A Working Vocabulary for AI Agents and Runtime Governance

A broad term for AI systems designed to pursue goals with some autonomy: planning, choosing actions, using tools and adjusting to results, rather than producing a single response to a single prompt. It names the approach, while an AI agent is a specific system built that way.

A process in which some or all steps are carried out by AI agents, with the model deciding at least part of the sequence at run time rather than following a fixed script. The degree of model control ranges from one decision point inside a scripted pipeline to a fully open-ended loop.

An AI system that pursues a goal by selecting and carrying out actions, often through tools and over multiple steps. Unlike a system limited to producing responses, an agent can interact with software or external systems as part of its work.

An AI agent that works inside a software project: it reads and edits files, runs commands and tests, and uses the results to continue. Because it acts through a shell and the filesystem, its actions can have effects well beyond the code it was asked to change.

An agent that works on a task over an extended period, across many steps and sometimes multiple sessions. It may use notes, memory or checkpoints to preserve working state, making continuity of purpose and scope important throughout execution.

A system in which several agents, each with its own role, instructions or tools, work on a task by delegating, exchanging results or acting in parallel. It raises questions a single agent does not, such as which agent acted, under whose authority and with what shared state.

The architecture proposed in the Sentience Governor white paper, in which governance is a continuous control loop that jointly manages an agent's scope, its memory, and the identities and policies that constrain both. It describes an architecture and a direction, not the current capabilities of Sentience Governor.

A single operation an agent attempts at the execution boundary, recorded as structured metadata: the tool used, the type of operation (read, write, delete or execute) and the system it targets. The record describes the attempt, not the content of prompts or completions.

The software wrapped around a language model that turns it into a working agent: it assembles the context, runs the loop, dispatches tool calls, applies permissions and handles results. Two agents using the same model can behave very differently because their harnesses differ.

The repeating cycle at the center of an agent: the model reads the current context, chooses an action, the action runs, and the result is added to the context for the next turn. The loop ends when the model decides the task is complete or an external limit stops it.

The execution environment that hosts an agent while it works: the processes, tools, credentials, state and resource limits available to it. It determines what the agent's actions can actually reach.

The point at which an agent's decision is about to become an operation on a real system: a tool call, a file write, a shell command, a write to persistent memory. It is where an attempted action can be captured and evaluated, whether or not the operation then succeeds.

A model capability in which the developer describes functions with typed parameters, and the model returns a function name and structured arguments instead of prose. The application, not the model, executes the function, and the term is often used interchangeably with tool calling, which is the broader concept.

Describing the potential effects of a shell command by its domain, action and destructive character, rather than recording only that a command was run. Sentience Governor currently applies deterministic classification to Claude Code shell commands and records unknown or incomplete classifications rather than assuming an effect it cannot establish.

The mechanism by which a language model requests an external function, API or command through a structured interface, with the surrounding application responsible for invoking it and returning the result. A tool call represents a requested operation, not proof that the operation succeeded.

Governance applied to AI systems that act: deciding what agents may do and under whose authority, evaluating what they actually do, and keeping evidence of both. It extends AI governance from models and their outputs to actions and their effects.

The policies, roles, processes and controls used to direct and oversee the development, deployment and operation of AI systems. It addresses accountability, risk, compliance and oversight across the AI lifecycle, from organizational decisions to the behavior of individual systems.

A statement, made before an agent acts, of the objective it is working toward and the scope within which it will pursue it. In Sentience Governor it is written to the record as its own event and applies only to the activity that follows it.

The set of operation targets, such as the filesystem, a shell or the web, that are stated as within an agent's task boundaries. Each attempted action's target is compared against that set, and a mismatch is recorded.

An operator-defined configuration that establishes the expectations, boundaries, and oversight requirements against which an AI agent's execution is evaluated. It helps determine what behavior deserves attention, which operations carry greater consequence, and how governance findings should be recorded or acted upon.

A design in which a person participates in an AI system's decision or execution process by reviewing, approving, correcting or providing input at a defined stage. Human involvement may occur before consequential actions, during execution or when reviewing results, depending on the system's purpose and risk.

An approach in which agent actions are evaluated, and the resulting record is kept by default, on the operator's own machine, with no account, service or network connection required. It describes where governance runs, not what the agent itself connects to.

The practice of writing policies in a machine-readable form that is version-controlled, tested and evaluated automatically, instead of keeping them only as documents. It makes a policy's application repeatable and its changes reviewable.

Policy resolution is the process of determining which governance policies apply to an AI agent or execution context. It establishes how policies are selected, combined, or prioritized, and provides the basis for evaluating agent behavior against the appropriate expectations and boundaries.

The evaluation of an AI agent's actions against its declared intent, scope and policy while the agent is executing, with the results recorded as evidence. Sentience Governor implements it as observation and recording: actions are evaluated and flagged, and execution is not interrupted.

The divergence of an agent's behavior from its declared objective or scope over the course of execution, distinct from model drift and data drift. Sentience Governor records signals relevant to such divergence, including scope mismatches, unexpected operations and policy violations, but does not provide a single comprehensive drift measurement.

Measuring how well an agent performs against defined tasks or criteria, either offline on test sets or online by scoring real runs. Because agents take many steps, an evaluation can assess the final result, the path taken, or both.

The ability to inspect and understand an agent's execution through recorded data such as traces, tool calls, inputs, outputs, timing and errors. It provides visibility into what occurred and the surrounding execution context, while judging an action's appropriateness requires criteria against which to evaluate it.

Recording an agent run as a structured sequence of steps, typically nested spans covering model calls, tool calls and their timing. A trace shows the path an agent took through a task.

The ongoing observation of agents in operation against expected behavior, using measures such as error rates, latency, cost and task outcomes, usually with alerts when they move out of range. It tells operators that something has changed, while diagnosing why usually falls to tracing and observability.

A chronological record of an AI system's actions and decisions, maintained so that its behavior can be reviewed and attributed later. Its evidentiary value depends on the coverage, integrity and provenance of the recorded events.

A flag identifies a condition or behavior that warrants attention during an AI agent's execution, while a policy violation indicates that an action meets the conditions of a rule defining prohibited or noncompliant behavior. The distinction separates observations about agent behavior from judgments against applicable policy, without necessarily determining what response should follow.

The recorded account of what an agent declared, what it attempted, which policy applied and what the evaluation concluded, including what could not be determined. Its value lies in gaps and unknowns being recorded explicitly rather than left out.

The local, append-only stream of structured events that Sentience Governor writes for each governed agent session. It uses one schema across every supported integration and stays on the operator's machine by default.

The rules and mechanisms that determine what an identified agent may access or do, such as scoped credentials, delegated authority and least-privilege access. Authorization establishes what an agent is allowed to do, and does not by itself establish whether a permitted action serves the task it was given.

An identity associated with an AI agent so that it can be distinguished from other agents, users and services, and its actions can be attributed to it. Where the identity is verifiable, it also supports authentication and authorization decisions.

An isolated execution environment that restricts the files, network resources, processes or credentials an agent's code and tools can access. It limits the reach of an agent's actions according to its configured isolation boundaries, but does not by itself determine whether a permitted action serves the intended task.

The protection of agents, and of the systems they can reach, against misuse and attack, including prompt injection, credential and tool abuse, data exfiltration and excessive privileges. It treats the agent both as something to defend and as a potential path to everything it has access to.

Controls placed around an AI system to constrain or check its inputs, outputs or actions, such as content filters, schema validation, allow-lists and rule-based checks. They apply limits that someone defined in advance, and sit at different points depending on the product: before the model, after it, or around tool use.

A high-consequence operation is an agent action whose consequences, if mistaken, would be costly, difficult to reverse, or widely felt, and which therefore warrants more scrutiny than routine actions. Which operations qualify is a judgment about the action in its context, typically made by the operator responsible for the environment.

An attack in which an adversary uses crafted input to redirect an AI system away from its intended instructions or task. It may arrive directly through a user prompt or indirectly through material such as documents, web pages and tool results, potentially causing an agent to take unintended actions.

The mechanisms that let an agent retain and retrieve information beyond the context immediately available to the model, using resources such as notes, files, databases or vector stores. Depending on the design, this information may persist across steps, tasks or sessions and influence later behavior.

The total expense of operating an AI agent, including model usage, tool execution, infrastructure and retries. Unlike the cost of a single model request, it depends on how many steps the agent takes, how much context each step consumes and which external resources it uses.

The portion of an agent's model usage cost attributable to supplying accumulated context, such as conversation history, instructions and tool results, across successive turns. Cached inputs may reduce the price of repeated context, but they do not eliminate its cost.

The maximum amount of context a language model can process in a single invocation, measured in tokens and subject to the model's input and output limits. An agent that accumulates more context than the model can accommodate must select, summarize or store material outside the active window.

The coordination of agents, tools and execution steps within a larger process, including routing work, ordering operations, managing state and handling handoffs. It defines how the parts of an agent system work together to complete a task.

An open protocol for communication and collaboration between independent AI agents, allowing them to discover capabilities, exchange messages, delegate tasks and receive results without requiring access to one another's internal state or tools.

A software library that provides the components for creating agents, such as model interfaces, tool definitions, the agent loop, memory and state handling. It shapes how an agent is built, while how the agent is hosted and run is the concern of the runtime.

A program that exposes tools, resources or prompts to AI applications over the Model Context Protocol, running either locally alongside the client or as a remote service. Each server extends what a connected agent is able to do.

An open standard for connecting AI applications to external systems through a common client-server interface. MCP servers can expose tools, resources and prompts, allowing compatible clients to discover and use those capabilities.