Thirty-three agent governance terms, defined plainly.

Terms

Thirty-three definitions, each written to stand alone if quoted. Where a term has a contested meaning we say so rather than picking the flattering one.

Agent trust layer

A control plane between an AI agent's decision and its effect. It authorizes the action before execution using identity, policy and approval, then emits evidence proving what occurred. Distinct from observability, which only describes what already happened.

Agent Passport

An agent's identity record: cryptographic identity, human accountable owner, mission, permitted tools, autonomy level and lifecycle state. An agent without one is an action you cannot attribute.

Execution receipt

A signed, hash-chained record of one agent action containing the identity, policy version, approval, payload hash, execution details and outcome. Editing it breaks chain verification.

Assurance Gateway

The deny-by-default checkpoint an action must pass before it executes — scope, tool permission, autonomy budget, suppression, rate limit, and human approval where required.

Autonomy Budget

Hard ceilings on what an agent may do without further authorization: actions per period, rate, and spend. It refuses at the limit rather than slowing down.

Flight Recorder

The replayable record of an agent's prompts, decisions, tool calls, approvals and outcomes, used to reconstruct an incident after the fact.

Payload-bound approval

An approval tied to the hash of one exact payload, usable once, with an expiry. Changing the payload or missing the window invalidates it — so approving one action never silently approves the next.

Policy gate

A deterministic check evaluated before execution that returns allow, deny, or requires-human-approval. Deterministic matters: the same inputs must always produce the same decision.

Deny by default

Any action not explicitly permitted is refused. The opposite — permitting anything not explicitly forbidden — cannot be secured for agents that generate their own plans.

Fail closed

When a control cannot evaluate, the action is refused rather than allowed. A governance component that fails open is decorative.

Autonomy level

How much an agent may do without a human: human-led (a person acts), human-assisted (the agent proposes, a person approves), or fully autonomous within a bounded budget.

Kill switch

A mechanism that halts one agent or all agents immediately. Its only meaningful specification is how fast it takes effect and whether it has been tested live.

Revocation

Withdrawing an agent's credentials or grants so it can no longer act, independently of whether its process is still running.

Replay

Reconstructing an agent's action sequence from receipts to answer what it believed, what it proposed, what was allowed, and what landed.

Idempotency key

A token ensuring the same logical action executes at most once, even if retried. Without it, a retry is a duplicate send.

Circuit breaker

A control that halts a class of actions after a failure threshold, preventing one fault from cascading across many agents.

Separation of duties

No single role both recommends and executes, or both executes and certifies. The role that scores an outcome cannot be the role that produced it.

Non-human identity

Credentials belonging to software rather than people — service accounts, workload identities, agents. They typically outnumber human identities by a wide margin and are governed far less.

Shadow agent

An agent running in an environment without being inventoried, owned or governed. Discovery is usually the first real finding of any agent trust assessment.

Agent sprawl

Uncontrolled growth in the number of agents and their permissions, usually outpacing the ability to attribute actions to owners.

MCP (Model Context Protocol)

The protocol through which agents reach external tools and data. Its 2026-07-28 specification hardened authorization onto OAuth 2.1 and added Enterprise-Managed Authorization, with a twelve-month deprecation window for older versions.

Tool exposure assessment

An inventory of every tool an agent can invoke, what each can reach, and whether the permission is scoped to the mission that needs it.

Confused deputy

When a component with broad permissions is tricked into acting for a caller with narrower ones. A recurring hazard wherever agents proxy tool access.

Prompt injection

Instructions smuggled into content an agent reads, intended to redirect its behaviour. Indirect injection arrives via retrieved documents, pages or tool output rather than the user.

Memory poisoning

Corrupting an agent's persistent memory or retrieved context so future decisions are influenced by planted material. OWASP ASI06.

Rogue agent

An agent operating outside intended scope, whether through compromise, misconfiguration or goal drift. OWASP ASI10.

Agent wallet

A payment capability held by an agent. Governance requires spend ceilings, merchant scoping, a payment kill switch, and evidence of authorization for each transaction.

AP2

The Agent Payments Protocol, donated by Google to the FIDO Alliance in April 2026. Uses verifiable credentials and cryptographic mandates to prove a human authorized a specific spend.

x402

An HTTP-native payment standard letting agents settle payments without a human in the loop, governed through the x402 Foundation. Its convenience is precisely why spend controls matter.

Evidence pack

An assembled set of receipts, approvals, policy versions and control mappings prepared for an audit, a customer review or a regulator.

Claims ledger

A published record of every public claim an organisation makes, with its basis, verification date and expiry. A claim past its expiry shows as stale rather than silently persisting.

Basis label

An explicit marker on a number stating what it rests on — learned, prior, pooled, synthetic, or insufficient data. Unlabelled numbers invite the reader to assume the strongest interpretation.

Independent verification

Confirmation of a control by something other than the system being assessed. Self-certification is not verification, however sincere.

Definitions maintained by ApexClaw, last verified 2026-08-06. Where a term originates in a published framework — OWASP ASI codes, MCP specification versions, AP2 — the framework's own definition governs; see the standards crosswalk.

Common questions