Glossary
AI and software, explained.
57 terms in plain language, with links to our in-depth guides.
- A2A (Agent2Agent)
- An open protocol that lets independent AI agents discover each other, exchange messages and hand off tasks. See A2A vs. MCP.
- Agentic AI
- AI systems that pursue a goal by planning steps, using tools and acting with limited supervision, rather than only answering questions.
- AI agent
- A software system that uses a language model to decide what to do, call tools and complete multi-step tasks. See AI agents vs. chatbots.
- AI governance
- The policies, roles and checks that control how an organisation chooses, uses and monitors AI tools and data. See our starter policy.
- API
- Application programming interface: a defined way for one piece of software to request data or actions from another.
- Audit log
- A tamper-resistant record of who did what and when in a system, used for investigation and compliance.
- CI/CD
- Continuous integration and continuous delivery: automated building, testing and releasing of software.
- CMS
- Content management system: software that lets non-developers create and edit website content. WordPress is a well-known example.
- Context engineering
- Designing what information an AI model sees at each step, including instructions, retrieved documents, tool results and memory. See our guide.
- Context window
- The amount of text a language model can consider at once, measured in tokens.
- Core Web Vitals
- Google's measures of page experience: loading (LCP), interactivity (INP) and visual stability (CLS). See our checklist.
- CRM
- Customer relationship management: software for tracking leads, customers and deals.
- Dependency
- A package, library or service your software relies on. Dependencies are part of your supply chain.
- DevOps
- Practices that combine development and operations so software is built, released and run reliably.
- Embedding
- A list of numbers that represents the meaning of text, used to find similar content in search and retrieval.
- Evals
- Evaluations: repeatable tests that measure the quality of an AI system on realistic cases. See how to evaluate agents.
- Fine-tuning
- Further training a model on your own examples to change how it behaves, often for tone, format or a narrow task.
- Function calling
- A feature that lets a model request that your code runs a defined function with specific arguments. Also called tool use.
- GEO (generative engine optimization)
- Making your content easy for AI search tools to find, understand and cite. See our GEO guide.
- GraphQL
- An API style where the client describes exactly which data it wants in a single query.
- Guardrails
- Controls that limit what an AI system may do, such as permissions, approvals, spend limits and output checks. See AI agent guardrails.
- Hallucination
- When a language model produces fluent but false or unsupported information.
- Headless CMS
- A content system that stores content and delivers it by API to any front end. See headless vs. WordPress.
- INP (Interaction to Next Paint)
- A Core Web Vital that measures how quickly a page responds to user input.
- Least privilege
- A security principle: give people and systems only the access they need, for only as long as they need it.
- LLM (large language model)
- An AI model trained on large amounts of text that can understand and generate language.
- MCP (Model Context Protocol)
- An open standard for connecting AI applications to tools and data. See what is MCP.
- Multi-agent system
- A design where several specialised AI agents, often coordinated by an orchestrator, work together on a task. See our guide.
- Multi-factor authentication (MFA)
- Signing in with more than one proof of identity, such as a password and a code or security key.
- MVP (minimum viable product)
- The smallest version of a product that delivers real value and teaches you something. See our 8-week MVP plan.
- n8n
- An open workflow automation platform that can be self-hosted and extended with code. See Zapier vs. Make vs. n8n.
- OAuth
- A standard that lets an app access your data in another service without being given your password.
- Observability
- The ability to understand what a system is doing from its logs, metrics and traces. See agent observability.
- Passkey
- A phishing-resistant sign-in credential stored on a device or in a password manager. See our passkeys guide.
- Post-quantum cryptography
- Encryption designed to resist attacks from future quantum computers. See our guide.
- Prompt engineering
- Writing instructions to a language model so that it produces the result you want.
- Prompt injection
- An attack where text in a document, email or web page tries to give the AI new instructions.
- PWA (progressive web app)
- A website that can be installed on a device and work offline. See mobile app options.
- RAG (retrieval-augmented generation)
- A technique that retrieves relevant passages from your documents and gives them to a model so its answers are grounded. See what is RAG.
- Ransomware
- Malicious software that encrypts or steals data and demands payment. See our readiness checklist.
- Rate limiting
- Restricting how many requests a user or system can make in a given time.
- REST
- A common API style that uses standard web methods on resources identified by URLs.
- SaaS (software as a service)
- Software delivered online by subscription instead of installed on your own machines.
- Serverless
- A way of running code where the cloud provider manages the servers and you pay for usage.
- Single sign-on (SSO)
- Using one login to access several applications, managed in one place.
- Small language model (SLM)
- A language model with far fewer parameters than the largest systems, cheaper and faster for focused tasks. See our guide.
- Staging environment
- A copy of your production system used to test changes safely before release.
- Strangler fig pattern
- A modernisation approach that replaces a legacy system piece by piece while it keeps running. See the guide.
- Structured output
- Model output that follows a defined format, such as JSON, so software can rely on it. See our guide.
- Supply chain attack
- An attack that compromises something you depend on, such as a package, tool or vendor, to reach you.
- Technical debt
- The future cost created by shortcuts and ageing code. See how to pay it down.
- Token
- A small chunk of text, such as a word or part of a word, that language models read and write. Usage is often priced per token.
- Vector database
- A database that stores embeddings and finds the most similar items quickly. See vector database vs. pgvector.
- WCAG
- Web Content Accessibility Guidelines: the standard for making websites usable by people with disabilities. See our checklist.
- Webhook
- A message one system sends to another automatically when an event happens, such as a new order.
- Workflow automation
- Software that carries out multi-step business processes automatically, moving data between tools. See our service.
- Zero trust
- A security model that verifies every request instead of trusting anything by default. See our starter guide.
A
C
D
E
F
G
H
I
L
M
N
O
P
R
S
T
V
W
Z
Keep learning