An open protocol for interoperability between agents — discovery via Agent Cards and exchange of tasks and results — as opposed to MCP, which connects an agent to tools. (Ch. 12)

An open protocol for the agent↔human surface — a standard event stream by which a running agent emits its state, tokens, tool calls, and questions to a front-end and takes direction back. Completes the protocol trinity with MCP (agent↔tools) and A2A (agent↔agent); CopilotKit is a reference client. (Ch. 13)

Software in which a language model directs control flow at runtime, choosing actions in a loop until a goal is met. Contrast with a workflow, whose control flow is fixed by a developer. (Ch. 1)

A first-class, durable identity for an agent itself — distinct from the human principal it acts for and the workload identity it runs as. It carries the agent's owner, provenance, and entitlements, and is the unit you authorize, audit, and revoke. Emerging as a managed cloud primitive (Entra Agent ID, Bedrock AgentCore Identity). (Ch. 15)

The deliberate practice of assembling the limited context window each turn — selecting, ranking, and compacting what the model sees — treating it as a scarce, managed working set. (Ch. 7)

A privileged intermediary tricked into misusing its authority on an attacker's behalf; for agents, mitigated by acting with the user's delegated, scoped permissions rather than the agent's own. (Ch. 15)

An execution model in which workflow progress is persisted such that a run survives crashes and resumes exactly where it stopped, with completed steps never re-executed. (Ch. 4)

A deterministic check around the model that inspects inputs, outputs, and proposed actions and intervenes on policy violations — defense-in-depth, not a guarantee. (Ch. 16)

A first-class state in which a run durably pauses for human judgement (approval, correction, escalation) at essentially zero cost while waiting. (Ch. 5)

The dangerous combination of untrusted content + private-data access + external communication in one agent; their co-presence makes prompt-injection exfiltration possible. (Ch. 16)

Using a language model to score outputs against a rubric — scalable evaluation that must itself be calibrated against human labels. (Ch. 19)

An open standard connecting AI applications to external capabilities via servers exposing tools, resources, and prompts — collapsing M×N bespoke integrations into M+N. (Ch. 8)

A single internal service through which all inference flows, providing routing, fallback, caching, structured outputs, observability, cost attribution, and experimentation. (Ch. 6)

Dedicated, guaranteed model-inference capacity (versus shared, rate-limited APIs) — the capacity floor of the three-layer scaling model. (Ch. 21)

The reason-and-act loop: the model alternates between reasoning and tool calls, incorporating each observation before deciding again — the irreducible core of an agent. (Ch. 1, 7)

Retrieval-augmented generation grounds the model in retrieved documents; GraphRAG retrieves from a knowledge graph of entities and relationships for multi-hop and cross-document reasoning. (Ch. 11)

A standard (and its reference implementation) for verifiable workload identity issued as short-lived, auto-rotated cryptographic documents — replacing static secrets. (Ch. 15)

A protocol reviving HTTP 402 to let agents pay for requests programmatically (typically stablecoin), enabling machine-to-machine micropayments without human checkout. (Ch. 15)

A proxy that fronts many MCP servers as one endpoint, acting as the policy enforcement point for tool calls — authorization, tool namespacing, rate limits, guardrails, credential injection, and audit. (Ch. 22)

A catalog of MCP servers with versioned metadata used for discovery and curation. In production, a private registry pins vetted servers and versions rather than allowing arbitrary connection. (Ch. 22)

An infrastructure layer that supplies mTLS, identity-based authorization, retries, and telemetry to every service from the network substrate. Modern meshes are sidecarless — per-node (Istio ambient) or eBPF-based (Cilium). (Ch. 23)

A Linux kernel technology for running sandboxed programs in-kernel, used by Cilium to enforce identity-aware L3/L4 networking policy and observability without a per-pod proxy. (Ch. 23)

A captured memory-and-device state of a booted microVM. With copy-on-write memory, one golden snapshot is resumed into thousands of sandboxes in milliseconds, eliminating boot latency at fleet scale. (Ch. 24)

Metering is the high-volume, real-time counting of usage (the gateway is the meter point); billing is the financial-grade path that rates, invoices, and collects. Keeping them separate but reading the same events is the core design rule. (Ch. 25)

Serving many customers from shared infrastructure while isolating each tenant's data, identity, compute, policy, and cost. Modeled on a spectrum from silo (dedicated) to pool (shared) to bridge (mixed per resource). (Ch. 26)

One tenant's load degrading others on pooled capacity — acute for agents, where a runaway loop can exhaust the shared inference floor. Countered with per-tenant limits, bulkheads, and fair scheduling. (Ch. 26)

Provenance metadata tracing every derived datum (embedding, summary, graph node, training set) back to its source and tenant. The prerequisite for provable erasure, residency, and reproducible evaluation. (Ch. 27)

A systematic enumeration of how a system can be attacked, mapped to the controls that mitigate each threat. For agents it must cover the single-inference surface and the agentic surface that autonomy, tools, memory, and multi-agent coordination add. (Ch. 14)

OWASP’s catalogue of the ten most critical risks for LLM applications (2025): prompt injection, sensitive-information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system-prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. (Ch. 14)

OWASP’s agent-specific risk list (2026), prefixed ASI: agent goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents. (Ch. 14)

Agent memory organized against an explicit schema of entity and relation types — a knowledge graph — rather than free-floating vectors alone, so recall is typed, queryable, and auditable and every fact keeps lineage back to its source. (Ch. 10)

Using several specialized stores, each matched to a data class — relational for operational state, vector and graph for memory and knowledge, object store for artifacts, append-only for audit — rather than forcing every shape into one database, balanced against the operational cost of each additional system. (Ch. 27)

Using a strong, expensive model plus an eval set to generate training data, then fine-tuning a small fast model to match it on specific tasks — cutting cost and latency without losing quality where it matters. (Ch. 28)

Holding runtime credentials (API keys, tokens, passwords) in a dedicated manager and injecting them just-in-time at the boundary, scoped and short-lived, so they never enter a prompt, image, or the model's context. Distinct from identity. (Ch. 15)

Declaring the platform's infrastructure and control-plane configuration as version-controlled, reviewed, policy-checked definitions reconciled to a desired state, so environments are reproducible and every change is auditable. (Ch. 21)

A service-level objective is a target on a measured indicator (availability, latency, a quality floor); the error budget is the permitted shortfall, and it governs how fast you ship versus stabilize. (Ch. 29)

Recovery point objective (how much data you may lose) and recovery time objective (how long restoration may take) — the two numbers that frame backup and disaster recovery, above all for the durable store that is the system of record. (Ch. 29)

Adversarial evaluation — running injection, jailbreak, and exfiltration attempts as first-class, continuously-run test cases so the defenses of Ch. 16 are proven to hold and every exploit becomes a permanent regression test. (Ch. 19)