Glossary

Terms as this book uses them, with a pointer to where each is built or first used. Where a term has a broader industry meaning, the definition here is the one that matters for agent systems on AWS.

A2A (Agent2Agent). An open protocol for agents to engage other agents as counterparties across trust boundaries: signed agent cards for discovery, long-lived tasks with a lifecycle. Contrast MCP. Chapter 51.

Admission control. Refusing to start work the budget cannot cover, checked before dispatch rather than after. The mechanism that makes a budget a ceiling rather than an estimate. Chapter 23.

AgentCore. Amazon Bedrock's managed agent platform: Runtime, Memory, Gateway, Identity, Code Interpreter, Browser, Observability, Policy, Evaluations. Dissected component by component in Part 3.

Agent (as this book means it). A model calling tools in a loop, with the model choosing each step. The three parts are the model (judgment), the tools (hands), and the loop (harness). Chapter 7.

Agent card. An A2A agent's signed, published description of its capabilities and how to reach it: the discovery layer for cross-vendor agents. Chapter 51.

At-least-once delivery. A queue's honest promise: a message will arrive, possibly more than once, because "done but unacknowledged" cannot be told from "never started." Tamed by idempotency. Chapter 47.

Blast radius. The worst an actor (or a compromised agent) can do, bounded by its tools and permissions. Capping it, rather than perfecting detection, is the durable defense. Gates 1 and 11, Chapter 37.

Budget (vs quota). A total you impose on yourself (tokens or dollars per run/tenant/fleet), enforced by the ledger. Distinct from a quota, a rate the provider imposes. Chapter 0.

Checkpoint. A saved offset into an event log marking known-good progress, so resumption re-reads only what follows. Chapter 9.

Confused deputy. An agent tricked into misusing a powerful identity of its own. Defended by acting under credentials scoped to the user's task, not the agent's standing role. Chapter 36.

Context window. The bounded set of tokens a model can attend to in one call: its working memory. Re-sent in full every turn because the model is stateless. Chapter 0.

Distributed map. A Step Functions state that runs one branch over a large dataset, up to 10,000 parallel children, with redrive. The managed fleet fan-out. Chapter 46.

Drain (vs kill). Stop intake and let in-flight work finish (drain), versus stop now and lose in-flight work (kill). The two operator switches. Chapter 43.

Dead-letter queue (DLQ). Where a message that fails N times is parked for human inspection, instead of retrying forever. Chapter 47.

Event sourcing. Storing an append-only log of what happened and deriving state by folding over it, rather than storing mutable state. Buys replay, audit, and resumption. Chapter 9.

Firecracker. The open-source (Rust, on KVM) microVM monitor under Lambda, Fargate, and AgentCore. VM-grade isolation at container speed. Chapter 28.

Governor. The client-side token bucket that shapes a fleet's demand on the model quota so it never storms the account. Chapter 14.

Guardrail. A managed content filter applied to text crossing a boundary (Bedrock Guardrails). A probabilistic sieve, not a wall; contrast a permission or a gate. Chapter 13.

Idempotency key. A unique id on an effect (operation_id) so a duplicated attempt is a no-op: exactly-once effect on at-least-once delivery. A tool property, not plumbing. Chapter 8.

Inference profile. A Bedrock routing indirection that spreads traffic across regions (us./eu./global.). The unit of capacity planning, distinct from the model. Chapter 11.

Lease. A time-limited claim on a work unit, held by a conditional write with a TTL. Its expiry distinguishes a slow worker from a dead one without asking. Chapter 32.

Lethal trifecta. The three ingredients a damaging injection needs: private data, untrusted content, and an egress path. Remove any one and the exfiltration fails. Chapter 37.

Little's law. $L = \lambda W$: concurrency equals throughput times time-in-system. Sizes a fleet; its crossover with the token quota sets the useful worker count. Chapter 0, Chapter 23.

MCP (Model Context Protocol). The open protocol for connecting an agent to tools: JSON-RPC, tools/list, tools/call. Built from scratch in Chapter 18; its economics in Chapter 50.

microVM. A virtual machine stripped to a minimal device model, so it boots in ~100ms with a strong (own-kernel) isolation boundary. The unit of agent-code isolation. Chapter 28.

Plane. A group of components sharing one responsibility and one failure conversation. Hive has six: control, model, execution, sandbox, state/memory, trust/ops. Chapter 4.

Poison work. A unit that fails every attempt (on its content, not luck). Dead-lettered after N tries rather than retried forever. Chapter 25.

Principal / role / least privilege. An authenticatable identity; a bundle of permissions it can assume; the rule of granting only what the task needs. The vocabulary of agent IAM. Chapter 36.

Prompt caching. Reusing the model's processing of an unchanged request prefix at ~0.1x price. Requires a byte-stable prefix; the largest single cost lever. Chapter 12.

Prompt injection. Text the agent reads (in a page, a document) that instructs it to misbehave. Unpatched by design; bounded by containment, not detection. Chapter 37.

Quota. The provider's rate limit (requests and tokens per minute), account-wide. Managed by the governor; distinct from a budget. Chapter 14.

Redrive. Distributed map's re-run of only the failed children: resume, as a button. Does not know your budget ledger. Chapter 46.

Replay. Deterministic re-execution of a recorded run against its recorded model responses, for debugging and audit. Requires record-at-the-edges purity. Chapter 10.

Session policy. An STS policy attached to an assumed-role session that can only narrow the role (effective = intersection). How a broad agent role is scoped per task. Chapter 36.

Showback. Attributing spend per run, tenant, team, and change, so cost is a shared engineering concern rather than a monthly surprise. Chapter 42.

Snapshot / restore. Freezing a booted microVM to disk and restoring fresh copies in ~tens of ms: how a per-request-destroyed sandbox stays fast, and what SnapStart is. Chapter 28.

Strands. AWS's open-source, model-driven agent SDK; its multi-agent primitives (agents-as-tools, swarm, graph, workflow) are thin conveniences over the Part 1 loop. Chapter 49.

Stop reason. The machine-readable field ending a model response (done, tool-use, out-of-tokens, refusal): the only signal the loop should trust for control flow. Chapter 7.

Token. The unit a model reads and writes and is priced in (~¾ of an English word). Output typically costs ~5x input. Chapter 0.

Trajectory. The whole multi-turn arc of a run: the unit of agent observability and evaluation, represented as a trace of spans. Chapter 40.

Verification mesh. An adversarial layer of blind refuter agents that try to kill findings, lifting precision at a measured token price. The star of Capstones A and D. Chapter 26.

Workflow (vs agent). Known control flow drawn in advance (a state machine); use it wherever the steps are knowable, and reserve the free agent loop for genuinely open-ended steps. Chapter 45.