Agentic AI Glossary: Identity and Security Terms

Agentic AI has brought a wave of new terms, and many are used loosely or inconsistently. This glossary gives short, precise definitions of the terms that matter for identity, access and security in agentic AI, written for IAM practitioners, security architects and risk teams. Where a term is defined by a standard or specification, we say which. Terms link to our detailed guides where relevant.

A

Agent (AI agent): Software that uses an AI model to decide on and take actions, such as calling tools or APIs, towards a goal, with or without human approval of each step. See AI Agents vs Agentic AI.
Agent Card: In the A2A protocol, a JSON document an agent publishes to describe its identity, endpoints, skills and supported authentication methods. Agent Cards can be signed so callers can verify them.
Agent identity: The unique non-human identity under which an AI agent authenticates and is authorised, distinct from the identities of people and other workloads. See the Agentic AI Identity Guide.
Agent registry: The system of record for an organisation's AI agents, recording owner, purpose, tools, credentials, autonomy level and risk.
Agent2Agent (A2A): An open protocol, contributed by Google to the Linux Foundation, for agents built on different frameworks to discover each other and exchange tasks. See the Multi-Agent and A2A Security Guide.
Agentic AI: AI systems in which one or more agents plan and act over multiple steps with limited human involvement, often using tools, memory and other agents.
Agentic commerce: Purchases and payments initiated by AI agents on behalf of people or organisations. See the Agentic Commerce Identity Guide.
AI-BOM (AI bill of materials): A record of the models, data sets, software, tools, services and credentials that make up an AI system. See the AI Supply Chain and AI-BOM Guide.
AI gateway: A central proxy through which applications and agents access AI models, providing authentication, rate limits, logging and policy.
Attestation: Evidence about what a workload or agent is and where it runs (for example, its platform, code or configuration), used before issuing it an identity.
Autonomy level: The degree to which an agent may act without human approval, typically recorded per agent and per action type.

C–D

Computer-use agent: An agent that operates a desktop or browser by reading the screen and issuing mouse and keyboard actions. See the Browser and Computer-Use Agent Guide.
Confused deputy: A situation where a privileged component (such as an agent or MCP server) is tricked into using its authority on behalf of a less privileged party.
Context window: The input a model considers at once, including instructions, conversation, retrieved content and tool results.
Delegation (on-behalf-of): Granting an agent authority to act for a user or another agent, ideally narrowed to a task and recorded so both identities are visible.
Delegation chain: The sequence of principals and agents through which authority passes in a multi-step or multi-agent task.

E–H

Excessive agency: OWASP LLM06: an LLM-based system given more functionality, permissions or autonomy than needed.
Goal hijack: OWASP ASI01: manipulation of an agent's objectives or plan, usually through prompt injection or poisoned data.
Guardrail: A control that constrains model inputs or outputs, such as content filters or prompt rules. Guardrails reduce risk but are not access controls.
Human-in-the-loop (HITL): A design in which a person must approve certain agent actions before they are executed.

I–L

Indirect prompt injection: Instructions hidden in content an AI system processes, such as web pages, emails, documents or tool outputs, that alter its behaviour. See How to Prevent Prompt Injection in AI Agents.
Just-in-time (JIT) access: Access granted only when needed and for a limited time. For agents, typically task-scoped, short-lived credentials. See the JIT Access Guide.
Kill switch: A mechanism to stop an agent and revoke all of its credentials and access quickly.
Least agency: Limiting what an agent is allowed to decide and do on its own, alongside least privilege on its credentials.
LLMjacking: Use of stolen cloud or AI provider credentials to run AI models at the victim's expense. See the LLMjacking Guide.

M

MAESTRO: A Cloud Security Alliance threat modelling framework for agentic AI, organised into seven layers. See Threat Modelling AI Agents.
MCP client: The connector within a host application that connects to an MCP server.
MCP gateway: A proxy between agents and MCP servers that centralises authentication, policy and logging.
MCP server: A service that exposes tools, resources and prompts to AI applications via the Model Context Protocol.
Memory poisoning: OWASP ASI06: inserting malicious or false content into an agent's memory so it influences future behaviour. See the AI Agent Memory Security Guide.
Model Context Protocol (MCP): An open protocol for connecting AI applications to tools and data, created by Anthropic and now hosted by the Linux Foundation's Agentic AI Foundation. See the MCP Security Guide.
Multi-agent system: A system in which several agents coordinate, directly or through an orchestrator, to complete tasks.

N–P

Non-human identity (NHI): An identity used by software rather than a person, such as service accounts, API keys, tokens, workloads and AI agents. See The Ultimate Guide to NHIs.
Orchestrator: An agent or component that plans work and assigns tasks to other agents.
Permission-aware retrieval: Retrieval that only returns content the requesting user or agent is allowed to see. See the Permission-Aware RAG Guide.
Policy enforcement point (PEP) / policy decision point (PDP): Components that enforce and decide authorisation respectively; for agents, often a tool gateway (PEP) calling a policy engine (PDP).
Principal: The user or system on whose behalf an agent acts.
Prompt injection: OWASP LLM01: input that alters a model's behaviour in unintended ways, either directly from a user or indirectly through processed content.

R–S

RAG (retrieval-augmented generation): Supplying a model with relevant content retrieved from documents or data at query time.
Rogue agent: OWASP ASI10: an agent that deviates from its intended behaviour, through compromise or drift, and acts harmfully while appearing legitimate.
Sender-constrained token: An access token bound to a key held by its client (for example via mTLS or DPoP), so it cannot be replayed if stolen.
Shadow AI: AI tools, agents and integrations used without the organisation's knowledge or approval. See the Shadow AI Discovery Guide.
SPIFFE: A standard for workload identity using short-lived, attested identity documents (SVIDs), usable as a basis for agent identity.

T–Z

Task-scoped access: Permissions limited to the resources and actions needed for one task, for the task's duration.
Token exchange: OAuth 2.0 Token Exchange (RFC 8693): trading one token for another scoped to a different audience, used for per-hop delegation.
Token passthrough: Forwarding a token received from a client to another service. Prohibited for MCP servers because it breaks audience restriction and attribution.
Tool: A function or API an agent can call to act or retrieve information.
Tool poisoning: Hiding malicious instructions in a tool's name, description or schema, which the model reads when deciding how to use it.
Workload identity federation: Exchanging a platform-issued identity token for short-lived credentials in another system, removing the need for stored secrets.
Zero standing privilege: Having no permanent privileged access; privilege is granted just in time and removed after use.

For the wider NHI vocabulary, see the NHI Mgmt Group Glossary. Related resources: Top 10 Agentic AI Identity Issues · Agent Identity Standards Tracker · Agentic AI Security Guide