The vocabulary
The words you will be sold, defined honestly
You are about to be quoted for agentic software by people who use these terms loosely. This page defines each one in plain language and then says what it means for a decision you actually have to make. Quote it, print it, bring it to someone else's sales call.
The substrate
- Model also: LLM, foundation model, frontier model
- A very large statistical function that takes text in and produces the most plausible continuation. It has no memory between calls, no goals and no awareness of time. Everything else in this field is built on top of that one operation.
- So what: the model is a commodity you rent by the word. It is not the product, yours or anyone's.
- Token
- The unit models read and write — roughly three-quarters of an English word, and rather less efficient in Arabic. Billing is per token, in and out.
- So what: cost scales with how much context you resend, not with how clever the task is. A badly built agent that re-reads the same document forty times costs forty times as much for identical work.
- Context window
- How much text the model can hold at once — the prompt, the documents, the conversation so far, and the tool results. Large today, but finite, and everything in it is re-read on every single turn.
- So what: "it remembers everything" is either a context window being refilled behind the scenes, or a retrieval system. Ask which, because they fail differently.
- Inference
- One run of the model. A single agent step is typically several inferences; a job with a ten-step plan can be dozens.
- Training, fine-tuning, and what agents do instead
- Training builds the model. Fine-tuning adjusts one for a narrow task and needs data, money and evaluation. Agent products almost never do either — they change the instructions and the context, which is cheap, reversible and why the field moves so fast.
- So what: if a vendor says the agent "learns your business", ask what physically changes. Usually it is a file of notes — which is fine, and is a different claim.
- RAG retrieval-augmented generation
- Search your documents, paste the best matches into the prompt, then answer. The dominant way of getting a model to speak about your own material.
- So what: RAG quality is search quality. When the answer is wrong, the retrieval usually failed before the model did.
- AGI artificial general intelligence
- A hypothetical system matching human ability across essentially all cognitive work. There is no agreed definition, no agreed test, and no agreed date.
- So what: AGI is irrelevant to your purchase. A vendor who raises it in a commercial conversation is changing the subject away from whether their product works on Tuesday.
The agent layer
- Tool use also: function calling
- The model is given a list of functions it may request, with their parameters. It does not execute anything — it emits a request, your software decides whether to honour it, runs it, and hands the result back.
- So what: your software is always the one acting. "The AI did it" is never true at the boundary that matters, which is also where the liability sits.
- Agent the actual definition
- A model, plus a loop that keeps calling it until a goal is met, plus a list of tools it may request. That is all. Everything vendors differentiate on lives in the third part.
- So what: the list of permitted tools is the product, and it is also the security model, the cost model and the risk profile.
- The agent loop
- Reason, act, observe, repeat. Each turn the model sees everything that happened before and chooses the next move. The loop ends on success, on a limit, or on a stop you placed deliberately.
- So what: ask where the loop stops. A loop with no designed stop stops by running out of budget.
- MCP Model Context Protocol
- An open standard for how a model connects to a tool or data source — a common plug shape, so any compliant client can use any compliant server. Widely adopted across the industry, now maintained as an open project.
- So what: adopt it, never reinvent it — but note that MCP standardises the connection, not the safety. An MCP server can still do something catastrophic; the protocol has no opinion about that.
- Connector
- The concrete piece of software that reaches one specific system — your ERP, your mailbox, your files — and exposes a defined set of operations. Where MCP is the plug, a connector is the appliance.
- So what: connector depth is where projects live or die. Fifty shallow connectors are worth less than one that understands the system's own rules. Ask what happens on a write, not on a read.
- Skill
- A packaged set of instructions and reference material an agent can load when a task calls for it — a written procedure rather than new capability. Loaded on demand so it does not consume the context window when irrelevant.
- So what: skills are cheap, portable and genuinely useful, and they are also just text. A skill cannot make an agent able to do something it has no tool for.
- Subagent
- A second agent run started by the first, with its own fresh context, to do a self-contained piece of work and report back a conclusion.
- So what: useful for reading — search four places at once and return four answers. Dangerous for deciding, because splitting a decision across contexts is how agents contradict themselves. Fan out to read; one thread decides.
- Hat also: role, persona, digital worker
- A named agent with a written remit — "the bookkeeper", "the follow-up officer". A useful organising idea and completely standard across the industry.
- So what: this is table stakes, not a differentiator. What matters is whether the hat comes with enforced limits or only a personality.
- Multi-agent system
- Several agents collaborating, handing work between them. Impressive in demonstrations. In practice it multiplies token cost several times over and adds a coordination failure mode where agents disagree or lose the thread across a handoff.
- So what: justified when the work genuinely parallelises. A tax the rest of the time, paid in money and in unreproducible bugs.
- Orchestration
- The machinery that decides which agent runs, when, with what input, and what happens when one fails. Schedulers, queues, retries, dependency graphs.
- So what: this is rapidly becoming a free platform feature from the model vendors. It is not where a small company should be investing, and we say so about our own.
The control layer — where the real questions are
- Human in the loop HITL, approval, the gate
- A designed stop where a person approves, amends or refuses before the agent proceeds. Universally available in serious products; almost universally implemented at the wrong granularity.
- So what: ask what the unit is. "Supervised or autonomous" as a per-agent toggle forces a choice between useless and frightening. Per-act is the granularity your own delegation of authority already uses.
- Guardrail
- An overloaded word covering two very different things: instructions telling the model what not to do, and code that makes something impossible. Vendors use the same word for both.
- So what: this is the single highest-value question in a demo. "Is that guardrail a sentence in the prompt, or is it a thing the code will not do?"
- Prompt injection
- An attack where instructions hidden in content the agent reads — a document, a web page, an email — are followed as if you had given them. There is no reliable defence at the model level, and this is the consensus position, not a pessimistic one.
- So what: assume it will succeed and design for the blast radius. The right question is what an attacker with full control of the agent's reading could cause to happen.
- Hallucination
- Fluent, confident, false. Not a bug to be patched out — a property of producing plausible continuations. Retrieval and tool use reduce it; nothing eliminates it.
- So what: any workflow whose errors are silent is the wrong first workflow, however attractive it looks.
- Eval evaluation, benchmark
- A repeatable test of whether the system does the job correctly, run against cases with known right answers. The weakest area in the entire industry: almost nobody can tell you how they know their agent is working.
- So what: ask how they measure success, and ask for the number. If the answer is a demonstration, you are being shown the best run, not the average one.
- pass@1 vs pass^k
- Two very different ways of scoring the same agent. pass@1 is "got it right on one attempt"; pass^k is "got it right on every one of k attempts". Published results routinely show a system in the low sixties on the first and the mid twenties on the second.
- So what: capable and dependable are different words with different numbers behind them. Your business runs on the second one.
- Autonomy
- How far the agent goes without asking. Sold as the frontier. The documented causes of abandoned agent projects are runaway cost, unclear value and inadequate risk controls — and every one of those gets worse as autonomy increases.
- So what: buy the gate, not the absence of one. Autonomy is something you grant later, act by act, after watching.
- Observability tracing, spans
- Recording what the agent did, step by step, so a failure can be reconstructed. Mature tooling exists and most organisations already run some.
- So what: a trace shows what the model did. It is not the same artefact as evidence that a person decided, and an auditor wants the second one.
- Agent identity agent registry, non-human identity
- Giving each agent its own account, credentials and permissions rather than letting it borrow a human's. Becoming standard, and now a shipping feature of the large enterprise suites.
- So what: necessary, and no longer differentiating. If you are already in a large enterprise suite, you may be paying for this already.
- BYO key bring your own model account
- The software runs against your own account with the model vendor, so token costs are billed to you directly and no one marks them up.
- So what: it answers the hardest procurement question — who controls the key — and it makes the least predictable cost line yours to see. The genuine trade is that per-agent usage reporting gets harder, and an honest vendor will tell you that rather than showing you an estimated number.
The five questions this page exists to let you ask
- What can your agent physically not do?
- Is that guardrail a sentence in the prompt, or a thing the code refuses?
- What is the unit of approval — the agent, the session, or the act?
- How do you know it works, and what is the number?
- When it writes to my system, does my system's own logic run?
Ask us these too. The answers are on How it works and Security, and where our answer is weak we have said so.
Talk to us
Start with a conversation, not a signup
Gibreen is not sold from a pricing table. Tell us which system of record you run and which job is eating your week, and we will tell you honestly whether this is a fit — including when it is not.