Glossary

Every term the program uses, in plain language.

New here? Read the free first lesson. No account needed.

AI concepts

Agent: An AI system that takes multiple steps on its own toward a goal, choosing tools and adapting as it goes.
Agentic search: An agent finding what it needs while it works, with search tools, file paths and links, instead of having passages loaded before it starts. What it reads is current, but it's slower than retrieval and can wander without guidance.
AGI: Artificial general intelligence, a hypothetical AI as capable as a person across most tasks. Much debated and not here yet.
Augmented LLM: A model call with retrieval, tools and memory added. Anthropic uses it as the building block of every workflow pattern and of agents.
Calibrated probability: A probability that matches how often answers turn out right: of all the answers given at about 0.8, about 80% are correct. It describes groups of answers, never one, and you can rely on it only once you've checked it on your own labelled work.
Closed model: A proprietary model you can reach only through a provider's API or app.
Coding agent: An AI assistant with hands. It reads files, edits them, and runs commands, checking results as it goes.
Compaction: Summarizing earlier parts of a conversation to free up space in the context window.
Completion / response: What the model sends back after your prompt.
Context: Everything the model can see right now: your prompt, the conversation, attachments, and any injected notes.
Context rot: A loop failure where history grows until the signal drowns. Fix it by summarizing old turns and pinning the goal.
Context window: The most tokens a model can hold at once, covering your prompt plus everything it has already read.
Decision model: A model that answers a question by picking one of the options you define, with a probability for each option, instead of writing text. Jev and Laya are examples.
Embedding: A numerical representation of text that lets a system search by meaning instead of exact words.
Embedding models: Models that turn text into numbers so tools can search it by meaning. They work under the hood of assistants connected to your documents.
Fine-tuning: Extra, specialized training on top of a base model to fit a specific use case.
Frontier model: The biggest, newest, most capable model a provider offers.
Generation: The final RAG step: stuffing retrieved chunks into the prompt and letting the AI answer using that context.
Gradient descent: The training process where a model slowly adjusts billions of internal parameters until it predicts the next word well.
Image models: Models that generate images from text descriptions, like DALL-E, Midjourney, or Stable Diffusion.
Inference: Each time you actually use the model. You send a prompt, it runs through frozen parameters and produces output.
LLM: Large language model, the technology behind chat assistants like ChatGPT, Gemini, and Claude.
Long context: How much an assistant can hold in one conversation. A long context fits the equivalent of a small library at once.
MCP (Model Context Protocol): A standard way for AI apps to plug into outside tools, data, and services. Think USB for AI.
Memory: A feature that saves selected facts about you and places them back into context at the start of future conversations.
Multimodal: Models that handle more than text, like images and sometimes audio or video.
Next-word prediction: How an LLM works at its core. It predicts the most likely next word over and over to form a useful response.
Open weights: A model whose parameters you can download and run yourself.
RAG (Retrieval-Augmented Generation): The system searches your documents or the web first, then the model answers from what it found.
Session: One continuous conversation. A new chat starts with an empty context.
Source corpus: Where the truth lives for a RAG setup: the pages, docs, contracts, or past tickets you retrieve from.
Speech models: Models that convert speech to text and back, like Whisper for transcription and ElevenLabs for voice synthesis.
Subagent: A separate agent with its own context window that takes a side task, such as a search or a review, and returns only a summary. It doesn't see the main conversation, so its brief must restate any rule you gave only in that conversation.
System prompt: Instructions that set the AI's role and rules at the start of a conversation.
Token: The small chunks of text an assistant reads and writes, roughly 3/4 of a word. Length and cost are counted in tokens.
Tool: A connector that lets AI do something beyond writing text, like search, calculate, or reach another system.
Training: The expensive, one-time process where a model learns patterns from huge amounts of text. Providers do this, you don't.
Training cutoff: The date after which a model knows nothing from training, so it misses later events unless you tell it.
Unattended agent: An agent that runs a task from start to finish with no person watching or answering questions on the way. People see only the result, so the checks and the environment have to do the supervising.

Prompting & techniques

AI step: A process step that needs judgment varying with the input. Spend your AI budget here.
Always-on layer: The small set of things read every turn: hard constraints, house rules, and the active task.
Chain (prompt chaining): A sequence of prompts where each output becomes the next input. You manage the chain while the AI runs each stage.
Chain of thought: Asking the model to reason step by step before answering, which improves accuracy on multi-step problems.
Chunking: Breaking a corpus into bite-sized pieces (256 to 512 tokens, with 10 to 20% overlap) so they can be retrieved.
Context engineering: Choosing everything that reaches a model's context while it works, not only the prompt: instructions, files, tool descriptions, tool results and history. The aim is the smallest set of useful information that leads to the right action.
Determinism vs judgment: Determinism means a step gives the same output every time. Judgment means a step can legitimately vary. Mark each stage.
Deterministic step: A process step handled by fixed logic: a formula, a database property, or a script.
Evaluator-optimizer: A workflow pattern where one model call writes and another grades the result against clear criteria, sending feedback in a loop until it passes or a limit is reached.
Few-shot: Giving the model a few examples of the input to output pattern you want, which boosts reliability.
Four-Element Framework: The reliable prompt structure Role, Context, Task, Format (also called CRAFT or RCTF).
Golden rule: Give the AI as much context as possible, always. Better inputs reliably produce better outputs.
Handoff (the seam): The moment one step's output becomes the next step's input. Most chain breaks happen here, so put checks at the seam.
Instruction altitude: The level of detail guidance is written at. Too low is a brittle list of if-then rules; too high is a vague hope. The right altitude states the goal, the judgment calls and the hard limits, with the reason behind each.
Iterative refinement: Treating AI as a conversation and improving the output over a few rounds instead of expecting the first draft to be perfect.
Meta-prompting: Asking the AI to critique and rewrite your prompt so it produces more reliable output.
Multi-step prompting: Break work into stages instead of one big prompt. Each stage produces a clean, named output the next uses.
Negative constraints: Telling the AI what not to do. This pushes against its defaults and is often easier than describing what you want.
On-demand loading: Loading schemas, specs, runbooks, or docs only when a task needs them, fetched by name.
Orchestrator-workers: A workflow pattern where a central model call breaks a task into subtasks while it runs, hands them to worker calls and combines their results. Use it when you can't list the subtasks in advance.
Output formatting: Keeping intermediate outputs machine-friendly (tables, JSON, consistent fields). Free-form prose breaks chains.
Parallelisation: A workflow pattern that runs model calls at the same time: independent parts of a task side by side (sectioning), or the same task several times to compare the answers (voting).
Persona: Assigning the model a role to raise its quality bar. It shapes how the model answers, leaving whether it's right unchanged.
Persona prompts: Give each stage a role (a paralegal, a compliance officer). The persona shifts vocabulary, depth, and tone.
Plan, then execute: Asking the model to plan and flag gaps first, then produce the deliverable, so it doesn't fill gaps with guesses.
Pre-filling the response: Starting the AI's answer for it, which locks in the format and tone and cuts down on drift.
Process decomposition: Breaking a multi-team process into steps and deciding which are AI, deterministic, or need a human.
Progressive disclosure: Loading a little always and the rest only when relevant. Keep the always-on layer small.
Prompt: What you type to an assistant. Prompting is the craft of asking well.
Prompt journal: A saved collection of prompts that worked, built up over time into reusable templates for your own work.
Retrieval: Picking the right chunks for a query. Hybrid retrieval (semantic plus keyword) with a reranker is the production default.
Role stacking: Having the AI analyze something from several expert viewpoints in turn, then synthesize one recommendation.
Routing: A workflow pattern where one step sorts an input into a category and sends it to a step built for that kind, such as billing, technical or account emails.
Structured note-taking: Having an agent write notes to a file outside its context window as it works, such as a to-do list or a findings file, and read them back later. The notes survive compaction because they were never in the window.
Structured outputs: Asking for a specific schema like JSON or a table, so the output is clear and easy for other tools to reuse.
Zero-shot: Asking the model to do a task with no examples. Fine for simple, well-known tasks.

Building & shipping

50-Inputs Rule: Test an agent on 50 different real inputs before trusting it to run unattended. Categorise every failure.
Acceptance criteria: The conditions a piece of work must meet to count as done, written before work starts. For an agent, each works best as a check it can run: a test, a command or a result anyone can see, with checks for the new behaviour confirmed failing first.
Agent loop: The runtime cycle: read context, decide, call a tool, read the result, decide again, until the task is done.
Agentic engineering: Developing software with coding agents while an engineer stays accountable for the result: they set the goal, check the code and the evidence, and decide what ships. Simon Willison uses the term for the opposite of vibe coding, where nobody looks at the code.
Agentic loop: A task set up so a coding agent can reach a goal by trial and error: a clear goal, a check that says pass or fail, the commands to try changes, and a safe place to run with approvals off. Every agent runs a loop; an agentic loop is one you design.
Agentic manual testing: Having a coding agent use its own change the way a person would: calling a function from the command line, an API with curl or a page in a real browser, and keeping a record of each command and its output. It can find what passing tests miss.
AGENTS.md: The cross-tool standard instruction file. Put your conventions here as the single source of truth.
Anatomy of a brief: The parts a good agent brief needs: role, trigger, inputs, steps, output format, and guardrails.
Architecture decision record (ADR): A short file in the repository that records one significant decision: its context, the decision, its status and its consequences. It tells people and coding agents why the code is the way it is, so neither accepts or changes it blindly.
Back pressure: Automatic checks that reject an agent's bad output, such as tests, type checkers and security scanners, so it has to fix its change before it can move on. Keep them fast, because the agent waits for them.
Boilerplate: Code that has to be written but holds no new idea, such as setup, wiring or the same test shape again. It is easy to describe and easy to check, which makes it good work to hand to a coding agent.
Branch: A parallel line of work inside the same repo. You experiment on a branch without disturbing the main one.
Breaking change: A change in a new version of a library or service that makes code written for the old version fail or behave differently. Some break loudly, like a removed function. Others are quiet, like a changed default, and only tests that pin the behaviour catch them.
Budget cap: A stop condition setting a hard ceiling on turns, tokens, or tool calls.
Call site: A place in the code where a given function is called. Before an upgrade or a rename, listing every call site, tests and scripts included, shows how big the change is and what has to be checked.
Capability eval: An eval of tasks an agent still struggles with. It starts at a low pass rate and shows whether changes to the harness help.
Cascade: Running a cheap, fast model first and sending only its unsure cases to a stronger model or a person. It saves cost, but adds accuracy only when the second stage makes different mistakes.
Changelog: A short running note at the bottom of a brief recording each version's changes, so others see how it evolved.
Checkout: Switching your working folder to show a particular branch or commit. Same repo, different view.
CLAUDE.md: Claude Code's instruction file, at the project root or in ~/.claude for global. Often a pointer to AGENTS.md.
Cloud environment: The prepared setup that cloud agent runs start from: the code checked out, dependencies installed, network rules and secrets. Each run works in its own copy, so every run starts the same way.
Code owners (CODEOWNERS): A file that names who owns which paths in a repository. With the matching rule turned on, a change to an owned file can't merge without approval from one of its owners.
Commit: One saved change, with a note saying what changed and why. A repo's history is a chain of commits.
Compound engineering: A way of working, described by the company Every, in which each change should make the next one easier. After plan, work and review comes a fourth step: turn what you learned into a doc, an example, a test or a check, and ask whether the system would now catch the problem by itself.
Computational control: A guide or sensor run by ordinary software, such as a test, a linter or a script. It's fast and cheap, and gives the same result every time.
Context budget: Treating the context window as a budget you allocate on purpose, spending the most on what changes the answer.
Continuous integration (CI): The automatic build and tests that run on every proposed change before it merges. In a software factory it is the first check an agent's change must pass, and a green run is only as trustworthy as the tests behind it.
Cost: The price of every token in money, latency, and diluted attention.
Cost per useful output: Total spend divided by outputs that didn't need rework. The spend metric to internalise.
Coverage: A force in harness design: giving the model enough to act correctly. Too little and it guesses or invents an API.
Deferred tools: Listing tools by name and letting the model pull a full definition on demand, keeping context lean.
Definition of done: A short list of statements about finished work, written before the work starts, that anyone could check. Each line is true or false of the result, so "done" means checked, not just looks done.
Definition of ready: A team's agreed list of what a work item must contain before anyone starts on it. In a factory it decides which items may enter the agent queue; the rest go back to their author with the missing piece named.
Dependency bump: A change that moves one of a project's dependencies to a newer version. A bump that only changes a version number suits a plain script; one with breaking changes also needs code changes, and a check that the project still builds and passes its tests.
Design flaw: A failure rooted in the workflow's architecture. The fix is to re-stage or redesign it.
Diff: The line-by-line list of what changed in your files: the lines removed and the lines added. Reading the diff after each step is how you see exactly what an agent did.
Disposable environment: A workspace created fresh for one task from a standard setup and thrown away afterwards, such as a worktree, a container or a cloud sandbox. Nothing you need lives only inside it, so any run can be restarted.
Doc-gardening: A recurring run, often by an agent, that compares a repository's docs with the code and opens a pull request for each page that has gone stale. It keeps the docs agents rely on true.
DORA metrics: Five software delivery measures from DORA, a research programme run by Google Cloud. Change lead time, deployment frequency and failed deployment recovery time show throughput; change fail rate and deployment rework rate show instability.
Edge cases: Inputs that are valid but unusual. A brief should say what to do about missing fields, contradictions, and sensitive data.
Eval suite: A set of tasks you can run again, each with a pass rule, so you can score an agent and its harness before and after a change. Grow it from real failures, and include cases where something shouldn't happen.
Fan-out: Splitting one repetitive change into one agent run per item, such as a file, started from a script with the same prompt. Each run starts with a fresh context. Try a few items first, fix the prompt, then run the rest with a check on each.
Fleet-wide change: The same kind of change made across many repositories, such as a dependency bump or a configuration update, usually as one small pull request per repository. Each repository's own checks and owners still decide whether its change merges.
Forking: Copying someone's shared agent or assistant and adapting it, inheriting the lessons the original author learned.
Format drift: The AI returns output in a slightly different shape than specified, breaking anything downstream that expected the exact format.
Fresh-context review: A review by a model that gets the finished work, its definition of done and the sources, but not the conversation or reasoning that produced it. It may open files and run the checks.
Frontmatter: A small YAML block at the very top of a file, holding facts about the file itself.
Git bisect: The git command that finds the commit where a bug first appeared. You mark a good commit and a bad one and give it a test, and it searches the history in halves. Coding agents are good at running it for you.
Goal test: A stop condition the agent runs rather than asserts: the build passes, or the endpoint returns 200.
Gold set: Real items from your work, each labelled with the right answer by people who know the job. You score a decision model against it before you trust it.
Golden principle: An opinionated, mechanical rule about what the code should always look like, written into the repository, so a scheduled agent can find deviations and open small pull requests to fix them.
Grader: Whatever decides whether a trial passed: code for what can be checked exactly, a model with a rubric for judgement calls, or a person. Check a model grader against people before you trust it.
Guide (feedforward control): A harness control that steers the agent before it acts, such as instructions, a style guide or a template. It makes a good first attempt more likely.
Harness: Everything you build around a model: the context you feed it, the tools it can call, and the loop it runs in.
Harness engineering: Designing and improving everything around an agent's model: its instructions, tools, checks and limits. In Mitchell Hashimoto's sense, the habit of changing the harness each time the agent makes a mistake, so it doesn't make that mistake again.
Harness pruning: Taking pieces out of a harness one at a time and re-running the same evals after each, to keep only what still makes results better. Every rule or check is an assumption about the model, and models change.
Headless run: A coding agent run from a script with no one at the keyboard, such as claude -p or codex exec. The allowed tools, the sandbox and the limits on turns and spend all have to be set before it starts.
Hidden context: System prompts, reference files, conversation history, and retrieved chunks all spend tokens on every run.
Holdout scenario: An end-to-end user story, stored outside the codebase, that checks software by what a user can observe. Agents never see it, so they can't rewrite it or write code that only passes it.
Idempotency: An agent is idempotent if running it twice on the same input is safe. It produces the same output or skips.
Inferential control: A guide or sensor that relies on a model's judgment, such as written instructions or an AI review. It can judge meaning, but it's slower, costs more and can vary from run to run.
Infrastructure (vs a tool): A build many people depend on. At that scale it needs a named owner, documented behavior, HITL gates, and a maintenance plan.
Instruction file: A file of standing rules an agent reads before it starts working. AGENTS.md is the common name.
Intake form: The form or template people fill in to file a work item, with one field for each line of the definition of ready and the important ones required. It makes fields hard to skip, not impossible, so triage checks every item again. On GitHub, it is an issue form.
Lockfile: A file that records the exact version of every package a project installs, including the packages its dependencies bring in. Its changes in a diff show everything a new package adds.
Maintenance plan: A short document naming the owner, a backup, review cadence, known failure modes, and how to test changes.
Maturity tiers: Labels for shared workflows: try-at-your-own-risk, featured (reviewed), and official (maintained, production-grade).
Merge: Folding a branch's changes back into the main line once they're ready.
Merge conflict: What happens when two branches change the same lines of the same file. Git can't combine them on its own, so a person or an agent has to choose. Splitting parallel work by area keeps conflicts rare.
Merge queue: A queue that tests each pull request together with the latest main branch and the pull requests ahead of it before merging, so changes that pass on their own can't break the branch together.
Model limitation: A failure where the AI isn't reliable enough at the task. The fix is a deterministic check or a tighter HITL gate.
OpenTelemetry (OTel): An open standard for sending metrics, logs and traces from a program to a collector you choose. Agent tools use it to report each run's tokens, cost and tool calls.
Optimistic concurrency: A way for many agents to share state without locks: anyone can read it, but a write fails if the state changed since it was read, and the writer reads again and retries.
Output dominance: Output tokens typically cost 3 to 5 times more than input tokens, so a verbose default multiplies spend fast.
Output schema: A precise written definition of an output's fields and types, set before writing the prompt.
pass@k (at least once): The share of tasks an agent passes at least once in k trials. It shows whether the agent can do a task, not whether it does it every time.
pass^k (every time): The share of tasks an agent passes on every one of k trials. It falls as k grows, and it matters most where people expect the same result every time.
Path-specific instructions: Instruction files that apply only when an agent works on matching files, such as a GitHub Copilot .instructions.md file with an applyTo pattern, or a Cursor rule with globs.
Production-ready: A workflow tested on real inputs, with failure modes and HITL gates in the brief, documented, owned, and logged for drift.
Progress file: A file an agent reads at the start of every session and updates at the end: the goal, the rules and a log of what was done and what's next. With an item list beside it, a fresh session can pick up long work without redoing or skipping any.
Pull request: A bundle of commits offered for review before it merges.
Ralph loop: A way to run one coding agent unattended: a script sends it the same prompt, plan file and specs again and again. Each pass starts with a fresh context, does one item, runs the checks and commits.
Rebase: Replaying a branch's commits on top of the latest main branch. Rebasing just before the final checks means the checks test the code that will actually merge.
Recall: How reliably the model acts on a given rule. Rules buried in the middle of a long context get missed.
Red/green TDD: Test-first development: write a test, run it and watch it fail (red), then change the code until it passes (green). Seeing it fail first shows the test checks the change, not something that already worked. With a coding agent, asking for red/green TDD is usually enough.
Reference files: Stable documents (regulations, style guides, glossaries) attached to a custom assistant so it reasons with them consistently.
Regression eval: An eval of tasks an agent already handles, which should pass nearly every time. A drop means something broke, often after a change to the model, the instructions or the tools.
Reliability table: A table that groups a model's answers by probability and shows how often each group was right. It tells you whether 0.8 really means about 80% on your data.
Replay set: A fixed list of past work items, each with its starting commit and the result that counts as a pass. Before you ship a change, you run the current and the changed system on it and compare item by item.
Repository (repo): A project folder with a memory. It holds files, tests, and a log of every change, so nothing is ever really lost.
Reproducing test: A test written to fail because of a reported bug, before anyone fixes it. It must fail for the same reason users see the bug, not because of a typo or a missing setup, so that its passing later shows the fix works.
Required status check: A check, such as the test suite, that must pass before a pull request can merge into a protected branch. It turns tests from advice into a gate.
Retry cap: A limit on how many times an agent may try again after a check fails, such as two rounds of CI. When it's reached, the run stops and the branch goes to a person with the failing output.
Revert check: Taking a fix out, running its new test to see it fail again for the same reason as before the fix, then putting the fix back. A test that still passes without the fix doesn't check the fix and won't catch the bug if it returns.
Ruleset: A named set of rules on a repository's branches, such as requiring a pull request, passing checks and an approval before anything merges. Changes from agents are held to it like anyone else's.
Satisfaction (scenarios): StrongDM's score for holdout scenarios: of all the runs through all the scenarios, the share that would likely satisfy the user. It replaces a single pass or fail when software with a model inside doesn't behave the same way every time.
Scope judge: A model that reads only a work item and the diff an agent produced for it, and vetoes changes that go beyond the item. It runs after the build and test checks. Track its veto rate and hand-check a sample of its verdicts.
Seam: The point where information passes from one person, team, or system to another. Seams leak time and quality.
Seam map: A map of a process's handoffs: who hands off, who picks up, what's lost, the time cost, and where AI could fit.
Sensor (feedback control): A harness control that checks the agent's work after it acts, such as a test, a link checker or a reviewer model, so the agent can correct itself.
Shadow mode: Running a decision model on real work while the current process stays in charge. You log both answers and compare them later; nothing the model says is acted on.
Shift left: Moving a check as early as it can run, such as a lint on every push instead of in CI or review, so a failure shows up where it's cheapest to fix.
Skill: A bundle of instructions and reference material that teaches an assistant to do one job well, reusable in every future chat.
SKILL.md: A skill's one required file: YAML frontmatter (name and description) at the top, then the procedure in the body.
Software factory: A system where many AI agents take work items from a queue and turn them into verified changes, with people at the checkpoints you choose. The agent is one step; the queue, isolated environments, checks and sign-offs make its changes safe to merge.
Spec-driven development: Writing the intent down first, as a spec, and having a coding agent build from it. The levels differ in what happens to the spec afterwards: used for one change (spec-first), kept with the feature (spec-anchored), or the only file people edit (spec-as-source).
Stacked pull requests: A series of small pull requests in which each one is based on the one before it, so a large piece of work is reviewed one self-contained change at a time. Each one must leave the system working when it merges.
Stop hook: A hook that runs each time the agent finishes responding and can send it back to work, for example while a test still fails. It needs a guard, so a check that can never pass ends the run instead of looping.
Symlink: A shortcut file that points at another file, so one real copy can appear in several places.
System of record: The one place a fact officially lives, which every other mention points to. In a codebase, versioned docs in the repository can be the system of record for architecture, decisions and business rules.
Task lock: A claim on a work item, such as a small file an agent commits to a shared repository before it starts, so that other agents pick something else. Locks held too long or never released slow everyone down.
Templating with variables: Production briefs are templates with named variables, which makes them inspectable, versionable, and forkable.
Terminal (shell): The text window where you type commands instead of clicking buttons. Coding agents live here.
Test suite: A project's self-checks, run by a single command that reports pass or fail.
The build rule: When you find yourself doing the same work twice, build it as an agent so the third time it runs itself.
Threshold bands: Two cutoffs that split a decision model's answers into three outcomes: act on its own, confirm with a person, or escalate to a person. You set them from your own labelled items and what each mistake costs.
Trace: A record of one run as a tree of timed steps called spans: the run at the root, and each model call and tool call beneath it. It shows where the time and tokens went, what failed and why the run stopped.
Trial: One attempt at one task in an eval. Agents vary from run to run, so each task gets several trials, each from a clean start.
Triggers: How an agent starts: on a schedule, on demand, or on an event like a new database row.
Tripwire: In an agent SDK, the signal a guardrail sends when its check fails. The run stops, and your code decides what happens next, such as telling the user the request can't be processed.
Trusted inputs: Inputs already validated upstream, like a database row with an enforced schema. You can act on them.
Usable vs accurate: Usable means downstream stages can parse the output. Accurate means the content is correct. Both matter.
Validation stage: The first chain stage that checks each required field is present and valid. If a check fails, it stops and flags a human.
Verified outcome: A change that merged, deployed and needed no rollback, hotfix or follow-up fix. Counting these, instead of pull requests opened or lines generated, shows what work with coding agents actually delivered.
Verifier: A check an agent can run but doesn't control, such as a build or a test run, that reports back in a few lines. In a factory, verifiers run before a pull request opens, and a failing one stops it from opening.
Vibe coding: Building something by describing what you want in plain words and letting AI write the code, steering by feel.
Work item: One piece of work in a shared queue, such as an issue in a tracker. When an agent takes it, the item is its whole brief: the outcome, the checks that prove it, what is out of scope and who to ask.
Workflow: A system where a model and tools follow steps you fixed in advance. Simpler, cheaper and easier to test than an agent, so use one whenever you know the steps.
Worktree: A second working copy of the same repo in its own folder, with its own branch, so two efforts never trip over each other.
YAML: Settings written as labeled lines, like name: pdf-export. Read it like a form rather than like code.

Risk & safety

Action risk rating: A low, medium or high rating for one action an agent can take, from four questions: does it write, can it be undone, whose access does it use, and is money involved. Each rating maps to allow, ask or deny.
Adversarial testing: Deliberately feeding an agent tricky, conflicting, incomplete, or malicious inputs during testing to find where it breaks.
Adversarial verification: Splitting making from judging. One pass creates, another attacks with orders to refute, and only what survives ships.
Agentic laziness: When an agent stops partway through a long, many-part task and reports the whole job as done. Counter it with a check the agent must run before it stops.
Agents Rule of Two: Meta's design rule for prompt injection: within one session, an agent should hold at most two of untrusted input, access to sensitive systems or private data, and the power to change state or communicate externally. With all three, it needs a person or another reliable check.
AI slop: Low-effort, mass-produced AI text or images. The thing good prompting avoids.
Always-HITL actions: Things that always need human sign-off: money, health, safety, contracts, legal terms, government submissions, legal status.
Approval fatigue: What happens when people see so many approval prompts that they stop reading them. Approvals still happen, but they're no longer a check. Ask less, show exactly what will happen, and contain the routine work.
Audit logs: A record of every MCP tool call with timestamp, caller, scope, and result. What you check to see what the AI did.
Auto-pause: A circuit breaker that halts an agent when sampled accuracy drops below a set threshold, until a human re-enables it.
Automation bias: The pull to rely, or over-rely, on an automated system's output. The EU AI Act names it, and a near-zero override rate is one warning sign.
Blast radius: The range of systems an agent can affect if something goes wrong. A connected agent needs tighter gates.
Confidence calibration: Making the AI rate its own confidence (high, medium, low) with a reason, so you know which outputs need review.
Confidence floor: A threshold below which the agent stops and escalates instead of acting.
Confidently wrong: An answer that sounds authoritative but is wrong in a subtle way, with the same tone as correct answers.
Containment: Limiting what an agent is able to reach, whatever it decides: a sandbox, network access off or limited to a list, and credentials kept out of its reach. It holds when nobody is watching, which approvals can't.
Credential proxy: A service outside an agent's sandbox that holds a real key and adds it to outgoing requests for allowed domains. Code inside the sandbox only ever sees a placeholder, so a hijacked run has no key to steal.
Data hygiene: Habits for handling private information with AI. Keep sensitive data where it lives rather than pasting it into a tool you don't control.
Deny rule: A permission rule that blocks a tool, a command or a path whatever the model decides, such as Read(./.env) in Claude Code. Deny rules are checked first, so an allow rule can't make an exception to one.
Drift: When a model's outputs slowly degrade because the input pattern shifted. Silent, and only visible across many outputs.
Drift (loop): A loop failure where the agent forgets the goal and optimizes a sub-task. Restate the goal near the end of context.
Enforced control: A limit the tool applies whatever the model decides, such as a permission rule, a hook, a sandbox or an app that isn't connected. Unlike an instruction, the model can't skip it.
Escalation path: The defined route for a flagged case: who gets notified, how, and with what context. Every HITL gate needs one.
Exfiltration: Sending data out to someone who shouldn't have it. For an agent, any way to communicate outside can carry it: an email, a message, a web request, even a link or an image address.
Guardrails: Rules and checks that stop AI from doing risky things.
Hallucination: When an assistant states something false with full confidence. Always worth a quick check.
Hidden Unicode characters: Characters that take up no visible space, such as zero-width joiners and bidirectional text markers. They can hide an instruction in a file that a person reading it can't see but a model reads.
HITL gate: A human-in-the-loop checkpoint where a person reviews before the agent acts. Required for irreversible or low-confidence actions.
Human-in-the-loop (HITL): A person reviews or approves AI output before any action, especially on steps that are regulated, irreversible, or high-impact.
Indirect prompt injection: Prompt injection that arrives inside content an agent reads, such as a web page, an email, a shared file or a tool result, rather than in what the user types.
Jailbreak: A prompt crafted to bypass an AI's safety guardrails. Don't try it; guardrails protect you and others.
Least privilege: Giving an agent, a person or a program only the access its task needs, and nothing that outlives the task. For an unattended agent, that means one repository, a small set of tools and credentials that expire with the run.
Lethal trifecta: Simon Willison's name for an agent that has access to private data, sees untrusted content and can send data out. With all three, an attacker can trick it into leaking the data. Remove at least one.
Network allowlist: The list of hosts an agent's run may reach, such as your package registry. Everything else is blocked, which limits where a confused or manipulated agent can send data.
No progress: A loop failure where the agent retries the same failing action. Track what's been tried and cap retries.
Overeager behaviour: An agent taking a helpful-looking step beyond what you asked for or would approve, such as using a credential it found. Limit it with controls the tool enforces.
Package hallucination: A software package a model suggests that doesn't exist. Anyone can register the invented name and fill it with harmful code, so check every new package before you keep it.
Prompt injection: Malicious instructions hidden inside content the AI reads, trying to hijack what it does.
Push protection: A GitHub check that blocks a push containing a password, key or token before it reaches the repository, instead of alerting you afterwards.
Red-teaming: Adversarial testing with an attacker's goal: you attack your own real set-up on purpose, for example by trying to make it leak data, to see which defences hold. For an agent, that often means planting a harmless instruction in something it reads.
Revocation: Removing an MCP connection's scopes when a workflow is retired, so dormant connections don't accumulate.
Reward hacking: Passing a check without doing what the check was meant to prove, such as deleting a failing test or writing code that only works for the test's input. Protect checks from edits, and keep some where the agent can't see them.
Scopes: Per-action permissions an MCP server exposes, like read_employees separate from update_employee. Grant only the minimum.
Self-preferential bias: An agent's tendency to rate its own work too kindly when asked to check or grade it. Counter it with a reviewer that didn't do the work.
Slopsquatting: Registering a package name that AI models tend to invent, so that code following a model's suggestion installs the attacker's package. The name comes from typosquatting, where attackers register misspelled package names.
Spot-checking: Sampling a share of a workflow's outputs (say 10%) and reviewing them yourself.
Supervision: Keeping an agent safe by having a person approve each action before it runs. It works only while that person is paying attention and understands what they approve, so work that runs while nobody watches needs containment.
Swap test: Changing one detail that shouldn't matter, such as a name or a place, and running the item again. If the answer moves more than normal noise, the decision is using that detail.
Swiss cheese model: A picture from safety engineering: every layer of checks has holes, but layers with holes in different places let few mistakes through. No single check catches everything, so stack several.
The hard rule: Never paste bank details, credentials, government IDs, or anything private and not yours into a general AI tool.
Workspace trust: A coding agent's check before it uses a folder's own settings, such as hooks committed to a repository: it asks whether you trust the folder. Scripted runs may skip the question and treat the folder as trusted.
Wrong stop: A loop failure where the agent quits early or never quits. Fix it with an explicit termination test.

Tools & assistants

AI agent: A saved brief that runs a recurring job on its own, on a schedule, on demand, or on an event.
AI assistant: Your standalone chat tool (ChatGPT, Gemini, Claude, or Grok). Reactive: you ask, it answers.
AI code review: A review of a pull request or a diff by an AI model. Its findings are leads to check against the code, not approvals, and it doesn't replace tests or a person's review.
Approval policy: In Codex, the setting that decides when the agent stops to ask before going past its sandbox, such as on-request or never. The sandbox mode sets what commands can technically do.
Artifacts: A Claude feature that generates code, documents, slides, and interactive outputs in an editable side panel.
Automation platform: A no-code tool (Zapier, Make) that copies data between apps on a schedule.
Built-in (in-app) assistant: AI built inside an app you already use, like Gmail, Notion, or Word. It acts on the open page.
ChatGPT: OpenAI's assistant, free at chatgpt.com. A dependable all-rounder with the largest user community.
Checkpoint (file snapshot): A snapshot a coding tool takes of your files before the agent edits them, so you can rewind its last steps. It is for quick recovery inside one conversation; some tools miss changes made by shell commands, so commit to git as well.
Claude: Anthropic's assistant, free at claude.ai. Strong for long-form writing, heavy document analysis, and hard reasoning.
Claude Projects: Persistent Claude workspaces holding reference documents Claude remembers across every conversation.
Cloud agent: A coding agent that runs on a vendor's machines instead of yours. You give it a task, it works in its own prepared environment, and it hands back a branch or a pull request for a person to review.
Co-pilot: AI that works beside you inside a tool, suggesting as you go while you stay in control.
Connectors: Links that let Claude connect to tools like Drive, Gmail, Slack, GitHub, and Linear, with your permission.
Custom GPTs: ChatGPT's saved, reusable assistants that you configure once and reuse.
Deep Research: A mode that runs an extended, multi-source investigation over several minutes and returns a written, cited report.
Gemini: Google's assistant, free at gemini.google.com. Strongest when input is large, mixed, or visual, and runs inside Google Workspace.
Gems: Gemini's saved, reusable custom assistants that you configure once and reuse.
Grok: xAI's assistant, free at grok.com. Wired into X and the live web, strongest on current events.
Permission mode: A coding agent setting that decides which actions run without asking you first, from only reads to everything. Permission rules sit on top of it, and a deny rule still blocks in every mode.
Plan mode: A coding agent mode in which the agent reads the code and proposes a plan, but changes nothing until you approve it. It keeps working out what to do apart from doing it.
Plugin: A package that installs several parts of an agent setup at once, such as skills, hooks and server connections. A plugin can run code with your own permissions, so read what it contains before you install it.
Project instructions: Standing instructions you set once in a ChatGPT or Claude project. Every chat in the project gets them, along with the project's files, but they're still requests the model may skip.
Saved (reusable) assistant: A custom assistant you configure once and reuse, such as a Custom GPT, Gem, or Claude Project.
Workspace-integrated agent: An agent that lives inside a tool like Notion, reading and writing its pages and databases.

Working with AI

Agent legibility: Whether the knowledge an agent needs sits somewhere it can open while it runs. A decision that lives only in a meeting, a chat thread or someone's head is illegible: to the agent, it doesn't exist.
AI fluency: The ability to work with, build on, and think alongside AI. The highest-return skill of the decade.
AI-first default: Spending 30 seconds on every new task thinking about how AI could help before doing it manually.
AI-pilled: Won over by AI. Once it clicks for one task, you start reaching for it everywhere. Usually said with a wink.
Comprehension debt: The growing gap between how much code a team has shipped and how much of it anyone on the team understands. It builds up quietly while the tests stay green, and shows when something breaks. Also called cognitive debt.
Cross-checking: Run the same important question through two tools and compare. Agreement raises confidence; disagreement flags something to investigate.
Dark factory: The top of Dan Shapiro's five levels of autonomy: specs go in, software comes out, and no person writes or reviews the code. It is named after factories run entirely by robots, where no people work.
Everyone is a builder now: Anyone who builds a workflow with AI is a builder, whatever their job title.
Five levels of autonomy: Dan Shapiro's model of how much of the coding a team hands to AI, from Level 0, where a person writes every line, to Level 5, the dark factory. It is one person's model, useful as shared vocabulary, and one team can sit at several levels at once.
Golden example: The one piece of existing code you name as the model for a pattern, such as a new endpoint or a test. Coding agents copy what they find, so naming the best example steers what they copy.
Goodhart's law: The observation that a number stops being a good measure once people are rewarded for it. Set pull requests opened as a goal, and you get more pull requests whether or not they're worth anything.
Handoff note: A short note that lets a fresh session take over a task: the goal in its original words, the rules that must hold, what's done and how it was checked, what's next and what didn't work.
Paradox of supervision: The problem that supervising an AI agent takes the very skills that relying on it can weaken. Anthropic's study of its own engineers uses the term for coding: checking an agent's code needs the coding skills you practise less once it writes the code.
Relearn to learn: The meta-skill of continuing to learn as old expertise gets automated. The new moat.
Skill atrophy: Losing a skill you no longer practise because a tool does the work. With coding agents, debugging is the main worry: in one trial it showed the biggest gap, and it's the skill you need to check what an agent hands back.
The 100x mindset: The new pace: months become days, days become hours. New things become possible when cost drops 100 times.
The 80% rule: Start with your AI assistant for everything. The in-app tool is a handy shortcut you can skip.
Triage: Sorting incoming work so each item goes to the right place. In a factory, each item goes to an agent, to a person or back to its author, and every call records a reason and a confidence.
Work must disappear: The mindset that AI should erase whole categories of work, deleting tasks outright.
Work-in-progress limit: A cap on how many tasks are started and not yet merged. For parallel coding agents, set it by how many changes you can review and land, not by how many agents you can start, and review what's waiting before you start more.