AI agent glossary

The terms that come up when AI agents get access to company data, tools and each other — from MCP and A2A to tool poisoning and chain tokens — each defined in a sentence or two, with a link to the answer that goes deeper.

A2A (Agent2Agent protocol): An open protocol for AI agents to discover each other and delegate tasks: one agent sends another a message, the other works on it as a task and returns the result.; MCP vs A2A →
Agent Card: The A2A description an agent publishes about itself: its name, skills, endpoint and how callers must authenticate. Callers read it to decide whether and how to delegate.; Securing agent-to-agent communication →
Agent loop: Agents calling each other, or the same tool, over and over without making progress. Stopped with limits on chain depth, repeated identical requests, fan-out, call count and cost.; Stop AI agent loops →
Agent mesh: A broker that every agent-to-agent and agent-to-tool call passes through, so one set of rules decides which agent may call which, what data may cross, and records every hop.; DBShifts Agent Mesh →
Agentic AI: AI systems that pursue a goal by taking actions — calling tools, reading data, delegating to other agents — rather than only answering one prompt.; AI agent security best practices →
AI agent gateway: A control point between AI agents and the data they read. Each agent gets a scoped token instead of credentials, and every request is checked against policy and recorded before data is returned.; What is an AI agent gateway? →
AI data governance: The rules, controls and records that decide which data AI systems may use, for what, and that prove afterwards what they actually used.; What is AI data governance? →
Audit trail (for AI agents): A record of every request an agent made — who, when, what was asked, what was returned or refused — kept so access can be reviewed and proven later.; Audit what data an AI agent accessed →
Chain token: A signed token passed along a chain of agent calls that names who started the chain and every agent since, so each hop can apply the original requester's permissions and the path cannot be forged.; Trace multi-agent workflows →
Data masking (for AI): Replacing sensitive values — emails, card numbers, ID numbers — with placeholders on the server, before the data reaches a model.; Stop AI agents seeing customer PII →
Default deny: A policy stance where nothing is allowed unless a rule allows it: an agent reaches a table, tool or other agent only by explicit permission.; Least-privilege permissions for AI agents →
DLP for AI: Keeping personal data, secrets and regulated fields out of model context, by minimising, masking and blocking them in the data path rather than detecting leaks afterwards.; Stop sensitive data leaking to LLMs →
Human-in-the-loop: A control where an agent proposes an action with consequences and a person approves or rejects it before it runs.; Human approval for AI agent actions →
Indirect prompt injection: Instructions planted in content an AI agent reads — a database row, a web page, a document, a tool result — that the model follows as if they came from the user.; Prompt injection hidden in database data →
Kill switch (AI agent): A control that stops one agent's access immediately, on its next request, without changing any other agent.; Stop a misbehaving AI agent →
Least privilege (for AI agents): Giving each agent only the tables, columns, tools and agents its task needs, and no more, so a mistake or an injected instruction can do little harm.; Least-privilege permissions for AI agents →
MCP (Model Context Protocol): An open standard for connecting AI applications to tools and data. An MCP client in the AI app talks to MCP servers, which expose tools, resources and prompts.; What is MCP? →
MCP client: The part of an AI application — Claude Desktop, an editor, an agent framework — that connects to MCP servers, lists their tools and calls them on the model's behalf.; Connect Claude Desktop to a database over MCP →
MCP gateway: A proxy between AI agents and MCP servers that decides which tools each agent may call with which arguments, scans descriptions and results, and records every call.; What is an MCP gateway? →
MCP server: A program that exposes tools, resources and prompts over the Model Context Protocol, so any MCP-capable AI application can discover and use them.; Is an MCP server safe for your database? →
MCP tool: An action an MCP server offers, described by a name, a description the model reads, and a schema for its arguments. The model decides when to call it.; Control which MCP tools an agent can call →
OAuth for MCP: The way remote MCP servers authorize clients: OAuth 2.1 with PKCE, so a person signs in from their MCP client and the server knows who each request is for.; MCP authentication: OAuth for AI agents →
Prompt injection: Text that tries to override an AI model's instructions. Direct injection comes from the user; indirect injection is planted in content the model reads.; Prompt injection hidden in database data →
RAG (retrieval-augmented generation): Answering a question by first retrieving relevant documents or rows and giving them to the model, instead of relying only on what the model learned in training.; RAG vs direct database access →
Rug pull (MCP): An MCP tool whose description changes after it was reviewed and approved, so it starts instructing the model differently without anyone re-approving it.; MCP tool poisoning →
Scoped token: A credential issued to one agent that allows only specific actions on specific data, and can be revoked without affecting anyone else.; Give AI agents database access safely →
Text-to-SQL: Turning a plain-English question into a SQL query with a language model. Safe on production only when the generated query runs under strict limits and permissions.; Is text-to-SQL safe on production data? →
Tool poisoning: Hiding instructions for the model in a tool's description or metadata, so the model leaks data or misuses tools when it reads the tool list.; MCP tool poisoning →
Zero trust for AI agents: Treating no agent as trusted because of where it runs: every request is authorized on its own, by default deny, with short-lived tokens and everything the agent reads treated as hostile.; Zero trust for AI agents →

Govern your agents, their tools and their data

An AI agent gateway for databases and an agent mesh for A2A and MCP calls.

See Agent Gateway See Agent Mesh