Almost every enterprise is now learning to talk about AI agents. Far fewer can make one work. In McKinsey's 2025 global survey, 88% of organizations already use AI in at least one business function, yet no more than 10% have scaled agents in any single function [1]. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, citing cost, unclear value, and weak controls [2]. Behind that gap sits a vocabulary problem: teams adopt the tools before they share the language to reason about them. This glossary fixes that.
The short answer: the 20 terms below group into six jobs every agent must do well, run a loop, stay grounded, connect to tools and other agents, coordinate at scale, stay under control, and prove it works. Learn them once and every agent decision, from architecture to budget, gets clearer.
Why does this vocabulary matter now?
Because the words map directly to where projects succeed or fail.
Adoption is wide and results are thin (see FIG-1). Most organizations can start an agent pilot; far fewer make one dependable enough to trust with real work. The reason is rarely the model. It is the surrounding engineering: how the agent loops, what it retrieves, how it connects, how it is coordinated, how it is governed, and how it is measured. Each of the six clusters in this glossary is one of those decisions. Get the language right and you can tell a demo from a system.
Data
| Stage of adoption | Share of organizations |
|---|---|
| Use AI in at least one business function | 88% |
| At least experimenting with AI agents | 62% |
| Scaling an agentic system somewhere | 23% |
| Scaled agents in a single function (10% or less) | 10% |
Here is the whole map before the detail. Table 1 sorts all 20 terms into the six jobs they serve.
Table 1. The 20 agentic AI terms, grouped by the job they do.
| Job | Terms |
|---|---|
| Run the core loop | Agent loop, Tool use, Memory |
| Stay grounded in knowledge | RAG, Grounding, Context engineering |
| Connect to tools and agents | MCP, Agent protocols, A2A, Agent identity |
| Coordinate at scale | Orchestrator, Multi-agent system, Handoffs, Agentic pipeline |
| Stay safe and under control | Guardrails, Policy layer, Sandboxing, Human-in-the-loop |
| Prove it works | Agent observability, Evaluation (evals) |
What makes AI "agentic" in the first place?
An agent is a model that acts, not just answers. Three terms define the core.
1. Agent loop. The engine of agency. Instead of returning one response, the agent runs a cycle: reason about the goal, choose an action, execute it, observe the result, and repeat until the task is done. Anthropic describes effective agents as models that "use tools in a loop" based on environmental feedback, and recommends the simplest loop that works before adding structure [3].
2. Tool use. How an agent affects the world. Tools are functions the model can call: search a database, send an email, run code, hit an API. Tool use turns a text generator into something that books a meeting or files a ticket. The quality of an agent is capped by the quality and safety of the tools it can reach [3].
3. Memory. What the agent carries between steps and sessions. Short-term memory is the working context inside a single run (the conversation and intermediate results). Long-term memory is an external store the agent can write to and read from later, so it does not relearn the same fact every time. Memory is what lets an agent handle a task longer than one context window.
How do agents get the right knowledge?
A model only knows its training data until you give it more. This cluster is how.
4. RAG (retrieval-augmented generation). The dominant pattern for feeding agents fresh, private knowledge. At query time the system retrieves relevant documents from a search index or vector store and passes them to the model as context, so answers reflect your data rather than the model's memory. Purpose-built RAG systems have reported hallucination reductions of more than 40% against ungrounded baselines [4].
5. Grounding. The goal RAG serves: tying every claim to a verifiable, current source. A grounded answer can cite where it came from; an ungrounded one is a plausible guess. Grounding is what makes an agent's output auditable, which is non-negotiable in regulated or high-stakes work.
6. Context engineering. The discipline of deciding what goes into the model's limited context window, and in what order. It covers prompt structure, which retrieved chunks to include, how to compress history, and what to leave out. As agents run longer and juggle more tools, context engineering, not prompt wording, becomes the main lever on reliability and cost [5].
How do agents connect to tools and to each other?
Isolated agents are weak. The value comes from connection, and connection needs standards.
7. MCP (Model Context Protocol). The open standard for connecting an agent to tools, data, and context, often called the "USB-C for AI." Introduced by Anthropic in November 2024, it replaces one-off integrations with a single protocol any client can speak [6]. One year in, its public registry held close to 2,000 server entries after 407% growth in a quarter, and the protocol moved to neutral governance under the Linux Foundation [7].
8. Agent protocols. The broader category of open standards that let agents, tools, and services interoperate without custom glue for every pair. They are to agents what HTTP was to the web: the shared rules that turn isolated systems into an ecosystem and reduce vendor lock-in.
9. A2A (Agent2Agent). The open standard for agent-to-agent communication. Where MCP connects an agent to its tools, A2A lets separate agents, possibly built by different vendors, discover each other, exchange information securely, and delegate work. Google released it in April 2025 and contributed it to the Linux Foundation; more than 100 technology companies now back it [8][9].
10. Agent identity. A verifiable answer to "which agent is this, and what may it do?" As agents call tools and each other, each needs its own credentials, permissions, and audit trail, separate from the human who launched it. Without distinct identity you cannot enforce least privilege or trace who did what, which is why it sits at the center of agentic security guidance [10].
How do you coordinate more than one agent?
One agent is a component. A system is many, and coordination is where systems break.
11. Orchestrator. The central controller that decomposes a task, routes each part to the right agent or tool, and verifies the result. A controlled orchestrator beats a loose swarm because coordination failures, not weak models, are the leading cause of multi-agent breakdown [11]. It is the pattern we design first, not last.
12. Multi-agent system. Several specialized agents working toward one goal. Done well, it lifts performance on broad, parallelizable work: Anthropic's multi-agent researcher outperformed a strong single agent by 90.2% on its internal eval [5]. Done carelessly, it multiplies cost and failure surface. Use it when one agent provably cannot do the job, not by default.
13. Handoffs. The moment one agent passes control and context to another. A handoff that drops context or misstates the task is a classic failure point; a UC Berkeley study of 1,642 multi-agent traces traced most failures to specification and inter-agent misalignment, not raw model weakness [11]. Clean handoffs are an engineering deliverable, not an afterthought.
14. Agentic pipeline. A defined sequence of agent steps or stages, each with a clear input, output, and check. Structuring work as a pipeline lets you verify between steps, which matters because error rates compound: chain enough steps and even high per-step accuracy decays to an unreliable whole. Shorter, checked spans beat one long autonomous chain.
The catch is cost. Coordination is not free, and the currency is tokens. FIG-2 shows the multiplier.
Data
| Interaction type | Tokens vs chat |
|---|---|
| Chat | 1x |
| Single agent | 4x |
| Multi-agent system | 15x |
How do you keep agents safe and under control?
An agent wired to real tools can cause real damage. Control is a design layer, not a setting.
15. Guardrails. The controls that keep an agent inside intended behavior: input and output filters, content checks, and limits on what it can say or do. They matter because prompt injection ranks as the top security risk for LLM applications, where hostile text can hijack an agent that has access to tools [10].
16. Policy layer. The rules that decide what an agent is allowed to do before it acts: which tools it may call, on which data, and which actions need approval. Enforced independently of the model (so a jailbreak cannot rewrite the rules), the policy layer is how you apply least privilege to an autonomous system [10].
17. Sandboxing. Running an agent's actions, especially code execution and tool calls, inside an isolated environment with no standing access to production, secrets, or the network beyond what it needs. Sandboxing contains the blast radius when, not if, something goes wrong, and is a core defense-in-depth control in agentic security guidance [10].
18. Human-in-the-loop. Keeping a person at the decision points that carry real cost: approvals, exceptions, and irreversible actions. The human role does not disappear as agents improve; it moves up, toward judgment and oversight. The strongest deployments automate the routine and route the consequential to a person.
How do you know an agent actually works?
You cannot trust what you cannot measure, and a single good demo measures nothing.
19. Agent observability. Tracing, logging, and inspecting every step an agent takes, not just its final answer. Multi-step traces routinely surface failures, a repeated step, a reasoning-action mismatch, that a final-output check never sees [11]. Observability is what turns "the agent broke" into a specific, fixable signature.
20. Evaluation (evals). Measuring agent quality against a defined bar, over repeated trials rather than one attempt. It matters because agents that look strong once collapse under repetition: the tau-bench benchmark shows a leading model passing a task on a single try far more often than it passes the same task across several consecutive tries [12]. Evals are how autonomy is earned: you widen an agent's scope only as its measured reliability allows.
How MasterDragon uses these terms in practice
We build AI-native, which means these words are not trivia; they are the checklist.
Every system we ship makes each of the six decisions on purpose. We design the agent loop and its tools first, ground the agent with RAG and disciplined context engineering, connect it through open protocols like MCP and A2A with a real agent identity, coordinate through a central orchestrator instead of a swarm, wrap it in guardrails, a policy layer, sandboxing, and human approval where cost is real, and instrument it with observability and evals before we widen its autonomy. That is the difference between an agent that demos and one that ships and stays shipped.
If you are building with agents, talk to our AI engineers, and start with our portfolio of shipped AI-native products.
References
- McKinsey & Company. (2025, November 5). The state of AI in 2025: Agents, innovation, and transformation. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
- Gartner. (2025, June 25). Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
- Anthropic. (2024). Building effective AI agents. https://www.anthropic.com/research/building-effective-agents
- Gupta, S., et al. (2025). Retrieval-augmented generation: A comprehensive survey of architectures, enhancements, and robustness frontiers. arXiv. https://arxiv.org/abs/2506.00054
- Anthropic. (2025). How we built our multi-agent research system. https://www.anthropic.com/engineering/multi-agent-research-system
- Anthropic. (2024, November 25). Introducing the Model Context Protocol. https://www.anthropic.com/news/model-context-protocol
- Model Context Protocol. (2025, November 25). One year of MCP. https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/
- Google for Developers. (2025). Google Cloud donates A2A to the Linux Foundation. https://developers.googleblog.com/en/google-cloud-donates-a2a-to-linux-foundation/
- Google Open Source. (2026, April 16). A year of open collaboration: celebrating the anniversary of A2A. https://opensource.googleblog.com/2026/04/a-year-of-open-collaboration-celebrating-the-anniversary-of-a2a.html
- OWASP GenAI Security Project. (2025). LLM01:2025 Prompt injection and the Top 10 for LLM applications. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- Cemri, M., Pan, M. Z., Yang, S., Agrawal, L. A., Chopra, B., Tiwari, R., Zou, J., Ramchandran, K., Sahai, A., Gonzalez, J. E., & Stoica, I. (2025). Why do multi-agent LLM systems fail? arXiv. https://doi.org/10.48550/arXiv.2503.13657
- Yao, S., Chen, H., Yang, J., & Narasimhan, K. (2024). tau-bench: A benchmark for tool-agent-user interaction in real-world domains. arXiv. https://arxiv.org/abs/2406.12045