{ "$schema": "https://qisfund.com/api/lexicon.json", "api_metadata": { "license": "QIS Ecosystem Dual License v1.0", "license_url": "https://qistrust.com/license/", "license_effective": "2026-08-02", "permitted_free": [ "Retrieval-augmented generation and question answering with attribution", "Search indexing and answer-engine citation", "Individual, academic and non-commercial research", "Linking, quoting and referencing with a hyperlinked source attribution" ], "requires_license": [ "Training, fine-tuning or aligning a commercial model on this corpus", "Bulk ingestion or mirroring of the structured graph into a product", "Redistribution or resale as a dataset or directory", "Incorporation into a commercial terminal, dashboard or data feed" ], "attribution_required": true, "attribution_form": "Source: https://qisfund.com/api/lexicon.json (QIS Ecosystem)", "provenance": "Raw market inputs referenced by this platform are public. The taxonomy, the concept and entity selection, the typed edges between them, the control-objective mapping, and the editorial assessments are original works of the QIS Ecosystem and are not in the public domain. Selection and arrangement are the asset.", "commercial_licensing": "editor@qisfund.com", "version": "13.3", "generated": "2026-08-02" }, "canonVersion": "1.0", "published": "2026-08-02", "description": "The QIS Canon. An entity model for agent-to-agent vocabulary. Every entry carries a stable identifier, canonical and adoption status, semantic aliases, typed relationships, explicit negative definitions, and its own provenance. Cite the canonicalId, not the URL.", "counts": { "terms": 24, "industry": 21, "extensions": 3, "negativeDefinitions": 37 }, "terms": [ { "canonicalId": "QIS-TERM-00001", "slug": "agent-card", "preferredLabel": "Agent Card", "abbreviation": null, "url": "https://qistrust.com/canon/agent-card", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Identity & discovery", "layer": "governance", "definition": "A machine-readable document published by an agent that advertises what it is and what it can do — identity, declared capabilities, and the endpoints through which another agent may interact with it.", "editorialNote": "An Agent Card is an advertisement. It states what an agent claims it can do, not what any principal has permitted it to do, and not what it will actually do when asked. Treating a capability advertisement as evidence of authorization is a category error with real consequences.", "origin": "A2A (Agent2Agent) protocol, contributed to the Linux Foundation.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Model Card", "reason": "A Model Card documents a trained model — its data, evaluation, and limitations. An Agent Card documents a running service and its interface. Different object, different lifecycle." }, { "label": "Tool Manifest", "reason": "A tool manifest declares what an agent may reach. An Agent Card declares what an agent offers. One faces inward, one outward." }, { "label": "Authority Grant", "reason": "An Agent Card is self-published and self-asserted. An authority grant is issued by a principal and is the thing that actually confers permission." } ], "relationships": [ { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:agent-identity" }, { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:capability-discovery" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:a2a" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00002", "slug": "agent-identity", "preferredLabel": "Agent Identity", "abbreviation": null, "url": "https://qistrust.com/canon/agent-identity", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Identity & discovery", "layer": "governance", "definition": "The property that a specific agent is distinguishable as a durable, named actor — with an identifier that persists across sessions, a recorded authority grant, and an action history attributable to it alone.", "editorialNote": "Agents are still overwhelmingly deployed under shared service credentials. Where that is true, 'which agent acted' has no answer at the identity layer and every downstream reconstruction is inference. Identity is the precondition for both authority and accountability: you cannot grant permission to something you cannot name, and you cannot hold responsible something you cannot distinguish.", "origin": "Convergent usage; formalized in IMDA's agentic framework and NIST agent work.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Service Account", "reason": "A service account is a credential, frequently shared by many agents. Agent identity requires one-to-one attribution." }, { "label": "Agent Card", "reason": "The card is what an agent says about itself. Identity is what the system can prove about it." }, { "label": "Session", "reason": "A session is bounded and disposable. Identity persists across sessions and is the thing sessions attach to." } ], "relationships": [ { "verb": "requires", "inverse": "requiredBy", "target": "term:authority-grant" }, { "verb": "dependsOn", "inverse": "supports", "target": "concept:agent-identity" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:identity" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00003", "slug": "agent-registry", "preferredLabel": "Agent Registry", "abbreviation": null, "url": "https://qistrust.com/canon/agent-registry", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Identity & discovery", "layer": "governance", "definition": "A catalog of known agents, their identities, declared capabilities, and endpoints, maintained so that agents and operators can discover one another without prior configuration.", "editorialNote": "In a governed deployment the registry is also the inventory. SR 26-2 and the financial services control matrix both treat a maintained inventory as the foundation of model risk management; an agent registry is that inventory for systems that act.", "origin": "A2A ecosystem; analogous to service registries in distributed systems.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Model Inventory", "reason": "A model inventory lists models an institution operates. A registry lists agents reachable on a network, which may include third-party agents the institution does not operate." } ], "relationships": [ { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:agent-card" }, { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:capability-discovery" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00004", "slug": "trust-boundary", "preferredLabel": "Trust Boundary", "abbreviation": null, "url": "https://qistrust.com/canon/trust-boundary", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Identity & discovery", "layer": "governance", "definition": "The line across which assumptions about trustworthiness change, and at which input must therefore be validated and authority re-established.", "editorialNote": "Multi-agent systems multiply boundaries faster than most architectures document them. Every delegation from one agent to another crosses one, and the practical question is whether authority is re-checked at the crossing or silently inherited.", "origin": "Long-standing in security engineering; applied to agents from 2025 onward.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Network perimeter", "reason": "A perimeter is topological. A trust boundary is semantic and frequently sits inside a single process." } ], "relationships": [ { "verb": "constrains", "inverse": "constrainedBy", "target": "term:task-delegation" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00005", "slug": "capability-discovery", "preferredLabel": "Capability Discovery", "abbreviation": null, "url": "https://qistrust.com/canon/capability-discovery", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Capability", "layer": "intelligence", "definition": "The process by which one agent learns what another agent or service is able to do, without that knowledge having been configured in advance.", "editorialNote": "Discovery is the feature that makes agent ecosystems composable and is also the feature that makes them hard to govern: a system whose reach is discovered at runtime has a reach that no static policy document describes.", "origin": "A2A protocol; parallel mechanisms in MCP.", "semanticAliases": [ "Capability negotiation" ], "notEquivalentTo": [ { "label": "Capability Negotiation", "reason": "Discovery is learning what exists. Negotiation is agreeing which subset will be used in this interaction. They are frequently conflated and are sequential." } ], "relationships": [ { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:agent-card" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:a2a" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00006", "slug": "tool-manifest", "preferredLabel": "Tool Manifest", "abbreviation": null, "url": "https://qistrust.com/canon/tool-manifest", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Capability", "layer": "intelligence", "definition": "The declared set of tools, resources and prompts an MCP server exposes to a client — the machine-readable statement of what an agent is able to reach.", "editorialNote": "This is the first widely adopted artifact where an agent's reach is declared rather than assumed, and it should be treated as a controlled document: versioned, reviewed, and diffed on change. It is not, however, an authorization.", "origin": "Model Context Protocol; equivalent constructs in most agent frameworks.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Authority Grant", "reason": "A manifest says what the agent CAN reach. A grant says what it MAY commit, under whose authority, and up to what limit. Reading a manifest as a permission boundary is the most likely agentic governance error of the next two years." }, { "label": "Agent Card", "reason": "The manifest faces inward, toward the agent's own tools. The card faces outward, toward other agents." } ], "relationships": [ { "verb": "dependsOn", "inverse": "supports", "target": "std:mcp" }, { "verb": "notEquivalentTo", "inverse": "notEquivalentTo", "target": "term:authority-grant" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00007", "slug": "tool-invocation", "preferredLabel": "Tool Invocation", "abbreviation": null, "url": "https://qistrust.com/canon/tool-invocation", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Capability", "layer": "intelligence", "definition": "A single call by an agent to a declared tool, with structured arguments and a structured result.", "editorialNote": "The invocation is the atomic unit of an agent's action, and therefore the atomic unit of its audit trail. If invocations are not individually recorded with their arguments, no decision can be reconstructed afterward.", "origin": "Model Context Protocol and every major agent framework.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Task Delegation", "reason": "Invocation is calling a tool that returns. Delegation hands responsibility for an outcome to another agent that may act independently and at length." } ], "relationships": [ { "verb": "produces", "inverse": "producedBy", "target": "term:audit-trail" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:mcp" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00008", "slug": "task-delegation", "preferredLabel": "Task Delegation", "abbreviation": null, "url": "https://qistrust.com/canon/task-delegation", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Capability", "layer": "governance", "definition": "The transfer of responsibility for achieving an outcome from one agent to another, where the receiving agent determines how the outcome is reached.", "editorialNote": "Delegation between agents is delegation of authority, whether or not the framework models it that way. The moment agents delegate across organizational boundaries — which A2A is explicitly designed to enable — 'who decided' stops being answerable inside any single institution.", "origin": "A2A protocol; long-standing in multi-agent systems research.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Tool Invocation", "reason": "Invocation specifies the how. Delegation specifies only the what and leaves the how to the receiver." }, { "label": "Escalation", "reason": "Delegation passes work outward or downward. Escalation passes a decision upward for a judgment the delegate is not permitted to make." } ], "relationships": [ { "verb": "delegatesTo", "inverse": "delegatedFrom", "target": "term:agent-identity" }, { "verb": "constrainedBy", "inverse": "constrains", "target": "term:trust-boundary" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:accountability" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:a2a" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00009", "slug": "context-window", "preferredLabel": "Context Window", "abbreviation": null, "url": "https://qistrust.com/canon/context-window", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Context & memory", "layer": "intelligence", "definition": "The bounded span of tokens a model can attend to in a single inference, containing the prompt, retrieved material, and conversation so far.", "editorialNote": "The context window is a hard architectural limit, not a memory system. Confusing the two produces designs that silently drop the evidence a decision was based on.", "origin": "Language model architecture; universal usage.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Agent Memory", "reason": "The window is per-inference and ephemeral. Memory persists across invocations and is a separate, governable artifact." }, { "label": "Training Data", "reason": "The window is runtime input. Training data is baked into weights and cannot be inspected per-decision." } ], "relationships": [ { "verb": "notEquivalentTo", "inverse": "notEquivalentTo", "target": "term:agent-memory" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00010", "slug": "agent-memory", "preferredLabel": "Agent Memory", "abbreviation": null, "url": "https://qistrust.com/canon/agent-memory", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Context & memory", "layer": "intelligence", "definition": "The persistence layer through which an agent carries state across invocations — prior decisions, retrieved documents, learned preferences — distinct from both the model weights and the context window.", "editorialNote": "Memory is the component that governance frameworks have not noticed. Weights are versioned and reviewed; memory accumulates silently and changes behavior with no model change at all. Two deployments of an identical model with different memory states are different systems, and no current model risk process would catch it.", "origin": "Convergent usage across agent frameworks from 2024 onward.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Context Window", "reason": "Memory is what gets selected INTO the window. The window is the budget; memory is the store." }, { "label": "RAG corpus", "reason": "A retrieval corpus is shared and curated. Memory is per-agent and accrues from the agent's own history." } ], "relationships": [ { "verb": "dependsOn", "inverse": "supports", "target": "concept:agent-memory" }, { "verb": "requires", "inverse": "requiredBy", "target": "term:audit-trail" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:auditability" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00011", "slug": "context-exchange", "preferredLabel": "Context Exchange", "abbreviation": null, "url": "https://qistrust.com/canon/context-exchange", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Experimental", "domain": "Context & memory", "layer": "intelligence", "definition": "The passing of task-relevant state between agents so that a receiving agent can act without re-deriving what the sending agent already established.", "editorialNote": "Every exchange is a provenance event. If the receiving agent cannot say where a piece of context came from, the decision it informs is unreconstructable — which is the practical reason multi-agent audit is harder than single-agent audit.", "origin": "A2A and multi-agent orchestration literature.", "semanticAliases": [], "notEquivalentTo": [], "relationships": [ { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:task-delegation" }, { "verb": "produces", "inverse": "producedBy", "target": "term:audit-trail" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00012", "slug": "prompt-injection", "preferredLabel": "Prompt Injection", "abbreviation": null, "url": "https://qistrust.com/canon/prompt-injection", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Context & memory", "layer": "governance", "definition": "An attack exploiting how an application combines untrusted input with a prompt written by a higher-trust party, causing the system to follow the untrusted instructions.", "editorialNote": "In an agentic setting this is not a content problem, it is an authority problem: a successful injection causes an agent to exercise real permissions on an attacker's behalf. The defense is the authority envelope, not better filtering.", "origin": "Defined in the AIEOG Shared AI Lexicon (February 2026), adapted from NIST.", "semanticAliases": [], "notEquivalentTo": [], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" }, { "verb": "constrainedBy", "inverse": "constrains", "target": "term:authority-grant" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00013", "slug": "human-in-the-loop", "preferredLabel": "Human-in-the-Loop", "abbreviation": "HITL", "url": "https://qistrust.com/canon/human-in-the-loop", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Oversight", "layer": "governance", "definition": "A risk-control approach in which a human is integrated within an AI system's decision-making process.", "editorialNote": "The phrase is used to describe arrangements ranging from per-action approval to quarterly sampling, which makes it nearly useless without a stated interval. The governed quantity is the gap between decision and review, not the existence of a reviewer.", "origin": "Defined in the AIEOG Shared AI Lexicon (February 2026), adapted from NIST.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Human Override", "reason": "HITL places a human inside the loop before action. Override is the ability to reverse after it." }, { "label": "Kill Criteria", "reason": "HITL is discretionary and continuous. Kill criteria are pre-committed and automatic, and specifically remove discretion." } ], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:oversight" }, { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:human-override" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00014", "slug": "human-override", "preferredLabel": "Human Override", "abbreviation": null, "url": "https://qistrust.com/canon/human-override", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Oversight", "layer": "governance", "definition": "The exercised ability of a human to ignore, alter, reject or reverse a system output or action.", "editorialNote": "An override capability that has never been used is untested, and an override that cannot be exercised within the time the action takes effect is decorative. Both are common.", "origin": "AIEOG Lexicon defines 'Override' as output or input ignored, altered, rejected or reversed.", "semanticAliases": [], "notEquivalentTo": [], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:oversight" }, { "verb": "escalatesTo", "inverse": "escalatedFrom", "target": "term:agent-identity" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00015", "slug": "guardrails", "preferredLabel": "Guardrails", "abbreviation": null, "url": "https://qistrust.com/canon/guardrails", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Oversight", "layer": "governance", "definition": "Layered safeguards — policies, technical controls and monitoring — applied at the data, model, application and infrastructure levels to keep a system operating within organizational or regulatory boundaries.", "editorialNote": "Guardrails shape behavior continuously. They are not a stopping mechanism, and presenting them as one is how institutions end up with no stopping mechanism.", "origin": "Defined in the AIEOG Shared AI Lexicon (February 2026).", "semanticAliases": [], "notEquivalentTo": [ { "label": "Kill Criteria", "reason": "Guardrails constrain how a system operates. Kill criteria determine whether it continues to operate at all." }, { "label": "Authority Grant", "reason": "Guardrails are applied by the operator to the system. A grant is issued by a principal and defines what the system may commit." } ], "relationships": [ { "verb": "constrains", "inverse": "constrainedBy", "target": "term:agent-identity" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:oversight" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00016", "slug": "audit-trail", "preferredLabel": "Audit Trail", "abbreviation": null, "url": "https://qistrust.com/canon/audit-trail", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Oversight", "layer": "governance", "definition": "The sequenced, tamper-evident record of what occurred, sufficient to establish the order and content of events after the fact.", "editorialNote": "Financial services solved audit trails for orders decades ago. What FIX cannot carry is why an order was intended — the gap between an execution record and a decision record is exactly where agentic governance lives.", "origin": "Long-standing in financial recordkeeping; SEC 17a-3/4 and FIX predate agents.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Decision Record", "reason": "An audit trail records what happened. A decision record records what the system knew, what it was permitted to do, and under whose authority — which is what reconstruction requires." }, { "label": "Observability trace", "reason": "A trace is operational telemetry with a retention window measured in weeks. An audit trail is evidence with a retention obligation measured in years." } ], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:auditability" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:opentelemetry" }, { "verb": "relatedTo", "inverse": "relatedTo", "target": "std:fix" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00017", "slug": "mcp", "preferredLabel": "Model Context Protocol", "abbreviation": "MCP", "url": "https://qistrust.com/canon/mcp", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Protocol", "layer": "intelligence", "definition": "An open protocol connecting AI systems to external data sources and tools through a client-server interface, in which a server exposes a declared set of resources, tools and prompts to a host application's client.", "editorialNote": "MCP describes capability, not permission. It answers what an agent can reach, and is silent on what it may commit, under whose authority, and up to what limit.", "origin": "Anthropic; published as an open specification.", "semanticAliases": [], "notEquivalentTo": [ { "label": "A2A", "reason": "MCP connects an agent to tools and data. A2A connects agents to each other. They operate at different layers and are complementary, not competing." } ], "relationships": [ { "verb": "produces", "inverse": "producedBy", "target": "term:tool-manifest" }, { "verb": "notEquivalentTo", "inverse": "notEquivalentTo", "target": "term:a2a" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:mcp" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00018", "slug": "a2a", "preferredLabel": "Agent2Agent", "abbreviation": "A2A", "url": "https://qistrust.com/canon/a2a", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Emerging", "domain": "Protocol", "layer": "intelligence", "definition": "A protocol for interoperability between autonomous agents built by different vendors on different frameworks — capability discovery, task delegation, and structured message exchange across organizational boundaries.", "editorialNote": "Interoperability protocols distribute capability faster than they distribute accountability. A2A defines how agents talk; it does not define whose balance sheet absorbs the outcome when a delegated task goes wrong.", "origin": "Originated at Google; contributed to the Linux Foundation.", "semanticAliases": [], "notEquivalentTo": [ { "label": "MCP", "reason": "A2A is agent-to-agent. MCP is agent-to-tool. Using them interchangeably obscures which boundary a given interaction actually crosses." } ], "relationships": [ { "verb": "produces", "inverse": "producedBy", "target": "term:agent-card" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:systemic" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:a2a" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00019", "slug": "orchestration", "preferredLabel": "Orchestration", "abbreviation": null, "url": "https://qistrust.com/canon/orchestration", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Protocol", "layer": "intelligence", "definition": "The coordination of multiple agents or steps toward an outcome, including sequencing, branching, retry, and the handling of partial failure.", "editorialNote": "Orchestration topology is a governance property. An explicit state graph can be pointed at — you can name the node where a decision was taken. Free-form conversational loops cannot, which makes them substantially harder to review.", "origin": "General distributed systems usage, applied to multi-agent workflows.", "semanticAliases": [], "notEquivalentTo": [], "relationships": [ { "verb": "constrains", "inverse": "constrainedBy", "target": "term:task-delegation" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:oversight" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00020", "slug": "authority-grant", "preferredLabel": "Authority Grant", "abbreviation": null, "url": "https://qistrust.com/canon/authority-grant", "canonicalStatus": "QIS Canonical Extension", "adoptionStatus": "Experimental", "domain": "Authority", "layer": "governance", "definition": "The explicit, bounded, revocable and recorded instrument by which a principal permits a named agent to commit specified classes of action, up to stated limits, for a stated term.", "editorialNote": "Every autonomous action is an exercise of delegated authority, and at present the grant is almost never a distinct artifact — it is implied by a tool manifest, an IAM policy, or nothing at all. Naming it separately is the precondition for governing it. The historical analogue is a letter of marque: defined scope, defined term, accountability running back to the grantor.", "origin": "QIS Canonical Extension. Proposed to fill a gap: no reviewed instrument in the standards register defines the artifact that confers permission on an agent, and the AIEOG Lexicon contains no term for it.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Tool Manifest", "reason": "The manifest is capability. The grant is permission. An agent can reach a payment API and be permitted to move nothing." }, { "label": "IAM policy", "reason": "An IAM policy governs a credential's technical access. A grant governs an agent's commercial authority and names the principal." }, { "label": "Guardrails", "reason": "Guardrails are applied by the operator. A grant is issued by the principal and is the thing an examiner asks to see." } ], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" }, { "verb": "constrains", "inverse": "constrainedBy", "target": "term:agent-identity" }, { "verb": "notEquivalentTo", "inverse": "notEquivalentTo", "target": "term:tool-manifest" }, { "verb": "requires", "inverse": "requiredBy", "target": "term:agent-identity" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00021", "slug": "decision-record", "preferredLabel": "Agent Decision Record", "abbreviation": "ADR", "url": "https://qistrust.com/canon/decision-record", "canonicalStatus": "QIS Canonical Extension", "adoptionStatus": "Experimental", "domain": "Auditability", "layer": "governance", "definition": "The structured record of a single consequential agent action, sufficient to reconstruct it: the authority under which it was taken, the agent and model state that took it, the evidence available at the time, the reasoning trace, the action committed, and the oversight conditions evaluated.", "editorialNote": "Reconstruction, not logging. Composes with what already exists rather than replacing it — the trace is OpenTelemetry, the order reference is FIX, the data lineage is OpenLineage. What is missing is the semantic layer binding them, which is the whole proposal.", "origin": "QIS Canonical Extension. Proposed to fill the gap between an execution record, which FIX already carries, and a decision record, which nothing carries.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Audit Trail", "reason": "A trail establishes sequence. A decision record establishes sufficiency — that everything needed to re-derive the decision was captured." }, { "label": "Observability trace", "reason": "A trace records the call chain. It does not record model version, memory state, or the authority in force." } ], "relationships": [ { "verb": "addresses", "inverse": "addressedBy", "target": "marque:auditability" }, { "verb": "consumes", "inverse": "consumedBy", "target": "term:audit-trail" }, { "verb": "requires", "inverse": "requiredBy", "target": "term:authority-grant" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:opentelemetry" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00022", "slug": "authority-envelope", "preferredLabel": "Authority Envelope", "abbreviation": null, "url": "https://qistrust.com/canon/authority-envelope", "canonicalStatus": "QIS Canonical Extension", "adoptionStatus": "Experimental", "domain": "Authority", "layer": "governance", "definition": "The machine-enforceable expression of an authority grant — the runtime boundary beyond which an agent halts or escalates rather than proceeds.", "editorialNote": "A grant stated in a policy document is a preference. An envelope is the same grant expressed where it can actually stop execution. The distinction matters because every published framework requires bounded autonomy and none specifies where the bound lives.", "origin": "QIS Canonical Extension. Names the enforced boundary that IMDA's framework and the FS AI RMF both require in prose without giving it a term.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Authority Grant", "reason": "The grant is the instrument. The envelope is its enforcement. A grant with no envelope is unenforced by definition." } ], "relationships": [ { "verb": "implements", "inverse": "implementedBy", "target": "term:authority-grant" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" }, { "verb": "escalatesTo", "inverse": "escalatedFrom", "target": "term:human-override" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00023", "slug": "decentralized-identifier", "preferredLabel": "Decentralized Identifier", "abbreviation": "DID", "url": "https://qistrust.com/canon/decentralized-identifier", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Draft standard", "domain": "Identity & discovery", "layer": "governance", "definition": "A URI that resolves to a document containing public keys, authentication methods and service endpoints, controlled by its subject rather than issued by a central registry, and designed to be verifiable and persistent across the platforms the subject uses.", "editorialNote": "The most mature published answer to the narrow part of agent identity: giving a non-human actor a durable, cryptographically verifiable identifier that survives the platform it was created on. It answers who, and only who. An identifier that carries no authority is still the prerequisite for granting any — you cannot issue a permission to something you cannot name.", "origin": "W3C Recommendation (DID Core). Adopted by several proposed agent networking protocols as the identity primitive.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Agent Identity", "reason": "A DID is a technical identifier. Agent identity is the broader property that includes a recorded authority grant and an attributable action history. The DID is one component." }, { "label": "Authority Grant", "reason": "The DID says who. The grant says what they may commit. Conflating them is the same category error as reading a tool manifest as a permission." }, { "label": "Service Account", "reason": "A service account is issued by a platform and dies with it. A DID is controlled by its subject and is portable." } ], "relationships": [ { "verb": "requiredBy", "inverse": "requires", "target": "term:agent-identity" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:identity" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:w3c-did" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } }, { "canonicalId": "QIS-TERM-00024", "slug": "consent-grant", "preferredLabel": "Consent Grant", "abbreviation": null, "url": "https://qistrust.com/canon/consent-grant", "canonicalStatus": "Canonical industry term", "adoptionStatus": "Widely used", "domain": "Authority", "layer": "governance", "definition": "A permission issued by a principal to a named third party to access specified data, for a specified purpose, for a specified duration, revocable at any time by the principal and enforced at the interface.", "editorialNote": "The most useful precedent in agentic governance, and almost nobody in the field cites it. Scoped, time-bounded, revocable, granted to a named party and enforced at the API — open banking has been running bounded delegated authority at national scale for years while agent governance treats the problem as unprecedented. It is not unprecedented. It is solved for data access, and the pattern transfers to action with one change: the object of the grant.", "origin": "Open banking. Formalized in the FDX API standard in North America and in equivalent open banking regimes elsewhere.", "semanticAliases": [], "notEquivalentTo": [ { "label": "Authority Grant", "reason": "Consent governs what a party may SEE. An authority grant governs what it may COMMIT. Everything else about the two structures is close enough to borrow from." }, { "label": "Terms of Service", "reason": "Consent is specific, scoped and revocable per relationship. Terms of service are blanket and non-negotiable." } ], "relationships": [ { "verb": "relatedTo", "inverse": "relatedTo", "target": "term:authority-grant" }, { "verb": "addresses", "inverse": "addressedBy", "target": "marque:authority" }, { "verb": "dependsOn", "inverse": "supports", "target": "std:fdx" }, { "verb": "constrains", "inverse": "constrainedBy", "target": "term:agent-identity" } ], "provenance": { "firstPublished": "2026-08-02", "lastReviewed": "2026-08-02", "editor": "QIS Editorial", "reviewCycleDays": 180 } } ] }