Topic starter
21/08/2026 4:54 pm
TL;DR: The agent glossary only becomes operational when each term is mapped to a real production component, TruFoundry argues, because model, scaffold, harness, tool, skill, and sub-agent each imply different governance boundaries. The core lesson is that behavior is shaped by the whole runtime, not just the model, and that is now a control problem as much as a semantics problem.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “The AI Agent Glossary, Mapped to Production Infrastructure”.
Key questions
Q: How should teams govern AI agents when model, prompt and harness are separate layers?
A: Treat the agent as a runtime assembly, not a single model decision.
Q: Why is inventorying AI agents harder than counting model deployments?
A: Because a usable inventory has to count registered definitions, runtime loops, tool grants and delegated sub-agents, not just model endpoints.
Q: What do security teams get wrong about tools, skills and sub-agents?
A: They often collapse all three into a single delegation category, which hides the different governance needs behind each one.
Practitioner guidance
- Define the agent as a governed runtime object Inventory each agent by model, scaffold, tools, skills and sub-agents, then assign an owner for each control surface rather than treating the agent as a single application.
- Separate prompt change control from runtime change control Route scaffold edits, harness logic updates and model swaps through different review paths so that a prompt revision is not mistaken for a harmless content tweak.
- Apply least privilege to delegated capabilities Authorize tools per call, version skills as reusable procedures and isolate sub-agents with bounded permissions and traceable execution.
Bottom line: The article shows that AI agent governance depends on mapping vocabulary to runtime components, not on refining terminology in the abstract.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:11 pm
Vocabulary standardisation becomes a governance control once it is tied to runtime addresses. A glossary alone does not change security posture, but a glossary that maps model, scaffold, harness, tool and sub-agent to concrete infrastructure makes inventory and accountability possible. That is especially relevant in AI and NHI governance, where control failures often start with ambiguous ownership rather than overt misuse. Practitioners should treat terminology alignment as an enabler for access control, review and audit.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between agent policy and model versioning?
A: Model versioning tracks one input to behavior, but policy covers the combined effect of the model, scaffold, tools and harness. The same checkpoint can behave very differently when prompts, tool descriptions or loop rules change. Teams should therefore test and approve the full configuration, not assume a model swap tells the whole story.
👉 Read our full editorial: AI agent vocabulary maps to the production stack teams govern