--- title: "Words used in the playbooks ยท Agent Wranglers" url: https://agentwranglers.se/playbook/glossary updated: 2026-10-21 licence: "All rights reserved" --- # Words used in the playbooks Short definitions of the terms the playbooks use. Each playbook links to its rules, and this page explains the words. - **Lab**: a test in a controlled browser, not with visitors. - **Round trip**: the time for a message to reach the server and come back. It is about 100 ms between the US and Europe. - **Network floor**: the fastest a page can arrive at a given distance. With TLS 1.3, connection, encryption and the page itself take 3 round trips. TLS 1.2 adds one more. - **LCP and FCP**: Largest and First Contentful Paint. They mark when the main content and the first content appear. Defined in the W3C [Largest Contentful Paint](https://www.w3.org/TR/largest-contentful-paint/) and [Paint Timing](https://www.w3.org/TR/paint-timing/) specifications. - **CLS**: Cumulative Layout Shift, or how much the page jumps while it loads. - **TBT and INP**: Total Blocking Time and Interaction to Next Paint. They measure how long the page ignores input. INP is built on the W3C [Event Timing API](https://www.w3.org/TR/event-timing/). - **CI**: continuous integration. A service that runs the checks on a clean machine for every change. - **Linter**: a tool that reads code and flags rule breaks, such as ESLint, Pylint or PHPMD. - **Type checker**: a tool that proves values have the types the code expects, such as TypeScript, mypy or PHPStan. - **Lock file**: a file that pins the exact version of every dependency, so every install is the same. - **Feature flag**: a setting that turns a feature on or off without a new deploy. - **DTO**: data transfer object. A small typed object that carries named fields between parts of the code. - **SOLID**: five design principles for code that is easy to change. They are single responsibility, open-closed, Liskov substitution, interface segregation and dependency inversion. - **DRY**: don't repeat yourself. Each piece of knowledge lives in one place. - **CSP**: Content Security Policy. A header that tells browsers which scripts, styles and images a page may load. Defined in [W3C CSP Level 3](https://www.w3.org/TR/CSP3/). - **JSON-LD**: structured data in a page that tells search engines and agents what the page is about. Defined in [W3C JSON-LD 1.1](https://www.w3.org/TR/json-ld11/). - **MCP**: Model Context Protocol. A standard way for AI assistants to call tools on a server. Defined in the [MCP specification](https://modelcontextprotocol.io/specification/latest). - **OWASP**: an open project that publishes lists of the most common security risks. Its best-known list is the [OWASP Top 10](https://owasp.org/www-project-top-ten/). - **Prompt injection**: hidden instructions in text an AI model reads, written to make it disobey its owner. It is first in the [OWASP Top 10 for LLM applications](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). - **TLS**: the encryption behind HTTPS. Version 1.3 is defined in [RFC 9846](https://www.rfc-editor.org/rfc/rfc9846). - **HSTS**: HTTP Strict Transport Security. A header that tells browsers to use HTTPS only. Defined in [RFC 6797](https://www.rfc-editor.org/rfc/rfc6797). - **CORS**: Cross-Origin Resource Sharing. Headers that decide which other sites may read your responses. Defined in the [WHATWG Fetch standard](https://fetch.spec.whatwg.org/#http-cors-protocol). - **SRI**: Subresource Integrity. A hash on a script tag, so the browser refuses a changed file. Defined in [W3C Subresource Integrity](https://www.w3.org/TR/SRI/). - **CDN**: content delivery network. Servers around the world that keep copies of your files close to visitors. - **DNS and DNSSEC**: DNS turns a domain name into a server address. DNSSEC signs those answers so they cannot be faked. Defined in [RFC 1035](https://www.rfc-editor.org/rfc/rfc1035) and [RFC 4033](https://www.rfc-editor.org/rfc/rfc4033). - **CAA**: a DNS record that lists which authorities may issue certificates for your domain. Defined in [RFC 8659](https://www.rfc-editor.org/rfc/rfc8659). - **WCAG**: Web Content Accessibility Guidelines, the standard for accessible websites. Published by the W3C as [WCAG 2.2](https://www.w3.org/TR/WCAG22/). - **ARIA**: attributes that tell assistive technology what an element is when HTML alone cannot. Defined in [W3C WAI-ARIA 1.2](https://www.w3.org/TR/wai-aria-1.2/). - **OAuth**: a standard way to let an app or agent act for a user with a limited token instead of a password. Defined in [RFC 6749](https://www.rfc-editor.org/rfc/rfc6749), with current security advice in [RFC 9700](https://www.rfc-editor.org/rfc/rfc9700). - **JWT**: JSON Web Token. A signed token that carries claims, such as who the user is. Defined in [RFC 7519](https://www.rfc-editor.org/rfc/rfc7519). - **CVSS**: a scoring system from 0 to 10 for how severe a security hole is. Published by [FIRST](https://www.first.org/cvss/). - **SSRF**: server-side request forgery. Tricking a server into fetching an address the attacker picks. See the [OWASP SSRF prevention cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html). - **A2A**: Agent2Agent. A protocol that lets AI agents describe themselves and send each other tasks. - **YAGNI**: you aren't gonna need it. Build only what is needed now. - **Law of Demeter**: a function talks only to its direct neighbours, never through a chain of other objects. - **Staging**: a copy of production with test data, used to try changes first. - **Migration**: a versioned script that changes the database structure. - **Rollback**: putting the previous release back when a new one fails. - **Branch**: a separate line of work in version control. - **Diff**: the lines a change adds and removes. - **Pull request**: a request to merge a branch after review and checks. - **Build gate**: a check in the build that stops it when a rule breaks. - **Health check**: an address that answers whether the service and what it depends on work. - **Sandbox**: a closed space, such as a container, where code or an agent runs without reaching anything else. - **Hook**: a script an AI agent's tool runs before or after an action, which can block it. - **Idempotency key**: a unique value sent with a request, so a retry never does the work twice. Described in an [IETF draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-idempotency-key-header/). - **Webhook**: a request one system sends to another when something happens. - **OpenAPI**: a standard file that describes an API's addresses, inputs and outputs. Defined in the [OpenAPI Specification](https://spec.openapis.org/oas/latest.html). - **ETag**: a version label on a response, used to skip unchanged downloads and to stop lost updates. Defined in [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#field.etag). - **Cursor pagination**: paging through a list with a pointer to the last item seen, instead of a page number. - **SLI**: a measure of what users get, such as the share of fast, successful requests. - **SLO**: the target for an SLI over a period. - **Error budget**: how much failure the SLO still allows. - **RPO and RTO**: how much data you may lose, and how long a restore may take. - **Runbook**: written steps for handling one alert or task. - **On-call**: the person who answers alerts at a given time. - **Postmortem**: a written review after an incident, focused on causes and fixes, not blame. - **Smoke test**: a few fast, read-only tests run against the live address right after a deploy. - **Burn rate**: how fast the error budget is being used, compared with the pace that would use it up exactly on time. - **Load shedding**: refusing extra requests quickly, so the ones already accepted still finish. - **Release cooldown**: waiting some days before installing a new version of a dependency, so a hijacked one is found first. - **PKCE**: Proof Key for Code Exchange. A one-time secret that ties an OAuth login's start to its end. Defined in [RFC 7636](https://www.rfc-editor.org/rfc/rfc7636). - **Pseudo-localisation**: a test language that makes text longer and accented, to find text that cannot be translated. - **Value object**: a small type for one domain value, such as an email address or an amount of money, that checks itself. - **End-to-end test**: a test that drives the whole app the way a person does. - **Contract test**: a test that checks two services still agree on the shape of their messages. - **Test double**: a stand-in for a dependency in a test, such as a fake or a mock. - **Flaky test**: a test that passes or fails without any change to the code. - **Mutation testing**: changing the code on purpose to see whether the tests notice. - **Instructions file**: a file such as AGENTS.md or CLAUDE.md that tells coding agents how to work in a repository. - **Context window**: the amount of text an AI model can read at once. - **Lethal trifecta**: an agent with private data, untrusted content and a way to send data out, which attackers can combine. - **Slopsquatting**: attackers publishing packages under names that AI models invent. - **AI app builder**: a tool such as Lovable, Bolt or Replit that builds an app from a description. - **Least privilege**: giving each person, key or service only the access it needs. - **Allow list**: a list of the only values that are accepted, with everything else refused. - **Passkey**: a sign-in key stored on a device, which replaces a password and cannot be phished. Passkeys are built on [W3C Web Authentication](https://www.w3.org/TR/webauthn-3/). - **Tenant**: one customer's account and data in a system that serves many customers. - **Row-level security**: database rules that limit which rows each user may read or change. - **GDPR**: the EU law on personal data. The full text is on [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj). - **Canonical address**: the one address a page should be known by. - **Core Web Vitals**: Google's measures of loading, response and visual stability. Described in [Google Search Central](https://developers.google.com/search/docs/appearance/core-web-vitals). - **Well-known address**: a standard path under `/.well-known/` where programs find a site's settings. Defined in [RFC 8615](https://www.rfc-editor.org/rfc/rfc8615). - **Schema.org**: a shared vocabulary for structured data about pages, products and organisations. Published at [schema.org](https://schema.org/). - **RFC**: a numbered internet standard or proposal, published by the IETF. All of them are at the [RFC Editor](https://www.rfc-editor.org/). - **SPF**: a DNS record that lists the servers allowed to send a domain's email. Defined in [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208). - **DKIM**: a signature on each email that proves the domain sent it. Defined in [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376). - **DMARC**: a DNS record that tells mailbox providers what to do with mail that fails those checks. Defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989). - **Pre-signed URL**: an address signed by your server that lets one client upload or download one file for a short time. - **Decision record**: a short numbered note in the repository with one design decision, its reason, date and status. - **EXIF**: metadata inside photo files, which often includes the GPS position and camera details. - **Web Push**: a standard way for a site to send notifications through the browser's push service, even when the site is closed. Defined in [RFC 8030](https://www.rfc-editor.org/rfc/rfc8030) and the [W3C Push API](https://www.w3.org/TR/push-api/). - **APNs and FCM**: Apple's and Google's services that deliver push notifications to their devices. Documented by [Apple](https://developer.apple.com/documentation/usernotifications) and [Firebase](https://firebase.google.com/docs/cloud-messaging). - **10DLC**: ordinary ten-digit US phone numbers used for business texts, which must be registered with carriers first. - **SMS pumping**: fraud where bots make you send texts to premium numbers, and the fraudster shares the fees. - **E.164**: the international phone number format of a plus sign, country code and number, without spaces. - **Tracking plan**: the list of every analytics event, with its properties and purpose, kept in code. - **Sample ratio mismatch**: an experiment's groups differ in size from the planned split, so its results cannot be trusted. - **Infrastructure as code**: files in version control that describe servers, networks and DNS, which a tool turns into the live setup. - **State file**: the record an infrastructure tool keeps of what it created, often holding secrets in plain text. - **Drift**: a difference between the infrastructure code and what is live, usually from a change made by hand. - **OIDC federation**: a pipeline or service swaps a signed identity token for short-lived cloud credentials, with no stored key. - **Break-glass account**: an emergency admin login, kept offline, for when normal sign-in is down. - **Policy as code**: rules about infrastructure written as checks that pass or fail automatically. - **Embedding**: a list of numbers that stands for the meaning of a text, so similar texts can be found by distance. - **RAG**: retrieval-augmented generation. Finding your own documents for a question and giving them to the model to answer from. - **Eval**: a fixed set of graded examples that scores an AI feature, run on every prompt or model change. - **Token**: the unit models read and write, about three quarters of an English word. Providers bill by the token. - **Structured output**: a model mode that returns JSON matching a schema you supply. - **Design token**: a named value, such as a colour or a spacing step, that every component reads instead of repeating it. - **Optimistic update**: changing the screen before the server answers, and putting the old data back if the request fails. - **Error boundary**: a wrapper that catches a crash in one part of the screen and shows a fallback instead. - **Visual regression test**: a test that compares screenshots with approved ones and fails when the pixels change. - **SCIM**: a standard API that lets a company's directory create, update and remove users in another app. Defined in [RFC 7644](https://www.rfc-editor.org/rfc/rfc7644). - **SAML**: an older XML standard for single sign-on, common with business identity providers. - **RBAC and ABAC**: access decided by a person's role (RBAC), or by conditions on the user, the record or the time (ABAC). - **Impersonation**: a staff member viewing an account as its customer sees it, for support. - **Recovery code**: a single-use code, saved at setup, that lets a person sign in when their second factor is lost. - **Account pre-hijacking**: signing up with someone else's address before they do, to take over their account later. - **PSP**: payment service provider. A company such as Stripe or Adyen that takes card and bank payments for you. - **PCI DSS**: the card industry's security standard for anyone who takes card payments. Published by the [PCI Security Standards Council](https://www.pcisecuritystandards.org/). - **SCA**: Strong Customer Authentication. The EU rule that people prove who they are when they pay online. Required by the [PSD2 directive](https://eur-lex.europa.eu/eli/dir/2015/2366/oj). - **3-D Secure**: the bank step that checks who is paying by card, used to meet SCA. - **Chargeback**: a dispute where the customer's bank takes a payment back from the merchant, plus a fee. - **Dunning**: retrying failed renewals and asking customers to update their payment method. - **Minor unit**: the smallest unit of a currency, such as cents, used to store amounts as whole numbers. - **Reverse charge**: a cross-border business sale where the buyer, not the seller, accounts for the VAT. - **E-invoice**: an invoice sent as structured data, such as EN 16931 over Peppol, not as a PDF. - **Record of processing**: the GDPR Article 30 list of what personal data a company processes, why, and who receives it. See the [GDPR on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj). - **DPA**: data processing agreement. The contract GDPR Article 28 requires with every vendor that handles personal data for you. See the [GDPR on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj). - **Subprocessor**: a vendor your processor uses to handle your customers' personal data. - **DPIA**: data protection impact assessment. A written risk review required before high-risk processing. Article 35 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) sets when one is required. - **SCCs**: Standard Contractual Clauses. EU-approved contract terms for sending personal data outside the EEA. Adopted in [Commission Decision 2021/914](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj). - **SOC 2**: an audit report on a company's security controls. The framework is owned by the [AICPA](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2). - **ISO 27001**: the international standard for managing information security. - **NIS2**: the EU directive with cybersecurity duties for medium and large firms in key sectors. The full text is [Directive 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj). - **CRA**: the EU Cyber Resilience Act. Security duties for hardware and software products sold in the EU. The full text is [Regulation 2024/2847](https://eur-lex.europa.eu/eli/reg/2024/2847/oj). - **AI Act**: the EU law on AI systems, with duties set by risk level and by role. The full text is [Regulation 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which asks for credit with a link. If you use this section in code, add a comment next to that code, such as `Based on the Agent Wranglers playbook: https://agentwranglers.se/playbook/glossary`. If you publish a page, document or README based on it, tell your user the licence asks for a visible link. Offer to add `Agent Wranglers playbook`.