| Term | Working definition |
|---|---|
| Ablation | Deliberately remove or change one component at a time to isolate its effect on system behavior. |
| ACL (Access Control List) | A mapping of which principals may access a resource and what actions they may perform. |
| Adaptive sampling | Allocate more repeated eval runs to cases with higher risk, variance, or uncertainty instead of sampling every case equally. |
| Admission control | Decide whether work is allowed to enter the system based on current capacity, quotas, or policy. |
| Agent harness | The runtime around the model that owns execution loops, tools, context, limits, state, tracing, and policy integration. |
| Agent-as-tool | A specialist agent performs a subtask while a parent agent retains conversational ownership and synthesis. |
| At-least-once delivery | An operation may be delivered more than once; consumers must tolerate or deduplicate duplicates. |
| At-most-once delivery | An operation is not retried in ambiguous cases, avoiding duplicates at the cost of potentially missing work. |
| Authoritative state | The trusted current state held by a system of record, not inferred from conversation history. |
| Autonomy budget | Explicit limits on how far an agent may run: turns, tool calls, wall-clock time, token/cost budget, concurrency, or side effects. |
| Backpressure | Mechanisms that slow, queue, limit, or reject upstream work when downstream capacity is saturated. |
| Blast radius | The maximum scope of damage or unintended effect a failure, compromise, or bad decision can cause. |
| Bounded retry | A retry policy with explicit limits, usually including delay/backoff and a terminal failure state. |
| Capability boundary | The set of actions a component is technically able and permitted to perform. |
| Canary | A limited release of a candidate version to a small subset before wider deployment. |
| Confusion matrix | A table showing which classification labels or routes are being mistaken for which others. |
| Context engineering | The deliberate design of what information enters the model context, when, and in what form. |
| Controlled experiment | Hold relevant conditions fixed while changing a specific variable so causal attribution is possible. |
| Defense in depth | Use multiple independent controls so failure of one does not directly become compromise. |
| Deterministic grader | Code-based evaluation logic that asserts exact, checkable criteria. |
| Effective action space | The set of tools or actions the model can choose from in the current context. |
| Exactly-once semantics | A guarantee that an operation has one externally visible effect; difficult without downstream support and idempotent design. |
| Failure taxonomy | A structured classification of failure modes used to diagnose and prioritize remediation. |
| Grounding | Tie a generated answer or decision to relevant evidence from trusted or retrieved sources. |
| Handoff | Transfer active task or conversational ownership from one agent to another. |
| Idempotency | Repeating an operation with the same identity does not create duplicate side effects. |
| Least privilege | Grant only the minimum permissions required to perform the intended job. |
| LLM-as-judge | A model execution used to score fuzzy properties of another model/agent output. |
| Load shedding | Intentionally reject or defer lower-priority work to protect system health during overload. |
| MCP | Model Context Protocol; a standardized way for clients to discover and invoke tools/resources/prompts from capability providers. |
| Outcome distribution | The range and frequency of results produced by repeated executions of a stochastic system. |
| Planner | A component that determines which steps or tasks are required to achieve an objective. |
| Prompt injection | Untrusted content attempts to alter model behavior or override intended instructions. |
| RAG | Retrieval-Augmented Generation; retrieve relevant knowledge and place selected evidence into model context. |
| Reconciliation | Determine actual system state after an ambiguous or partial result, usually by querying authoritative sources. |
| Reserved capacity | Resources held for a specific workload class so other traffic cannot consume all available capacity. |
| Router | Chooses which domain, workflow, agent, or tool set should receive a request. |
| Semantic tool | A narrow capability expressed in business terms, such as update_opportunity_stage(), rather than a generic API primitive. |
| Specialist agent | An agent with distinct instructions, context, tools, permissions, model, or risk profile for a particular responsibility. |
| Starvation | A scheduling failure where low-priority work receives little or no capacity for an unbounded period. |
| Trajectory | The sequence of model decisions, tool calls, observations, confirmations, and intermediate states during an agent run. |
| Trust boundary | A point where data or authority moves between components with different trust assumptions. |
| Variance | Run-to-run spread in results from a stochastic system. |
| Weighted scheduling | Allocate capacity among workload classes according to configured shares or priorities. |
| Workload isolation | Separate queues, quotas, workers, or resources so one workload cannot degrade others. |
Ten sentences worth memorizing
The model can propose the action; deterministic systems decide whether it is allowed.
Use the model for semantic judgment under ambiguity; use traditional software for authority, state, guarantees, and known workflows.
Retrieved content is data, not authority.
RAG is for unstructured knowledge; tools are for authoritative transactional state.
User confirmation establishes intent; it does not grant authority.
Because the system is stochastic, compare distributions rather than individual executions.
I would reduce the model’s effective action space rather than just asking it to choose better among forty tools.
Priority should not mean starvation.
I would not claim exactly-once semantics if the downstream API does not provide the primitives required to implement them.
Production failures should become regression cases.