# Agent security glossary: AI agent security terms, defined

> This agent security glossary is a plain-language reference to 55 terms used to secure AI agents. Each entry opens with a one-sentence definition, then says why the term matters for agents. It covers protocols such as MCP and A2A, attacks such as prompt injection and tool poisoning, identity, authorization, data protection, isolation and audit, and links to the guide that covers each topic in depth.

Source: https://agentfort.net/agent-security/glossary · Updated 2026-10-28 · AgentFort

## How to use this agent security glossary

This agent security glossary defines the AI agent security terms that come up when you secure agents that act: call tools, change records, move money or run code. Entries are alphabetical. Each opens with a one-sentence definition and adds why the term matters for agents. Specialist entries link to the standard or specification they come from, and most link to the guide in this series that covers the topic in depth. Standards change, so definitions reflect each source as of October 2026.

The table groups the terms by the control they belong to. The [pillar guide](/agent-security/) explains how the controls fit together.

| Control | Key terms | Guide |
|---|---|---|
| Discover | agent inventory, shadow AI, AI-BOM, agent loop | [Discovering AI agents](/agent-security/discovery) |
| Identity | non-human identity, workload identity, SPIFFE, SVID, on-behalf-of | [AI agent identity](/agent-security/identity) |
| Authorize actions | least privilege, ABAC, Cedar, PDP and PEP, deny by default | [AI agent authorization](/agent-security/authorization) |
| Approvals and limits | human-in-the-loop, single-use approval, spending limit | [Human approval](/agent-security/human-approval) |
| Data protection | DLP, masking and tokenization, prompt injection | [AI agent DLP](/agent-security/data-protection) |
| Isolation | sandbox, seccomp, Landlock, microVM, egress control | [AI agent sandboxing](/agent-security/sandboxing) |
| Audit | audit receipt, hash chain, OCSF | [AI agent audit trails](/agent-security/audit) |
| Protocols and risks | MCP, A2A, tool poisoning, OWASP Top 10 | [MCP security](/agent-security/mcp-security) |

## A

### A2A (Agent2Agent protocol)

A2A is an open protocol that lets AI agents built on different frameworks, by different vendors, discover each other, delegate tasks and exchange results without sharing their internal state or tools. Each A2A server publishes an Agent Card, a JSON document describing its identity, skills, endpoint and the authentication it requires. [A2A](https://a2a-protocol.org/latest/) was created by Google and donated to the Linux Foundation; it complements MCP, which connects agents to tools.

### ABAC (attribute-based access control)

ABAC is an access control model that decides using attributes of the caller, the resource, the action and the context, such as department, record owner, amount or time of day. It suits agents because the risk of a call usually sits in its attributes: a refund's amount, or which customer an invoice belongs to. See [AI agent authorization](/agent-security/authorization).

### Agent

An agent (AI agent) is software that uses a language model to decide what to do and then acts, by calling tools, APIs or other agents, often over several steps. What makes it an agent is the action: it sends email, updates records or issues refunds rather than only producing text. The [pillar guide](/agent-security/) covers how to secure one end to end.

### Agent inventory

An agent inventory is a maintained list of every AI agent in an organization, with where it runs, which model and tools it uses, what it can reach and who owns it. A reliable inventory is built from evidence such as platform APIs, model-call logs, identity providers, code repositories and runtime sensors, not from surveys that go stale. See [discovering AI agents](/agent-security/discovery).

### Agent loop

The agent loop is the cycle in which a model receives a task, asks for a tool, gets the tool's result back and decides the next step, repeating until the task is done. Seeing this loop in traffic, a model call that requests tools followed by tool results going back, is strong evidence that a piece of software is an agent and not a simple AI feature.

### Agentic AI

Agentic AI is the broad term for AI systems that pursue goals with some autonomy: planning steps, calling tools and acting on other systems with limited human input. In security writing it usually means the new risks and controls that appear once AI can take actions instead of only generating text.

### AI feature vs agent

An AI feature is a capability that uses a model to produce content, such as a summary or a draft, but takes no action itself; an agent decides and acts on other systems. The distinction sets priorities: a marketing-copy tool mainly needs data protection, while an agent that can issue refunds also needs identity, authorization and approvals.

### AI-BOM (AI bill of materials)

An AI-BOM is an inventory of the components an AI system depends on: models, datasets, frameworks, libraries and connected tools, with versions and provenance. It extends the software bill of materials to AI, and open formats such as the [CycloneDX ML-BOM](https://cyclonedx.org/capabilities/mlbom/) can record it. Posture tools use it to find vulnerable or unapproved components.

### Audit receipt

An audit receipt is a record of one decision about one agent request: which agent, acting for whom, under which grant and policy, what was decided and when. Good receipts record denials as well as approvals, and describe sensitive data without storing its values. See [AI agent audit trails](/agent-security/audit).

## C–D

### Cascading failure

A cascading failure is an error in one agent or step that spreads through connected agents and automated pipelines, growing as each step trusts the one before. The OWASP Top 10 for Agentic Applications lists it as ASI08 Cascading Failures. Limits per step, checks between agents and circuit breakers keep one mistake local.

### Cedar

Cedar is an open-source language and engine for writing authorization policies and evaluating requests against them, released by AWS under the Apache 2.0 license. A request is [denied unless a permit policy matches](https://docs.cedarpolicy.com/auth/authorization.html), and any matching forbid policy overrides a permit. Cedar is designed for automated reasoning, so tools can analyze what a set of policies allows before it goes live.

### Confused deputy

A confused deputy is a program with legitimate authority that is tricked into using it on behalf of someone who should not have it. Agents are natural deputies: they hold credentials and follow instructions that may come from untrusted content. The [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) describe a confused deputy attack on MCP proxy servers that skips user consent.

### Credential broker

A credential broker is a component that holds the secrets needed to call services and attaches them to approved requests on the agent's behalf, so the agent never sees or stores them. If the agent is compromised, there is no long-lived key to steal, and every use of the credential passes a policy check first.

### Data loss prevention (DLP)

Data loss prevention is a set of controls that find sensitive data, such as personal data, secrets or card numbers, and stop it moving where policy says it should not go. For agents, DLP inspects prompts, files and tool results in both directions and can mask, remove or block values. See [AI agent data loss prevention](/agent-security/data-protection).

### Delegation ceiling

A delegation ceiling is the maximum authority an administrator allows, within which system owners may grant access to agents. Owners can delegate less but never more: if the ceiling for refunds is $500 per call, no owner can grant $600. It keeps local decisions fast without letting them exceed central policy.

### Deny by default

Deny by default is a policy stance in which any request that no rule explicitly allows is refused. For agents, it means a new tool, operation or agent has no access until someone grants it, which keeps surprise capabilities closed.

## E–L

### Egress control

Egress control is the restriction of where a system can send outbound traffic: which hosts, ports and protocols. For agents, tight egress control, ideally no direct network at all with one inspected way out, stops a hijacked agent from sending data to an attacker's server. See [AI agent sandboxing](/agent-security/sandboxing).

### Fail closed

Fail closed is a design in which a security control that cannot reach a decision, because it is down or unreachable, refuses requests instead of allowing them. A gateway may keep the last signed policy for a short lease, then deny everything. Failing open keeps systems running but turns the control into a log.

### Goal hijack

Goal hijack is an attack that changes what an agent is trying to achieve, usually through instructions hidden in content it reads, so it works for the attacker while appearing to do its job. It is ASI01 Agent Goal Hijack in the OWASP Top 10 for Agentic Applications. Prompt injection is the most common way in.

### Hash chain

A hash chain is a sequence of records in which each record includes a cryptographic hash of the one before it. Changing or deleting any entry breaks every later hash, so tampering becomes visible. Agent audit logs use hash chains to make a missing or edited receipt detectable.

### Human-in-the-loop (HITL)

Human-in-the-loop is a design in which a person must review and approve certain agent actions before they run. It works best when the approver sees the exact call and its arguments, is not the person the agent acts for, and is asked rarely enough to read each request properly. See [human approval for agent actions](/agent-security/human-approval).

### Just-in-time (JIT) access

Just-in-time access is a model that grants a permission only when it is needed and removes it after a short time or a single use. For agents, it replaces standing keys with short-lived, narrowly scoped credentials issued per task or per call.

### Landlock

Landlock is a Linux security module that lets any process, including unprivileged ones, restrict its own access to the file system and network ports. [Landlock](https://docs.kernel.org/userspace-api/landlock.html) stacks on top of system-wide access controls. Agent sandboxes use it to confine a process to its own workspace even if the code inside turns hostile.

### Least privilege

Least privilege is the principle that every identity gets only the access its job needs, for only as long as it needs it. For agents, it applies at the level of individual operations, arguments and records, not just which systems an agent can reach. See [least privilege for AI agents](/agent-security/authorization).

## M–O

### Masking and tokenization (placeholders)

Masking is the hiding of all or part of a sensitive value in output, such as showing only a card's last four digits, in a way the reader cannot reverse. Tokenization replaces a value with a placeholder that a trusted component can swap back later. Agents use placeholders when sending text to a model provider: the model works with tokens, and the real values are restored in the answer.

### MCP (Model Context Protocol)

MCP is an open protocol, built on JSON-RPC messages, that connects AI applications to tools, data and prompt templates. The [specification](https://modelcontextprotocol.io/specification/latest) says descriptions of tool behavior should be treated as untrusted unless they come from a trusted server. As of October 2026, the current version is dated 2026-07-28. See [MCP security](/agent-security/mcp-security).

### MCP client and MCP server

An MCP server is a service that exposes tools, resources and prompts over MCP; an MCP client is the connector inside an AI application (the host) that talks to one server. When authorization is used, the [MCP server acts as an OAuth 2.1 resource server](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) and must accept only tokens issued for it.

### Memory poisoning

Memory poisoning is the planting of false or malicious content in an agent's memory or long-term context so that it changes the agent's behavior in later sessions. OWASP lists it as ASI06 Memory and Context Poisoning. Defenses include checking what gets written to memory, recording its source and expiring it.

### MicroVM

A microVM is a lightweight virtual machine with a minimal device model that starts quickly, giving each workload virtual-machine isolation with overhead close to a container's. [Firecracker](https://firecracker-microvm.github.io/), built at AWS, uses Linux KVM to create microVMs, and agent sandbox services such as E2B build on it.

### Non-human identity (NHI)

A non-human identity is any identity used by software rather than a person: service accounts, API keys, tokens, certificates, workload identities and agent identities. NHIs are easy to share, slow to expire and easy to lose track of, which is why each agent needs its own with a named owner. See [AI agent identity](/agent-security/identity).

### OAuth 2.0 token exchange

OAuth 2.0 token exchange, defined in [RFC 8693](https://www.rfc-editor.org/rfc/rfc8693.html), is a protocol for trading one security token for another at a security token service. It supports delegation, where an agent keeps its own identity while acting for a user and the new token names it in an `act` (actor) claim, and impersonation, where the agent becomes indistinguishable from the user. Delegation suits agents better because logs show both parties.

### OCSF (Open Cybersecurity Schema Framework)

OCSF is an open-source framework and vendor-agnostic core schema for security events, written in JSON and maintained as a Linux Foundation project. Writing agent audit events in [OCSF](https://ocsf.io/) lets a SIEM or data lake query them alongside other security data without custom parsing.

### On-behalf-of (acting-for)

On-behalf-of, or acting-for, describes an agent that performs actions for a specific person, such as an assistant updating its user's support cases. Policy should check both identities: the agent may act only within what that person could do, and the person it acts for should not approve its risky requests.

### OPA and Rego

OPA (Open Policy Agent) is an open-source, general-purpose policy engine that separates policy decisions from enforcement; it is a graduated Cloud Native Computing Foundation project. Rego is [OPA's](https://www.openpolicyagent.org/docs) declarative policy language, inspired by Datalog and built for rules over JSON-like data.

### OWASP Top 10 for Agentic Applications

The OWASP Top 10 for Agentic Applications is a peer-reviewed list of the most critical security risks for agentic AI, published by the OWASP GenAI Security Project on December 9, 2025, for 2026. Its entries run from ASI01 Agent Goal Hijack to ASI10 Rogue Agents. See [controls for each OWASP agentic risk](/agent-security/owasp-agentic-top-10).

## P–R

### Policy decision point (PDP) and policy enforcement point (PEP)

A policy decision point is the component that evaluates a request against policy and returns allow or deny; a policy enforcement point is the component in the request path that asks the PDP and carries out the answer. For agents, the PEP is typically a gateway in front of tools, and the PDP an engine such as Cedar or OPA. Keeping them separate lets one policy govern many enforcement points.

### Prompt injection (direct and indirect)

Prompt injection is an attack that puts instructions into a model's input so that it ignores or overrides the instructions its builders gave it. Direct prompt injection comes from the person typing to the agent. Indirect prompt injection hides the instructions in content the agent reads, such as an email, web page, document or tool result, and is the bigger risk for agents that act.

### RBAC (role-based access control)

RBAC is an access control model that grants permissions to roles and assigns identities to those roles. It is simple to audit but coarse for agents: a "support agent" role cannot say which customer's records or what refund amount is acceptable without adding attributes.

### ReBAC (relationship-based access control)

ReBAC is an access control model that decides access from relationships between entities, such as "this person owns this case" or "this invoice belongs to this customer". It suits agents acting for people, because a check can follow the path from the person to the record. [OpenFGA](https://openfga.dev/), a CNCF project, implements ReBAC based on ideas from Google's Zanzibar paper.

### Red teaming

Red teaming is structured adversarial testing in which people or tools attack a system to find weaknesses before real attackers do. For agents it covers prompt injection, tool misuse, data leakage and privilege abuse, and it works best repeated in CI as models, prompts and tools change. See [AI agent security tools](/agent-security/tools).

### Rogue agent

A rogue agent is an agent acting outside its intended purpose or authority, through compromise, misalignment or drift, sometimes while concealing what it does. OWASP lists it as ASI10 Rogue Agents. Containment, kill switches and monitoring that the agent cannot switch off limit the damage.

## S

### Sandbox

A sandbox is an isolated environment that limits what code inside it can reach: files, network, system calls, memory and processes. Agent sandboxes assume the code inside may already be the attacker's and keep the effects contained. See [AI agent sandboxing](/agent-security/sandboxing).

### Seccomp

Seccomp (secure computing mode) is a Linux feature that lets a process install a filter, written as a BPF program, that allows or refuses each system call based on its number and arguments. Sandboxes use it to block risky calls such as mounting file systems or loading kernel modules. The [kernel documentation](https://docs.kernel.org/userspace-api/seccomp_filter.html) notes that system call filtering is not a sandbox by itself; it is one building block.

### Separation of duties

Separation of duties is the rule that no single person or agent can both request and approve a sensitive action. For agents, the person an agent acts for should not approve that agent's risky call, and one agent should not approve another agent's request without human review.

### Shadow AI

Shadow AI is AI use that no platform, project or owner accounts for, such as a script that sends spreadsheets to a public model or an agent built outside approved tools. It is rarely malicious, just invisible, and you cannot protect or explain to an auditor what you do not know exists. See [shadow AI agents](/agent-security/discovery).

### Single-use approval

A single-use approval is a human approval that authorizes one exact call, with its arguments, exactly once. If the agent asks again, even with identical arguments, it needs a new approval, which stops one approved action from becoming a standing permission.

### Spending limit and rate limit

A spending limit is a cap on the money an agent can move per call, per record or per period, such as $2,000 refunded per invoice per week. A rate limit caps how many requests an identity can make in a time window. Rate limits protect capacity, spending limits protect the business, and agents that touch money need both. See [AI agent spending limits](/agent-security/spending-limits).

### SPIFFE

SPIFFE (Secure Production Identity Framework for Everyone) is an open standard for giving software workloads cryptographic identities. Each workload gets a SPIFFE ID, a URI that names its trust domain and the workload, which it proves with an SVID. The [SPIFFE](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/) Workload API hands out identities without the workload needing to know its own in advance.

### SPIRE

SPIRE is the production-ready implementation of the SPIFFE APIs. [SPIRE](https://spiffe.io/docs/latest/spire-about/spire-concepts/) attests nodes and workloads, then issues SVIDs to them and lets them verify each other's. Teams that run it can give agents identities without storing secrets inside them.

### SVID

An SVID (SPIFFE Verifiable Identity Document) is the document a workload uses to prove its identity: it carries one SPIFFE ID and is signed by an authority in that ID's trust domain. SVIDs come as X.509 certificates, which SPIFFE recommends where possible, or as JWTs, which are open to replay.

## T–W

### Token passthrough

Token passthrough is an anti-pattern in which an MCP server accepts a token that was not issued to it and forwards it to a downstream API. The MCP specification forbids it because it bypasses controls and breaks audit trails: the server cannot tell clients apart, and downstream logs show the wrong caller.

### Tool call (function calling)

A tool call is a structured request from a model to run a named function with arguments, such as `refund(invoice_id, amount)`. "Function calling" is the name many model APIs give the same feature. Every tool call is a natural point to enforce policy, because it is where text becomes action.

### Tool poisoning and rug pulls

Tool poisoning is an attack that hides malicious instructions in a tool's description or metadata, which the model reads and may follow. A rug pull is a tool that looks safe when approved and later changes its definition or behavior. Pinning tool definitions, re-reviewing every change and keeping new tools closed until approved defend against both. See [MCP security](/agent-security/mcp-security).

### Workload attestation

Workload attestation is the process of verifying what a running piece of software is, from evidence the platform provides, before giving it an identity. SPIRE's agent, for example, asks the local kernel or kubelet about the calling process, such as its user, path or Kubernetes service account, and matches the answer against registered selectors.

### Workload identity

Workload identity is an identity bound to running software rather than to a stored secret, issued by the platform the software runs on: a cloud IAM role, a Kubernetes service account or a SPIFFE ID. It lets an agent prove who it is with short-lived credentials that never need to be copied into code.

## Putting the terms to work

Definitions help only if they change what you check. Use this list to turn the glossary into a review of one agent:

- Confirm the agent appears in your agent inventory with a named owner.
- Give it a workload identity of its own instead of a shared API key.
- Write its 3 riskiest actions as policies, with deny by default for everything else.
- Decide which actions need single-use approval, and who may approve them.
- Set spending limits per record and per period, not only per call.
- Check that the enforcement point fails closed.
- Route code-executing agents through a sandbox with one inspected way out.
- Keep receipts for denials as well as approvals, in a hash chain so gaps show.

## How AgentFort uses these terms

AgentFort is security for AI agents, built on several of the standards defined here. AgentFort Identity uses an agent's existing identity where one exists and otherwise issues a SPIFFE identity, only after the owner approves the exact program. AgentFort Access enforces deny by default with Cedar policies, a forbid that always wins, single-use approvals, spending limits and acting-for rules, where the person an agent acts for cannot approve its request. If its control plane is unreachable, it fails closed after a short lease. AgentFort Data Protection sends personal values to model providers as placeholders. AgentFort Isolation confines tasks with Landlock, seccomp and cgroups and no network. Every request gets a chained receipt. See [AgentFort Access](/platform/access) or [watch the demo](/demo).

## Frequently asked questions

### Is prompt injection the same as jailbreaking?

They overlap but are not the same. Jailbreaking usually means getting a model to ignore its safety training, typically by the person typing. Prompt injection means getting a model to follow instructions its builders did not give, often hidden in content it reads. Many sources treat jailbreaking as one kind of prompt injection. For agents that take actions, indirect prompt injection is usually the bigger risk.

### What is the difference between authentication and authorization for AI agents?

Authentication proves which agent is calling, for example with a workload certificate or a token from an identity provider. Authorization decides what that agent may do: which operation, with which arguments, on which record, for which person. An agent can be fully authenticated and still make a call it should not, so both checks are needed on every request.

### What is the difference between a guardrail and a policy?

A guardrail is usually a classifier or filter that judges content, such as whether a prompt looks like an injection attempt. It is probabilistic and can miss. A policy is a deterministic rule evaluated at an enforcement point, such as refunds over $2,000 per invoice per week are denied. Most agent deployments need both: guardrails for content, policies for actions.

### Which agent security terms should I learn first?

Start with six: agent, tool call, prompt injection, least privilege, workload identity and audit receipt. Together they describe what an agent is, where it acts, how it gets manipulated, how much access it should have, how it proves who it is, and how you show what happened. Most other terms in this glossary refine one of those six.

## Sources

- [Model Context Protocol specification (latest)](https://modelcontextprotocol.io/specification/latest)
- [MCP authorization specification, version 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)
- [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
- [A2A Protocol](https://a2a-protocol.org/latest/)
- [A2A Protocol specification](https://a2a-protocol.org/latest/specification/)
- [SPIFFE concepts](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/)
- [SPIRE concepts](https://spiffe.io/docs/latest/spire-about/spire-concepts/)
- [RFC 8693: OAuth 2.0 Token Exchange](https://www.rfc-editor.org/rfc/rfc8693.html)
- [Landlock: unprivileged access control (Linux kernel documentation)](https://docs.kernel.org/userspace-api/landlock.html)
- [Seccomp BPF (Linux kernel documentation)](https://docs.kernel.org/userspace-api/seccomp_filter.html)
- [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io/)
- [Cedar: authorization (default deny, forbid overrides permit)](https://docs.cedarpolicy.com/auth/authorization.html)
- [Cedar policy language (GitHub)](https://github.com/cedar-policy/cedar)
- [Open Policy Agent documentation](https://www.openpolicyagent.org/docs)
- [OpenFGA](https://openfga.dev/)
- [Firecracker](https://firecracker-microvm.github.io/)
- [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)
- [OWASP: Top 10 for Agentic Applications announcement (risk names)](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/)
- [CycloneDX Machine Learning Bill of Materials (ML-BOM)](https://cyclonedx.org/capabilities/mlbom/)