---
title: "Glossary · Highflame"
description: "A glossary of agent-security terms: identity, delegated authority, MCP, A2A, trust tiers, and more, defined plainly."
doc_version: "0.1.0"
last_updated: "2026-07-27T05:42:48.105Z"
canonical: "https://www.highflame.com/glossary"
---

# The agent-security glossary.

The terms behind agent identity, authorization, and governance: defined plainly, no jargon for its own sake.

[A](#ltr-A)[B](#ltr-B)[C](#ltr-C)[D](#ltr-D)[E](#ltr-E)F[G](#ltr-G)H[I](#ltr-I)[J](#ltr-J)K[L](#ltr-L)[M](#ltr-M)[N](#ltr-N)[O](#ltr-O)[P](#ltr-P)Q[R](#ltr-R)[S](#ltr-S)[T](#ltr-T)UVWXY[Z](#ltr-Z)

## A

### [A2A (Agent-to-Agent)](/glossary/a2a.md)

Communication where one agent delegates work to, or calls, another agent. Each hop has to carry identity and narrow scope. Or authority leaks down the chain.

### [Adaptive guardrails](/glossary/adaptive-guardrails.md)

Runtime controls that tighten themselves as new signals and attack patterns emerge, instead of relying on static rules someone has to keep updating.

### [Agent Control Fabric](/glossary/agent-control-fabric.md)

Highflame's term for the identity, policy, and enforcement substrate that governs every agent action at every boundary it crosses: one layer, not a bundle of point tools.

### [Agent governance](/glossary/agent-governance.md)

Controlling what an organization's agents are allowed to do and proving what they did: discover every agent, authorize each action against policy, and produce audit evidence. Distinct from AI governance's focus on model risk.

### [Agent identity](/glossary/agent-identity.md)

A verifiable, cryptographic credential issued to an agent that carries agent-shaped claims (owner, trust tier, framework, delegation depth) so every action traces back to a named human.

### [AI observability](/glossary/ai-observability.md)

Capturing and querying everything an agent does at runtime, LLM calls, tool calls, file and network activity, tied to identity, so you can ask why something happened and who did it, not just read logs.

### [Attribute-based access control (ABAC)](/glossary/abac.md)

Authorization decisions keyed to attributes (the agent's claims, owner, trust tier, and delegation depth) rather than shared keys or static roles.

### [Authorization](/glossary/authorization.md)

Deciding whether a given actor is allowed to take a given action. Distinct from authentication (proving who you are); authorization is what an agent may do.

## B

### [Blast radius](/glossary/blast-radius.md)

The set of systems and data a compromised agent or credential could reach. Identity-scoped access shrinks it; cascade revocation contains it.

### [Breakout controls](/glossary/breakout-controls.md)

Runtime controls that keep an agent aligned to its mission: containing, redirecting, or stopping it when it veers off course, before the action lands.

## C

### [Cascade revocation](/glossary/cascade-revocation.md)

Revoking a parent credential instantly invalidates everything it delegated, collapsing the affected delegation tree rather than waiting for tokens to expire.

### [Cedar](/glossary/cedar.md)

An open, formally analyzable policy language. Highflame authors authorization policy in Cedar and enforces the same policy at every boundary an agent crosses.

### [CIBA](/glossary/ciba.md)

Client-Initiated Backchannel Authentication: an out-of-band flow that pauses a sensitive agent action for explicit, attributable human approval.

### [Code agent](/glossary/code-agent.md)

Autonomous software that reads code, runs commands, calls tools, and changes systems on a developer's behalf. Securing one means controlling what it can access while it runs, and proving afterward what it did.

### [Confused deputy](/glossary/confused-deputy.md)

An attack where a low-privilege agent tricks a higher-privilege one into acting on its behalf. Scope attenuation prevents it: a sub-agent provably cannot exceed its parent's authority.

## D

### [Delegated authority](/glossary/delegated-authority.md)

The model where an agent acts on behalf of a human or another agent, holding strictly less authority than the principal that authorized it, and provably distinct from that principal.

### [Delegation depth](/glossary/delegation-depth.md)

How many on-behalf-of hops a credential sits from its original human authorizer. Highflame enforces depth as a first-class policy primitive.

### [DPoP](/glossary/dpop.md)

Demonstrating Proof-of-Possession (RFC 9449): binds a token to a proof key so a stolen token is inert without it.

## E

### [Enterprise Managed Authorization (EMA)](/glossary/ema.md)

An MCP extension that lets a company's identity provider decide, through corporate SSO, which MCP servers an agent may connect to. It governs admission, not what the agent does once inside.

## G

### [Guardrails](/glossary/guardrails.md)

Inline detection and enforcement on an agent's prompts, tool calls, and responses: blocking unsafe actions in real time.

## I

### [ID-JAG](/glossary/id-jag.md)

Identity Assertion JWT Authorization Grant. After SSO, the identity provider evaluates policy and issues an ID-JAG, which an MCP client exchanges for a server access token: the mechanism behind Enterprise Managed Authorization.

### [Identity provider (IdP)](/glossary/idp.md)

The system that issues and manages identities. Highflame extends your existing IdP to agents rather than replacing it.

### [Inline enforcement](/glossary/inline-enforcement.md)

Evaluating and deciding on an action before it executes, out-of-band, rather than detecting it after the fact. Fail posture (open or closed) is set per surface.

## J

### [Just-in-time (JIT) access](/glossary/jit-access.md)

Issuing short-lived, task-scoped credentials on demand that expire when the work is done: eliminating standing access there's nothing to leak or over-grant.

## L

### [LLM firewall](/glossary/llm-firewall.md)

A checkpoint in front of a model that inspects prompts and responses for injection, sensitive data, and unsafe content. It guards the model's edge, not the agent's actions behind it.

### [LLM security tools](/glossary/llm-security-tools.md)

The stack that protects LLM applications: input/output filters, firewalls and gateways, runtime enforcement, red teaming, and observability. No single tool covers all five.

## M

### [MCP (Model Context Protocol)](/glossary/mcp.md)

An open protocol that connects agents to external tools and data. Powerful for capability. But every connection is a new access path that has to be governed.

### [MCP Gateway](/glossary/mcp-gateway.md)

A governed checkpoint every tool connection passes through (authenticated, policy-checked, and logged) so credentials stay central and unapproved servers can't connect.

### [Mission drift](/glossary/mission-drift.md)

When a non-deterministic agent gradually diverges from its intended task. Tracked at runtime so it can be contained before consequences land.

## N

### [Non-human identity (NHI)](/glossary/nhi.md)

Identities belonging to machines, services, and agents rather than people. Agents are the fastest-growing and least-governed class of NHI.

## O

### [On-behalf-of (OBO) chain](/glossary/obo-chain.md)

The unbroken provenance recorded on a credential (who authorized the action, what scope was granted, and how deep the delegation goes) so an audit walks back to a human.

## P

### [Prompt injection](/glossary/prompt-injection.md)

An attack that manipulates an agent through crafted input (in a prompt, a tool result, or retrieved content) to make it act against policy.

## R

### [Red teaming](/glossary/red-teaming.md)

Continuous adversarial testing of AI systems (jailbreaks, extraction, manipulation) with findings turned into enforcement policy and re-scanned to prove the fix.

### [RFC 8693 (token exchange)](/glossary/rfc-8693.md)

The standard that lets one token be exchanged for another with attenuated scope: the basis for verifiable agent-to-agent delegation.

## S

### [Scope attenuation](/glossary/scope-attenuation.md)

Narrowing permissions at each delegation hop so a sub-agent can never hold more authority than the agent that delegated to it.

### [Shadow agents](/glossary/shadow-agents.md)

Agents running across clouds, IDEs, and SaaS that no one inventoried or assigned an owner: the unmanaged majority of an enterprise's agent footprint.

### [Shadow AI](/glossary/shadow-ai.md)

The AI tools and autonomous agents adopted across an organization without IT's approval. Shadow IT for the agent era, and faster, because an agent takes minutes to wire up and can act on real systems.

### [SPIFFE / WIMSE](/glossary/spiffe-wimse.md)

Open standards for verifiable workload identity. Highflame extends them with agent-shaped claims for delegation, trust, and attribution.

## T

### [Tool poisoning](/glossary/tool-poisoning.md)

Hiding malicious instructions in an MCP server or tool description so an agent executes them when it loads or calls the tool. Invisible to static config; caught by scanning tools before load and enforcing at the call.

### [Trust tier](/glossary/trust-tier.md)

A provenance-based level on an agent's identity (first-party/attested, verified third-party, or unverified) that gates what the agent is eligible for and tightens its policy. It is a verified input to every decision, never a bypass: each action is still authorized per request, so there is no implicit trust.

## Z

### [ZeroID](/glossary/zeroid.md)

Highflame's open-source agent identity core (Apache 2.0), built on OAuth 2.1, SPIFFE/WIMSE, and RFC 8693: the inspectable foundation beneath Highflame Identity.

## See the fabric against your own agents.

A 45-minute session covers your real agent footprint and what governance looks like in your environment.

[Book a demo](/contact.md) [Explore the platform](/platform.md)

## Sitemap

Full site map: [/sitemap.md](https://www.highflame.com/sitemap.md). Machine index: [/sitemap-index.xml](https://www.highflame.com/sitemap-index.xml).