Agent Vocabulary: What the Terms Actually Mean

The vocabulary around agents is used loosely enough that people discussing the same word are often discussing different things. Here's what the terms mean when used precisely, and where the ambiguity usually causes trouble.

Agent. A model whose output determines what happens next — it chooses which tool to call and when to stop. The defining property is that the model owns the control flow. If the sequence is fixed by your code, that's a workflow with model calls in it, and calling it an agent obscures the difference that matters.

Loop. The code that runs the agent: send messages and tools, receive tool calls, execute them, append results, repeat until done. Usually under a hundred lines.

Harness. Everything around the model that isn't the model: the loop, context assembly, the tool layer, verification, state, permissions, presentation. Where most of the quality difference between systems lives.

Tool. A function the model can request. Its description is prompt text and its result is context — which is why tool design is prompt design and context design at once.

Context / the array. The messages sent to the model on a given call. Rebuilt every turn, re-sent in full, and the single most useful thing to print when debugging.

Context window. The maximum size of that array. Distinct from effective context — how much of it the model reliably uses — which is smaller and the number that actually matters.

Turn. One model call plus the tool calls it requests. The unit that cost and latency scale with.

Trajectory. The sequence of tool calls a run took. For an agent, the trajectory is part of the behavior, which is why asserting only on final answers misses most of what can go wrong.

Trace. The full record of a run. What you read when something went wrong.

Oracle. Something that verifies correctness mechanically — a compiler, a test suite, a schema validator, a reconciliation check. ⚠️ Availability of an oracle predicts agent effectiveness better than domain difficulty does, which makes this the most under-used word on the list.

Grounding. Tying output to a verifiable source, usually a quoted span. The mechanism that separates a checked claim from a plausible one.

Tool calling / function calling. The mechanism by which a model requests an action. Distinct from structured output, which is the model's answer in a schema — one expects a result back, the other ends the turn.

RAG. Retrieving material and putting it in the context before generating. In agent systems, retrieval is better treated as a tool the agent calls repeatedly than as a preprocessing step.

Multi-agent. Several agents with separate contexts. Worth distinguishing from several prompts in one agent — the second has no handoff and loses nothing at the boundary.

Handoff. Passing work between agents. Always lossy: the receiver gets a summary, not the context.

Human-in-the-loop. A person in the execution path. Loose enough to be unhelpful — the useful questions are where in the run, what they see, and whether they can realistically decide.

Guardrail. Anything constraining behavior. ⚠️ The word covers both prompt instructions and enforced code checks, which are completely different in strength. Worth saying which you mean.

Prompt injection. Text in the context, from an untrusted source, that changes behavior. Indirect injection — arriving via a tool result rather than from the user — is the consequential version and the one usually not meant when people say "prompt injection."

Blast radius. What a wrong action can affect. The property that should determine autonomy, more than accuracy does.

Idempotent. Safe to call twice. Necessary for any write tool, because agents repeat calls for at least five ordinary reasons.

Eval. A test case for an agent, usually asserting on trajectory and outcome rather than exact output.

Judge. A model scoring another model's output. Needs calibration against human labels to mean anything.

💡 The distinctions worth insisting on

Four confusions cause most of the miscommunication:

• Agent vs workflow — who owns the control flow.
• Multi-agent vs multi-prompt — whether there's a lossy boundary.
• Guardrail-as-instruction vs guardrail-as-enforcement — whether it can be talked around.
• Context window vs effective context — what fits versus what gets used.

When a conversation about agents isn't converging, it's usually one of those.

The takeaway

The words are used loosely and a few of the distinctions are load-bearing. An agent is a system where the model owns the control flow; the harness is everything around it and where the quality lives; an oracle is what predicts whether a domain works; and a guardrail in a prompt is a request while a guardrail in code is a control. Being precise about those four saves a lot of arguing about the wrong thing.