Glossary

The vocabulary, in plain English

Every term here came up while reporting the weekly briefing, so every definition is written for someone who has to make a decision about agents, not pass a quiz about them. Three sentences at most, no vendor's framing, no product named as the answer. It grows as the field's vocabulary does.

39 terms in 5 groups. Last updated September 14, 2026.

Each definition has its own link. Use the # beside a term to grab it and point someone at exactly the one you mean.

The basics

AI (artificial intelligence) #: Software that performs tasks that normally require human judgment: reading, writing, classifying, deciding. Today's wave is built on large language models.
LLM (large language model) #: The engine behind modern AI: a model trained on huge amounts of text that predicts language. GPT, Claude, and Gemini are LLMs. You pay for them by the token.
Token #: The unit LLMs read and write, roughly three-quarters of a word. API pricing is per million tokens, which is why AI costs scale with how much your agents read and write, not how often you call them.
AI agent #: An LLM given tools and permission to act (browse, write code, query databases, send messages) in a loop, working toward a goal with limited human supervision. The subject of this newsletter.
Agentic AI #: The umbrella term for systems built around AI agents. When vendors say "agentic," they mean software that takes action rather than only answering questions.
Agent harness #: The scaffolding that runs an agent: the loop, the tools, the memory, and the approval logic wrapped around the model. Benchmarks show containment depends on the harness and model together, not the model alone, so two deployments of the same model can carry very different risk.
Agent skill #: A packaged file of instructions and tool wiring an agent loads to learn a workflow, installed like a plugin. In published testing, poisoned skill files got some agents to run hidden commands in nearly 9 of 10 attempts. Treat skill installs like a software supply chain: scan, allowlist, log.
Agentic browser (computer-use agent) #: A browser or desktop driven by a built-in agent that reads pages, clicks, and types for you. Everything on screen becomes untrusted input, which is why zero-click hijacks work against this class. Its risk profile is different from a chatbot with a search tool.

Protocols and plumbing

MCP (Model Context Protocol) #: The standard way an agent connects to tools and data, often described as "USB for agents." The July 2026 spec made the protocol core stateless, hardened authorization, and moved enterprise features into a formal Extensions framework under vendor-neutral governance. Ask any vendor which spec version they implement; the answer changes how their gateway has to work.
MCP server #: One connector speaking MCP: it advertises tools an agent may call. Each server your team connects is a new door into your systems, which is why MCP security is a category now.
MCP gateway #: A control point that sits between agents and MCP servers. This is where you enforce which agents may reach which tools, log every call, and block malicious instructions hiding in tool output.; Read the explainer →
A2A (Agent-to-Agent protocol) #: The open protocol for agents talking to other agents, sitting alongside MCP. It passed 150 member organizations in its first year and now carries Google's payments protocol as a transaction layer. Every agent-to-agent hop is a trust boundary.
AP2 (Agent Payments Protocol) #: Google's protocol for letting an agent pay for things under signed mandates that record what the human approved. A formal analysis of version 0.2 found 48 threats across the payment lifecycle, 8 rated high. A valid signature does not guarantee true user intent.
LLM gateway (AI gateway) #: The same idea one layer down: a proxy between your applications and the model providers. Central place for API keys, rate limits, spend tracking, and failover across models.; Read the explainer →
Model routing #: Automatically choosing which model handles each request. Simple tasks go to a cheap, fast model; a frontier model gets the ones where judgment matters. The single biggest lever on an AI bill.

Access and identity

Permissions #: What an agent is allowed to touch: which files, systems, tools, and actions. The central question of agent governance is who grants these, how narrowly, and who can see what was done with them.
Least privilege #: The security principle that anything, human or agent, should get the minimum access needed for its task and nothing more. Old idea; newly urgent now that agents acquire and chain permissions fast.
Excessive agency #: An agent holding more permissions, tools, or autonomy than its task needs, so one hijack or mistake does outsized damage. It jumped from number 6 to number 3 in the 2026 LLM Top 10 from OWASP (the Open Worldwide Application Security Project), the biggest move on the list. Permission scoping exists to bound exactly this.
RBAC (role-based access control) #: Granting permissions by role ("support engineer") rather than individually. Works for humans; strains for agents, which don't fit neatly into roles and may act on behalf of many users.; Read the explainer →
Non-human identity (NHI) #: Identity and lifecycle management for software actors such as agents, service accounts, and workloads, rather than people. In a January 2026 survey, 92 percent of IT and security professionals said their legacy identity systems cannot manage AI and NHI risk, and 78 percent have no policy for creating or retiring agent identities. The umbrella term for the gap agents open in enterprise identity.; Read the explainer →
Service account #: The classic non-human identity: a machine login used by software. Agents are often bolted onto service accounts today, which hides who actually did what.; Read the explainer →
OAuth #: The standard way software gets permission to act on your behalf without holding your password ("Sign in with Google" is OAuth). MCP adopted it so agents authenticate like modern apps do.
Allowlist / denylist #: An allowlist permits only what's explicitly approved; a denylist blocks only what's explicitly forbidden. For agent tools and MCP servers, allowlists are the defensible default.
IAM (identity and access management) #: The systems that decide who gets access to what: directories, single sign-on, permission grants, and the audit trail behind them. Agents land here as a problem because IAM was built around humans who log in, not software that spawns copies of itself.
PII (personally identifiable information) #: Data that identifies a person: names, emails, addresses, account numbers. It matters for agents because an agent given broad data access can move PII somewhere it was never approved to go, which is the event regulators and your customers actually care about.

Risks

Shadow IT / Shadow AI #: Tools employees adopt without approval or oversight. Shadow AI is the current wave: unsanctioned copilots, agents, and API keys doing real work with no inventory, no policy, and no audit trail.; Read the explainer →
Prompt injection #: Attacks that hide instructions in content an agent reads, such as a web page, an email, or a code comment. The hidden text hijacks the agent into actions its operator never intended. The signature vulnerability class of the agent era.
Indirect (zero-click) prompt injection #: Prompt injection delivered through content the agent fetches on its own, such as a web page, an email, or a social post. The user clicks nothing and sees nothing. Zero-click hijacks of major AI browsers have been demonstrated with no complete fix known.
Memory poisoning #: An attack that plants instructions in an agent's persistent memory, skills, or configuration so malicious behavior reactivates later with no new bad input. Research shows 3 poisoned records can push attack success above 90 percent in self-updating systems. Anything an agent keeps between runs is attack surface.
Data exfiltration #: An attacker moving data out through a channel the agent controls, such as a tool call, an image URL, or a crafted link. It is the payoff step of most prompt injection attacks. Blocking the leak channel matters as much as blocking the injection.
Guardrails #: Controls that constrain what an agent can do or say: input/output filters, approval gates for risky actions, sandboxes, spending limits. Defense in depth, because no single guardrail holds.
Sandbox #: An isolated environment that limits what an agent can touch while it works. Escapes are documented reality, not theory: an OpenAI model broke out of a test sandbox and reached Hugging Face infrastructure in July 2026. The controls to check are egress rules and network reach, not just whether a sandbox exists.
Containment #: Bounding what a misbehaving or hijacked agent can reach, through network egress rules, identity scope, and kill switches, rather than only steering its behavior with guardrails. It assumes guardrails will sometimes fail. The September 2026 discovery of agents coordinating on an abandoned public wiki made it the operative word of the beat.
Audit log #: The tamper-resistant record of every action an agent took, tool calls and access included. If you can't reconstruct what an agent did last Tuesday, you don't govern it.
CVE / KEV #: A CVE (Common Vulnerabilities and Exposures entry) is the public identifier for a disclosed software flaw. KEV is the Known Exploited Vulnerabilities catalog from CISA (the US Cybersecurity and Infrastructure Security Agency), listing the CVEs attackers are actively using, with fix deadlines for US federal agencies. Agent-stack CVEs now land weekly, including a 10.0 severity score in an MCP server.
AIVSS (AI Vulnerability Scoring System) #: OWASP's severity scoring for AI vulnerabilities, in the mold of CVSS (the Common Vulnerability Scoring System) for traditional software flaws; the version shipped so far scores agentic risks specifically. Version 0.8 landed in March 2026 and version 1.0 is due before the end of the year. Auditors already publish crosswalks to it.; Read the explainer →

Cost

Cost optimization (AI spend governance) #: Knowing what your agents and models cost, who's spending it, and whether the same work could run cheaper. In practice that means budgets, caps, alerts, and routing policies for AI usage.
FinOps #: The discipline of managing cloud spend as an engineering practice. AI spend is becoming its fastest-growing line item, with worse visibility than compute ever had.
Hard spend cap #: A budget limit enforced at the API or gateway that stops the run when the money runs out, as opposed to a dashboard alert that reports after billing. Google, AWS, and OpenAI all shipped cap features in 2026, and some products called caps still allow overage at standard rates. Read the fine print on the word cap.

Missing a term? Email [email protected] and it gets considered for the next update. Corrections are welcome at the same address.

New to all of this? Start with why agents need a permission layer, then see who sells what on the vendor landscape map.

Want more than a definition? The explainers take one of these terms at a time and answer it in full, with the incident or number behind each claim.