Glossary¶

Every term the playbook defines, in one or two plain sentences, with a link to where it's explained. Alphabetical.

A¶

Agent¶

An LLM running in a loop: it decides the next action (usually a tool call), sees the result, and repeats until it can answer or hits a limit. See the agent loop.

Agent memory¶

Everything an agent can draw on beyond the current request, split into short-term and long-term memory. See how agents remember.

Agentic SDLC¶

A software development workflow where you write specs, plans, tests and reviews and a coding agent does most of the typing: spec, plan, tests first, implement, verify, review. See the new workflow.

AI compliance¶

Building AI systems that meet the laws and standards that apply to them, such as India's DPDP Act, the GDPR and the EU AI Act, and keeping records that prove it. See compliance basics.

AI system design¶

Deciding how an AI product's parts fit together and making explicit trade-offs between quality, cost, latency, safety and simplicity. See fundamentals.

API¶

Application programming interface: the way one program asks another for something. For LLMs, your code sends messages over HTTPS and gets the reply back. See calling an LLM.

C¶

Checkpointer¶

A LangGraph component that saves the graph's state after every step under a thread ID, enabling conversation memory, resuming and human approval. See LangGraph basics.

Coding agent¶

An LLM that acts on your project (reads files, runs commands, edits code, runs tests) in a loop until a task is done. See what is a coding agent?.

Context window¶

The maximum number of tokens a model can consider in one request, covering instructions, history, documents and its own output. See tokens and context windows.

D¶

Data poisoning¶

Tampering with the data a model learns from or retrieves so it behaves the way an attacker wants. OWASP LLM05:2026. See poisoning.

E¶

Edge¶

In LangGraph, a connection that decides which node runs next. A conditional edge chooses based on the state. See LangGraph basics.

Embedding¶

A list of numbers representing the meaning of a piece of text, so that similar meanings get similar numbers. See embeddings.

Eval¶

A repeatable test that runs an AI system on fixed inputs and scores the outputs. See why evals.

Excessive agency¶

Giving an LLM system more tools, permissions or autonomy than its job needs. OWASP LLM03:2026. See excessive agency.

G¶

Generation metrics¶

Measures of a RAG answer's quality, such as faithfulness to sources and relevance to the question. See RAG metrics.

Golden dataset¶

A small, expert-reviewed set of test inputs with expected behavior, run against every version of a system. See golden datasets.

Guardrail¶

A check around an LLM, on input, output or actions, that blocks or fixes unsafe, off-topic, private or malformed content. See what are guardrails?.

H¶

Hallucination¶

Fluent, confident model output that is false or unsupported. See how LLMs work.

Hidden context exposure¶

Extraction of context users aren't meant to see (system prompt, tool schemas, retrieved rules), which matters when it holds secrets or security logic. OWASP LLM08:2026, formerly system prompt leakage. See hidden context exposure.

Hook¶

A script that runs automatically at a fixed point in an agent's lifecycle (before a tool runs, when the agent stops) to check or enforce something. See subagents and hooks.

Human-in-the-loop¶

An agent pausing before a risky action so a person can approve, edit or reject it. See human-in-the-loop.

I¶

Improper output handling¶

Passing model output to another system (browser, database, shell) without validating or encoding it. OWASP LLM10:2026. See improper output handling.

J¶

Jailbreak¶

A prompt designed to make a model break its own safety rules. A form of prompt injection. See jailbreaks.

L¶

LangGraph¶

An open-source framework that models an agent as a graph of nodes, edges and shared state, with checkpointing. See LangGraph basics.

Large language model¶

A program trained on huge amounts of text to predict the next token, repeatedly, which lets it write answers, code and more. Usually shortened to LLM. See how LLMs work.

LLM gateway¶

A proxy between your apps and model providers that enforces keys, budgets, rate limits, guardrails and logging in one place. See LLM gateways.

LLM-as-a-judge¶

Using a model with a rubric to score another system's outputs on qualities code can't check. See LLM-as-a-judge.

Long-term memory¶

Facts, preferences and past experiences an agent saves across sessions and retrieves when relevant. See how agents remember.

M¶

Memory file¶

A markdown file such as AGENTS.md or CLAUDE.md that a coding agent reads at the start of every session. See memory files.

Memory poisoning¶

Getting false information or hidden instructions saved into an agent's long-term memory. OWASP ASI06. See memory poisoning.

Misinformation¶

Wrong or unsupported model output that looks credible enough to be acted on. OWASP LLM07:2026. See misinformation.

MITRE ATLAS¶

A public catalog of attacker tactics and techniques against AI systems, with case studies. See frameworks.

Model Context Protocol¶

An open standard (MCP) for connecting AI applications to outside tools and data through MCP servers. See MCP.

Multi-agent system¶

Several specialized agents coordinated by a supervisor, a pipeline or handoffs. See multi-agent patterns.

N¶

NIST AI Risk Management Framework¶

A voluntary US framework for managing AI risk through four functions: Govern, Map, Measure, Manage. See frameworks.

Node¶

In LangGraph, one step in the graph: a function that reads the state and returns updates. See LangGraph basics.

O¶

Observability¶

Recording what happens inside every request as connected traces, so you can explain, debug and monitor an AI system. See observability.

OWASP Top 10 for Agentic Applications¶

OWASP's list of the ten biggest security risks for agents (ASI01 to ASI10), published December 2025. See agentic threats.

P¶

Personal data¶

Any information about an identifiable person. Data-protection laws such as DPDP and GDPR govern how it's handled. See memory and privacy.

PII¶

Personally identifiable information, such as names, phone numbers, emails, Aadhaar, PAN or card numbers. See PII and privacy.

Prompt¶

The text you send to an LLM, usually split into system, user, assistant and tool messages. See prompting basics.

Prompt injection¶

Text the model reads (from a user, a document, a web page or a tool) changing its behavior in ways the developer didn't intend. OWASP LLM01:2026. See prompt injection.

R¶

Red-teaming¶

Deliberately attacking your own AI system, manually and with tools, to find weaknesses before attackers do. See red-teaming.

Reliability¶

Keeping acceptable answers flowing despite slow or failing providers, traffic spikes and step failures. See reliability and scaling.

Retrieval metrics¶

Measures of whether a RAG system found the right chunks: hit rate, recall, precision, MRR. See RAG metrics.

Retrieval-augmented generation¶

Finding relevant passages in your documents and putting them in the prompt so the model answers from them. Usually shortened to RAG. See RAG in one page.

S¶

Sensitive information disclosure¶

An LLM system exposing data someone didn't authorize, through answers, tools, logs or retrieval. OWASP LLM02:2026. See sensitive information disclosure.

Short-term memory¶

The state of the current conversation or task, held in the context window and a checkpointer. See how agents remember.

Skill¶

A folder with a SKILL.md file that teaches an agent one task, loaded only when needed. See skills.

State¶

In LangGraph, the shared data passed between nodes and saved by the checkpointer. See LangGraph basics.

Subagent¶

A helper agent with its own fresh context and limited tools, handed a focused job by a main agent. See subagents and hooks.

Supply chain¶

Everything your system depends on from outside: models, adapters, datasets, packages, MCP servers, skills. OWASP LLM04:2026. See supply chain.

T¶

Temperature¶

A setting that controls how random the model's choice of next token is. Low means more predictable. See how LLMs work.

Threat modeling¶

A structured way to work out what could go wrong with a system and what to do about it, before attackers do. See threat modeling.

Token¶

A chunk of text (a word or part of one) that a model reads and writes. Pricing and limits are counted in tokens. See tokens.

Tool calling¶

Describing functions to a model so it can request calls with structured arguments, which your code validates and runs. See tool calling.

Trace¶

The connected record of every step (spans) in one request, such as model calls, tool calls and guardrail checks. See observability.

U¶

Unbounded consumption¶

No effective limits on usage, letting attackers run up bills, cause outages or copy model behavior. OWASP LLM06:2026. See unbounded consumption.

V¶

Vector and embedding weaknesses¶

Security problems in similarity search, such as cross-tenant leaks, retrieval poisoning and embedding inversion. OWASP LLM09:2026. See vector weaknesses.

Vector search¶

Finding stored texts whose embeddings are closest to a query's embedding. See embeddings.

W¶

Workflow¶

A fixed sequence of LLM calls and code, where your code, not the model, controls the order of steps. See when not to use an agent.