This is a glossary of 27 key agentic AI terms — what each one means, where it came from, and one authoritative source to read for each. The vocabulary of agentic AI has moved faster than any enterprise glossary I have seen in twenty years of consulting. Terms that were lab jargon eighteen months ago now appear in Gartner press releases, vendor pricing pages, and board decks — often with three competing definitions attached. I traced this pattern in detail for one word, the harness, and the response convinced me the whole lexicon needs the same treatment: short entries with real sources, plus my own view where it matters.
One rule throughout: each term gets exactly one link, to the most reputed source I could find — the coiner, the official spec, or the analyst who made it stick. The terms fall into seven groups:
- The agent itself
- The layer around the model
- Protocols and interoperability
- Autonomy and oversight
- Security and identity
- Operations and economics
- Work and market framing
The Agent Itself
Agentic AI. AI systems that plan and execute multi-step goals with limited supervision, rather than answering one prompt at a time. Gartner made it a named strategic trend in late 2024; McKinsey’s “Seizing the agentic AI advantage” is the piece that put it in front of every board — along with the finding that most enterprises experiment and few scale.
Agent = Model + Harness (the agent loop). The now-standard equation: an agent is a model calling tools in a loop, and everything around that loop is the harness. The bluntest statement of it sits in LangChain’s official docs. Simon Willison’s “tools in a loop” framing did most of the work of settling the definition.
Agentic workflows vs. agents. A workflow follows a predefined path with LLM steps inside it; an agent decides its own path. Andrew Ng pushed “agentic workflows” into circulation in 2024, and Anthropic’s “Building Effective Agents” codified the distinction — still the best short document on when you need which. Most enterprise “agents” I review are workflows. That is usually fine. Mislabeling them is not.
The Layer Around the Model
Agent harness / harness engineering. Everything wrapped around the raw model that turns it into a working system, and the discipline of building it — named by OpenAI’s February 2026 “Harness engineering” report. I covered the evidence and the enterprise case in my harness deep dive, so I will not repeat it here.
Agent scaffold / scaffolding. The older academic sibling of harness, and still the word most arXiv papers use. Hugging Face’s agent glossary draws the cleanest line: scaffold is the behavior-defining layer (instructions, tools, format), harness is the execution runtime. Almost everyone else uses them interchangeably.
Context engineering. Curating what goes into the model’s context window — the successor discipline to prompt engineering. Karpathy defined it, Shopify’s Tobi Lütke popularized it in mid-2025, and Anthropic’s engineering guide is the reference text vendors and papers now cite. Of every term on this list, this is the one I would bet on outliving the hype cycle.
Context rot. The measured degradation of model performance as input tokens pile up — the reason “bigger context window” is not a strategy. Coined and quantified in Chroma’s 2025 technical report. It is the empirical backbone of the whole context-engineering argument.
Agent Skills / SKILL.md. Reusable, portable packages of procedural knowledge an agent loads on demand — a folder with a Markdown file, essentially an SOP for agents. Originated at Anthropic, released as an open standard in late 2025, adopted across Claude Code, Codex, Cursor, Copilot and dozens more; the Claude Code documentation is the canonical reference.
AGENTS.md. The repo-level counterpart: one conventionally named file at a repository root carrying operational context — build commands, conventions, the things that get violations rejected. Now in 60,000+ repositories under Linux Foundation stewardship; the spec lives at agents.md.
Agent memory. Persistence across sessions and beyond the context window — working memory, long-term memory, retrieval between them. The academic origin most cite is MemGPT (2023), which framed the LLM as an operating system paging memory in and out. An entire vendor category (Mem0, Zep, Letta) grew out of that paper.
Protocols and Interoperability
MCP (Model Context Protocol). The open standard for connecting agents to tools and data — the USB-C analogy stuck for a reason. Anthropic released it in November 2024; it is now Linux Foundation-governed and effectively universal. Spec at modelcontextprotocol.io. When your evaluation checklists start including “MCP readiness,” the standard has won.
A2A (Agent2Agent). The complementary standard for agents talking to each other across vendors and trust boundaries — MCP connects agents to tools, A2A connects agents to agents. Google announced it in April 2025 with 50+ partners; it too now sits under the Linux Foundation.
Tool use / function calling. The 2023-era ancestor of all of this: the model returns structured JSON naming a function and its arguments, your code executes it. OpenAI’s function calling docs defined the pattern every provider then converged on. Fully settled vocabulary now — which is what settling looks like.
Autonomy and Oversight
Multi-agent orchestration / subagents. Coordinating specialized agents — planners, workers, reviewers — on one task. “Subagent” went from niche to standard in months; IBM’s 2026 outlook carries the Gartner forecast that 70% of multi-agent systems will contain narrowly specialized agents by 2027.
Computer use / computer-using agents (CUA). Agents operating a screen the way a person does — looking at pixels, moving a cursor, clicking. Anthropic coined “computer use” in October 2024; OpenAI’s “computer-using agent” followed. Browser agents are the consumer-facing subset.
Guardrails. Programmable constraints on what an agent may say or do — the word generalized from NVIDIA’s NeMo Guardrails, the 2023 open-source toolkit that made it a product noun rather than a metaphor. Now so generic it appears in marketing copy for products that have none. Ask what the guardrail actually blocks.
Guardian agents. Gartner’s term for agents that supervise other agents — reviewers, monitors, protectors — and the formalization of the shift from human-in-the-loop to human-on-the-loop oversight. Gartner predicts the category captures 10–15% of the agentic AI market by 2030, and there is now a dedicated Market Guide. In my view this is the term most likely to make the next harness-style jump into business press.
Sandboxing. Running agent execution in an isolated environment so a mistake — or an injection — cannot reach production systems or credentials. The discipline done right is documented in Anthropic’s managed-agents architecture, where credentials live in a vault the harness is never made aware of.
Security and Identity
Prompt injection. Attacker-controlled text that hijacks an agent’s instructions — the SQL injection of the LLM era, and still unsolved. Simon Willison named it in September 2022, building on Riley Goodside’s demonstrations. Indirect injection — instructions hidden in content the agent fetches — is the agentic version, and the one that keeps me cautious about autonomy in regulated workflows.
The lethal trifecta. Willison again, June 2025: an agent with access to private data, exposure to untrusted content, and the ability to communicate externally is structurally vulnerable to data theft. Most production agents today have all three. The term is now embedded in OWASP guidance, which is how a blog coinage becomes doctrine.
Agent identity / non-human identity (NHI). Treating each agent as a first-class identity — credentialed, permission-scoped, auditable — instead of running fleets on shared service accounts. The OWASP GenAI Security Project anchors the field, including the Agentic Naming Service proposal already running in production at GoDaddy. I have written about agent identity and ANS before; it remains the most under-invested layer in most enterprise programs I see.
Agent washing. Gartner’s coinage for rebranding chatbots and assistants as agents without real agentic capability — from the same June 2025 release that predicted 40%+ of agentic projects canceled by 2027 and estimated only about 130 of the thousands of self-described agentic vendors are real. It crossed into Reuters within a day. Analyst coinages rarely move that fast.
Operations and Economics
Evals / LLM-as-judge. Systematic testing of model and agent behavior, with a stronger model grading outputs when human review does not scale. The judge paradigm was formalized in Zheng et al.’s 2023 MT-Bench paper. “Do you have evals?” has quietly become the first competence question in enterprise AI — and it filters rooms fast.
Cost per completed task / AI FinOps. Pricing agents by finished outcomes rather than tokens or seats, and building the cost visibility to know the difference. CIO.com’s harness-economics coverage is the sharpest enterprise treatment; I broke the arithmetic down in my agentic AI P&L post. One analyst’s line still holds: FinOps for agents is where cloud FinOps was in 2013.
Work and Market Framing
Digital labor. Salesforce’s framing of agents as a workforce — hired, managed, measured like headcount — productized as Agentforce. Analysts now forecast blended human-agent teams as the norm. I am wary of the metaphor’s HR baggage, but it has won the executive vocabulary battle, so learn it.
Long-running / ambient / background agents. Agents that work for hours or days without a human watching — LangChain coined “ambient agents” for the event-triggered variety, and every coding vendor now ships “background agents.” The engineering reality of keeping them on task is laid out in Anthropic’s work on harnesses for long-running agents. Autonomy over time, not intelligence, is the actual frontier here.
Vibe coding. Karpathy’s February 2025 coinage for building software by conversational delegation without reading the code — the rare AI term that reached dictionary word-of-the-year lists; Wikipedia’s entry tracks the trajectory. Its enterprise correction, spec-driven development, is the rising successor. Vibes do not pass a model-risk review.
Why a Shared Vocabulary Is a Governance Issue
Every term above eventually shows up in a contract or an audit finding — and when two parties mean different things by “guardrails” or “agent,” the gap surfaces at the worst possible moment. In my work in regulated loan origination, intent in, outcomes out only works when everyone in the room means the same thing by the words on the architecture diagram. That is what this page is for. I map deployments against my Five-Stage Agentic AI Roadmap; for the foundations, start with what agentic AI actually is, and I go deeper on control design in my books Agentic AI and Autonomy. I will keep this glossary updated as the vocabulary moves — and it will move.
Which of these terms has already reached your risk committee — and which one should have?
Go deeper with my newsletters:
- Agentic AI Architect — architecture and control design for enterprise agents
- Agentic AI Case Studies — deployment evidence and ROI teardowns
- Agentic AI P&L — cost, payback, and unit economics
- Agentic AI Governance — where autonomy meets accountability
Every edition publishes first on my Substack: agenticaiarch.substack.com.
© Dr. Harish Kotadia, Ph.D., All Rights Reserved, 2026.
Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems built on Anthropic Claude, AWS Bedrock, and Google Vertex AI.
Disclaimer: This blog post is based on publicly available academic publications, vendor documentation, open standards, and news items from reputed media sources linked above. This post is intended for educational purposes, to help the enterprise agentic AI community build a shared vocabulary from public, authoritative sources.
Views and opinions expressed here are my own and do not represent those of any employer or client, past or present. The analysis presented is my independent interpretation of the published sources linked above and does not constitute legal, financial, or consulting advice of any kind.