directing every step to the agent acting alone while a person watches. Two published scales are the five user-role levels of Feng, McDonald and Zhang (June 2025) and the four scopes of the AWS Agentic AI Security Scoping Matrix (November 2025).

Read more: Levels of autonomy, and when not to use an agent

An agent that works a screen the way a person would, from a screenshot to clicks, typing and scrolling, for systems with no API. Copilot Studio made it generally available in May 2026, Claude's API on 19 August and Gemini on 30 October, some tools and platforms in preview; each step sends a screenshot to the model, which costs tokens.

Read more: Computer-use agentscoming

Deciding what the model sees on each turn: which instructions, retrieved passages, tool results, memories and history go into the prompt, in what order, and what gets summarised or dropped. Long-running agents need it because earlier results outgrow the context window, so code assembles the prompt on every turn.

Read more: Context engineering

The amount of text a model can read and reason over in one call, measured in tokens. Everything the agent knows right now has to fit in it, and models read the start and the end of a long input more reliably than the middle.

Read more: Context engineering

The set of actions a company can take on its agents from one place: block, quarantine, stop, disable an identity, apply a policy. It reads the registry and acts on the agent. Microsoft Agent 365, AgentCore Policy and Gateway, and Google Agent Gateway each play this part.

Read more: AI agent registry and sprawl

Plumbing that lets a long-running agent or workflow survive a crash, a redeploy or a multi-day wait for approval without starting over. Each finished step is written to a durable log and replayed after a restart. AWS Lambda durable functions and Step Functions are examples.

Read more: Long-running agentscoming

A list of numbers that stands for the meaning of a piece of text, an image or an audio clip, so that similar content ends up close together. Retrieval systems compare embeddings to find passages that match a question even when the words differ.

Read more: Knowledge and retrieval

What an agent remembers about past tasks: what was asked, what it did and how it turned out. Amazon Bedrock AgentCore Memory writes an episodic record once it detects that an episode has finished, with a reflection on it, and can reuse the record in later tasks.

Read more: Types of agent memory

The European Union's law on AI, Regulation (EU) 2024/1689, in force since 1 August 2024. Its transparency duty applies to agents that talk to people from 2 August 2026. After the Digital Omnibus (Regulation (EU) 2026/1744) the Annex III high-risk obligations apply from 2 December 2027.

Read more: EU AI Act and AI agents

Checking with evidence that an agent does the job well enough to ship and keeps doing it after changes. Offline evaluation runs a fixed test set before release; online evaluation scores samples of real traffic. Both score the answer and the path the agent took to it.

Read more: Evaluation and testing

An agent with more functions, permissions or independence than its task needs, so that one bad instruction can do more damage than it should. OWASP lists it in the Top 10 for LLM Applications (LLM06 in the 2025 list), and it appears in several of the published agent incidents of 2025.

Read more: OWASP Top 10 for Agentic Applications

Another name for tool calling, used in model APIs: the model returns a structured call to a function your code defines, with the arguments filled in, and your code runs it and sends the result back. MCP standardises the same idea across systems.

Read more: Tool calling and actionscoming

A fixed set of test inputs with the expected outputs and, for agents, the expected tool calls. It grows from production failures and runs before every release and after every change to the model, a prompt, a tool or a knowledge source.

Read more: Regression testing when models changecoming

Retrieval that uses a knowledge graph as well as vectors. A model extracts entities and their relationships, summarises clusters of related entities, and answers broad questions across a whole corpus by combining those summaries. Microsoft Research published GraphRAG 1.0 on 16 December 2024.

Read more: Knowledge graphs and GraphRAGcoming

A check enforced outside the model on what goes into an agent, what it does with tools and what comes out: blocking a prompt-injection attempt, stopping a tool call that exceeds a limit, or redacting personal data in a reply.

Read more: Guardrails

Passing control of a task, with its context, from one agent to another or to a person. In the OpenAI Agents SDK a handoff is a specialised tool call between agents; in customer service products it means transferring the conversation to a human with its history attached.

Read more: Multi-agent patterns

The runtime code around a model that decides when to call it, assembles its context, runs the tools it asks for and loops until the task is done. Every major vendor now sells a managed harness: AgentCore harness (generally available 17 June 2026), Copilot Studio harnesses, Foundry's Copilot harness (preview) and OpenAI's Agents API (public beta since 10 September 2026).

Read more: Platforms and frameworks

A design in which the agent pauses at defined points and a named person decides whether it continues, supplies missing information, takes over the conversation or reviews the result afterwards. The design questions are which actions need a person, which person, and how the decision is recorded.

Read more: Human in the loop

Prompt injection that arrives through content the agent reads rather than from the person talking to it: a web page, an email, a document, a ticket or a tool result carrying hidden instructions. Many of the published agent incidents of 2025 used it.

Read more: Prompt injection

The international standard for an AI management system, published in 2023, which an organisation can be certified against. It asks for policy, roles, risk assessment, controls and continual improvement around AI. A vendor's certificate covers the vendor's service; a customer's own agents need the customer's own assessment.

Read more: NIST AI RMF and ISO 42001coming

An attempt to talk a model out of its safety rules or system instructions, usually by the person using it, so that it produces content or takes actions it was told to refuse. Prompt injection differs: it redirects the agent through attacker instructions, typed directly or hidden in content it reads.

Read more: Prompt injection

A store of entities (people, products, contracts, sites) and the relationships between them, so an agent can answer questions that depend on how things connect rather than on matching words. GraphRAG uses one alongside vector search.

Read more: Knowledge graphs and GraphRAGcoming

Giving an agent only the access its task needs, for only as long as it needs it: scoped, short-lived tokens, one repository or one project per session, read-only wherever writing is unnecessary. Several 2025 agent incidents turned on credentials broader than the task: a service role key, a stolen OAuth token, a reachable production database.

Read more: Least privilege and sandboxingcoming

Simon Willison's name (June 2025) for the combination that makes an agent dangerous: access to private data, exposure to untrusted content, and a way to send data out. An agent with all three can be steered into leaking data, so remove one leg or add a human gate.

Read more: Prompt injection

Using a second language model to score an agent's output or its tool-call path against a rubric where exact rules cannot. It scales well and carries known biases (position, verbosity, self-enhancement), so results are calibrated against human reviewers.

Read more: Offline and online evaluationcoming

The open standard an agent uses to call tools and read data in other systems through one consistent interface. The current specification is 2026-07-28, with a stateless core, and the protocol is hosted by the Linux Foundation's Agentic AI Foundation.

Read more: What is MCP?

A proxy between agents and MCP servers that applies central authentication, rate limits, logging and policy, and often presents many servers as one endpoint. Azure API Management, Amazon Bedrock AgentCore Gateway, Google Agent Gateway and Foundry Toolbox play this role.

Read more: MCP gateways and registriescoming

The official public catalogue of MCP servers, in preview since 8 September 2025. Companies run private sub-registries that pull from it and list only approved servers; Azure API Center exposes a registry endpoint of this kind.

Read more: MCP gateways and registriescoming

A program that wraps a system, such as a database, a SaaS API or a file store, and exposes it to agents as tools, resources and prompts over MCP. Each tool carries a schema for its inputs, so the model knows how to call it.

Read more: What is MCP?

What an agent keeps so it can carry on sensibly. Working memory is the context window of the current task. Long-term memory is a separate store of facts about the user (semantic), past tasks (episodic) and learned ways of working (procedural).

Read more: Agent memory and context

An attack that plants false facts or hidden instructions in an agent's long-term memory, often through ordinary-looking queries, so that later sessions act on them. It is ASI06 in the OWASP Top 10 for Agentic Applications; the defence is to validate what gets written and to be able to reset memory.

Read more: Memory privacy and retentioncoming

Choosing the model for each request automatically, by the quality and cost priorities you set, usually so that routine prompts go to a cheaper model. Microsoft Foundry model router and Amazon Bedrock Intelligent Prompt Routing (generally available 22 April 2025) do this; routing pays off only where evaluations confirm that quality holds.

Read more: Agent cost monitoring

Several agents that split one job between them, usually a lead agent that plans and hands pieces to specialists. It suits broad, parallel work, costs more tokens and is harder to keep consistent, so vendors advise getting as far as possible with one agent first.

Read more: Multi-agent patterns

A voluntary framework for managing AI risk, published by the US National Institute of Standards and Technology as AI RMF 1.0 on 26 January 2023 and built on four functions: Govern, Map, Measure and Manage. The Generative AI Profile (NIST AI 600-1, 26 July 2024) adds the risks specific to generative models.

Read more: NIST AI RMF and ISO 42001coming

An identity that belongs to a workload rather than a person: a service account, a managed identity or, now, an agent identity. Agents need their own, with delegation rules on top, so that what they do can be attributed, limited and switched off.

Read more: Agent identity and access

Recording what an agent did on each run: what it was asked, which model it called, which tools it used and with what arguments, what it retrieved, where it handed work off, how long each step took and what it cost. Traces, metrics and logs are the outputs.

Read more: Observability and cost

An agent acting with a specific person's permissions, so it sees and does only what that person could. OAuth token exchange (RFC 8693) records which agent acts for which user. The alternative is autonomous access, where the agent uses rights of its own.

Read more: On-behalf-of vs autonomous accesscoming

The standard names for traces and metrics from AI systems: spans such as invoke_agent, chat and execute_tool, and attributes for the model, the tokens and the tool calls. They moved to their own repository in June 2026 and remain in Development status, so names can still change.

Read more: Tracing AI agents

The control logic that decides what an AI system does next: which model call, tool or agent runs, in what order, and what happens when a step fails or needs a person. A workflow fixes the path in advance; an agent lets the model choose.

Read more: Orchestration and multi-agent systems

OWASP's list of the ten main risks in agent systems, published 9 December 2025 and numbered ASI01 to ASI10: agent goal hijack, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents.

Read more: OWASP Top 10 for Agentic Applications

How an agent has learned to do things: its instructions, refined over time, and the steps that worked before. It can live in model weights, in the system prompt and agent code, or in a managed store; Microsoft Foundry offers it as a memory type in preview.

Read more: Types of agent memory

Text that makes a model follow an attacker's instructions instead of its own. Direct injection comes from the person typing; indirect injection hides in content the agent reads. It is LLM01 in the OWASP Top 10 for LLM Applications 2025 and has no complete fix, so agents are designed to limit the damage.

Read more: Prompt injection

Looking things up in the company's own content before answering: find the most relevant passages, put them in the prompt, and answer with citations instead of relying on what the model memorised in training. In an enterprise it must also respect each user's permissions.

Read more: Knowledge and retrieval

A model that works through a problem in hidden steps before it answers or acts, which helps with planning and multi-step tool use and costs more time and tokens. By late 2026 reasoning is on by default in the main model families and is steered with an effort or thinking-level setting.

Read more: Platforms and frameworks

Attacking an agent on purpose before an attacker does. Automated scanners generate adversarial prompts and report an attack success rate, and people add context-specific attempts. For agents it covers prohibited actions, sensitive data leakage, task adherence and indirect prompt injection.

Read more: Red teaming AI agents

Re-running the golden dataset whenever the model, a prompt, a tool or a knowledge source changes, so that a change that breaks behaviour is caught before production. Model retirements make it routine: hosted models follow fixed lifecycles and some deployments upgrade automatically.

Read more: Regression testing when models changecoming

An isolated environment for an agent's code or browser session that limits what a mistake or an attack can reach: a container, a virtual machine or a hosted sandbox service. Access to production systems and to the internet still needs explicit controls, since test environments have leaked before.

Read more: Least privilege and sandboxingcoming

Facts an agent has stored about the world and about the user: preferences, names, past decisions. Products extract them from conversations in the background and recall them in later sessions; who may read them and when they expire are the deployer's job.

Read more: Types of agent memory

AI that staff use or build without IT knowing or approving it: a personal chatbot account, a browser extension, a coding agent on a laptop, an agent shared with half the company. In IBM's 2025 study of 600 breached organisations, one in five reported a breach due to shadow AI.

Read more: Shadow AIcoming

A model small enough to run cheaply or on a single device, used for routine agent steps such as classification, extraction and routing while a larger model handles planning and judgement. Microsoft's Phi family is one example; the smaller tiers of the frontier families serve the same purpose from the cloud.

Read more: Platforms and frameworks

One step inside a trace: a single model call, tool call, retrieval or agent invocation, with its start time, duration, attributes and any error. Spans nest, so a handoff to another agent appears as a child span of the caller.

Read more: Tracing AI agents

A lead agent that plans a task, hands pieces to specialist agents, often in parallel, and merges their results while keeping control of the conversation. Frameworks call the same pattern orchestrator-workers, manager, or agents as tools.

Read more: Multi-agent patterns

The unit a model reads and writes, a piece of a word a few characters long, and the unit it is billed in. Agents multiply tokens because every turn resends the history and each round of tool results needs another model turn; reasoning tokens are billed even when they are hidden.

Read more: Agent cost monitoring

The way a model acts: it picks a named tool, such as look up an order or create a ticket, and fills in the inputs as structured data; the runtime runs the tool, checks the result and hands it back. The model itself runs nothing.

Read more: Tool calling and actionscoming

A tool whose description, code or responses carry hidden instructions, or a trusted tool that turns malicious after adoption (a rug pull). Pinning a server's tool list and reviewing tool descriptions before approval are the defences.

Read more: MCP security

The full record of one agent run laid out as a timeline of nested steps, from the request through each model call, tool call, retrieval and handoff to the final answer. Engineers debug from it and evaluation samples it, so it needs the same access controls as any production log.

Read more: Tracing AI agents

An agent a registry has discovered that was created or is managed outside the registry's own management system. The Microsoft Agent 365 registry counts unmanaged agents separately from ownerless ones, and both counters should trend to zero.

Read more: Controlling agent sprawl

A database built to hold embeddings and to find the nearest ones to a query quickly. Azure AI Search, Amazon S3 Vectors (generally available 2 December 2025) and Google Agent Retrieval are examples; in practice it is combined with keyword search and a reranker.

Read more: Knowledge and retrieval

What the model can see right now: the context window holding the current task, recent tool results and the instructions. The model keeps none of it between calls; the application restores context from saved session state or from long-term memory.

Read more: Types of agent memory