Everyone is using the same words. Nobody means the same thing.
Agent-to-agent vocabulary is roughly where cloud computing was in 2008. Four major vendors, two protocol ecosystems, a Treasury-convened lexicon and a steady supply of academic papers all use overlapping terms with incompatible meanings, and there is no canonical dictionary. This is that dictionary — with one field nobody else publishes.
Every glossary defines terms positively. This one also defines them negatively.
Positive definition tells you what a word means. It does not tell you which adjacent word you have confused it with, and confusion between adjacent terms is the actual failure mode in a young vocabulary.
An Agent Card, a Model Card, a System Prompt and a Tool Manifest are four different artifacts with four different lifecycles, and they are used interchangeably every day. That is not a pedantic complaint — it has governance consequences:
A tool manifest declares what an agent can reach. An authority grant declares what it may commit, under whose authority, and up to what limit. Reading the first as the second is the most likely agentic governance error of the next two years, and it happens because the vocabulary permits it.
So every entry here carries a notEquivalentTo field, with the reason. There are 37 of them.
Two tiers, and we never blur them.
- Canonical industry term — the term exists in the wild. We document it and cite its origin. We do not get to define these; we get to describe them accurately, and if we have described one badly we would like to know.
- QIS Canonical Extension — a proposal from us, filling a gap we have documented elsewhere in the standards register or the control-objective crosswalk. Labeled as ours on every page, without exception.
There are only 3 extensions, deliberately. Proposing a term is legitimate; presenting a proposal as settled usage is not, and inventing vocabulary because it sounds impressive is how an ontology loses the credibility it exists to accumulate.
Identity & discovery
A machine-readable document published by an agent that advertises what it is and what it can do — identity, declared capabilities, and the endpoints through which another agent may interact with it.
The property that a specific agent is distinguishable as a durable, named actor — with an identifier that persists across sessions, a recorded authority grant, and an action history attributable to it alone.
A catalog of known agents, their identities, declared capabilities, and endpoints, maintained so that agents and operators can discover one another without prior configuration.
The line across which assumptions about trustworthiness change, and at which input must therefore be validated and authority re-established.
A URI that resolves to a document containing public keys, authentication methods and service endpoints, controlled by its subject rather than issued by a central registry, and designed to be verifiable and persistent across the platforms the subject uses.
Capability
The process by which one agent learns what another agent or service is able to do, without that knowledge having been configured in advance.
The declared set of tools, resources and prompts an MCP server exposes to a client — the machine-readable statement of what an agent is able to reach.
A single call by an agent to a declared tool, with structured arguments and a structured result.
The transfer of responsibility for achieving an outcome from one agent to another, where the receiving agent determines how the outcome is reached.
Context & memory
The bounded span of tokens a model can attend to in a single inference, containing the prompt, retrieved material, and conversation so far.
The persistence layer through which an agent carries state across invocations — prior decisions, retrieved documents, learned preferences — distinct from both the model weights and the context window.
The passing of task-relevant state between agents so that a receiving agent can act without re-deriving what the sending agent already established.
An attack exploiting how an application combines untrusted input with a prompt written by a higher-trust party, causing the system to follow the untrusted instructions.
Oversight
A risk-control approach in which a human is integrated within an AI system's decision-making process.
The exercised ability of a human to ignore, alter, reject or reverse a system output or action.
Layered safeguards — policies, technical controls and monitoring — applied at the data, model, application and infrastructure levels to keep a system operating within organizational or regulatory boundaries.
The sequenced, tamper-evident record of what occurred, sufficient to establish the order and content of events after the fact.
Protocol
An open protocol connecting AI systems to external data sources and tools through a client-server interface, in which a server exposes a declared set of resources, tools and prompts to a host application's client.
A protocol for interoperability between autonomous agents built by different vendors on different frameworks — capability discovery, task delegation, and structured message exchange across organizational boundaries.
The coordination of multiple agents or steps toward an outcome, including sequencing, branching, retry, and the handling of partial failure.
Auditability
The structured record of a single consequential agent action, sufficient to reconstruct it: the authority under which it was taken, the agent and model state that took it, the evidence available at the time, the reasoning trace, the action committed, and the oversight conditions evaluated.
Built to be traversed, not just read.
Each entry is an entity with a stable identifier, an adoption status, semantic aliases, typed relationships and its own provenance block. Identifiers do not change; URLs may. Cite the identifier.
The relationships carry verbs — governedBy, implements, constrains, delegatesTo, notEquivalentTo — which is what turns a glossary into something queryable. "Show me every term that constrains an agent's authority" is a traversal, not a search.
Free to read, cite and index under the dual license. If a definition here is wrong, or an origin is misattributed, tell us — corrections are published with attribution, and a lexicon nobody corrects is a lexicon nobody uses.