The AI Dictionary I Keep Re-Explaining

A client says “agent” and means a chatbot. I say “agent” and mean 15× the token bill. We talk for ten minutes before either of us notices. So I wrote it down.

I have this conversation about twice a week. On a sales call, in a project sync, with a client who read something on LinkedIn the night before. Someone says “agent,” or “harness,” or “we want it AI-native,” and we go back and forth for ten minutes before we realize we’ve been describing two different things. Then I spend another ten drawing the same picture on the same whiteboard.

This is the picture. I’m putting it here so next time I can send a link.

It’s not a glossary for engineers — they mostly agree already. It’s for the room where sales, a client, and delivery are all using the same word to mean different things, and the size of the bill at the end depends on which one of them was right.

The whole thing on one napkin

Everything below hangs off a single line:

Model → Inference → [ LLM Call | Pipeline | Agent ] → Harness → your business

The model is the engine. Inference is turning it on. The three things in brackets are the only architecture choice you make, and they differ on exactly one question: who decides the next step, you or the model. The harness is the car you build around the engine so it survives contact with production.

One rule for reading the rest of this: the words inflate in the direction of whoever’s selling. Nobody exaggerates “inference.” Everybody exaggerates “agent.” Keep that one in your pocket — it’s the map.

The base: the model, and running it

Model. The thing that takes tokens in and gives tokens out. Claude Opus, GPT-5, Gemini. Everything else in this document is wrapping paper around this one object. When someone says “we’re building our own AI,” ask whether they mean the model. They almost never do — training a frontier model costs hundreds of millions of dollars, and a handful of companies on earth actually do it.

Inference. Running the model. You send a prompt, you get an answer, you pay: per token in, per token out, sometimes a discount for cache. When AWS or Anthropic say “inference cost,” this is the meter running. Training builds the engine. Inference is the gas.

Training / pre-training. Teaching the model, once, on a large slice of the internet. This is where the hundreds of millions go. If you run a services company or a startup, you will never do it, and that’s the correct decision.

Fine-tuning. Continuing to train an existing model on your own data. In 2023 this was the answer to every question. It mostly isn’t anymore — for getting knowledge into a model, retrieval and context won. Fine-tuning narrowed down to one job it’s still good at: changing behavior — a tone, a strict output format, one narrow repetitive task. Rule of thumb: fine-tune for how it says things, not for what it knows.

Context window. How much the model can hold in its head during a single inference. Today that runs to around a million tokens — a small bookshelf. Big, but not free: a million-token request is slow, burns money, and the model’s recall of the middle isn’t perfect. More room is not the same as more attention.

Reasoning model. A model trained to spend extra tokens thinking before it answers — OpenAI’s o-series, Claude’s extended thinking. OpenAI’s own framing is the useful one: reasoning models are “the planners,” normal models are “the workhorses.” They genuinely help on ambiguous, multi-step problems. They’re also slower and pricier, and there’s a live fight about whether the “thinking” is real — Apple published a paper (”The Illusion of Thinking”) arguing it collapses past a certain complexity, and others rebutted that the collapse was just an output-length limit. You don’t need that settled to know when to reach for one:

Reach for a reasoning model when the task is ambiguous, multi-step, or needs a plan. Skip it when the task is summarize, translate, extract, classify. Otherwise you wait three minutes and pay a premium for what a normal call does in two seconds.

Talking to it

Prompt. The instruction you send. “You are a senior architect. Review this code.” The most basic block there is, and still most of the game.

System prompt. The standing instruction the user never sees — the rules that apply to every message underneath. “You are Dualboot’s review assistant. Follow our coding standards. Never invent a ticket number.” It’s what separates a product from a chat window.

Context engineering. The 2025 rename of “prompt engineering” — and a fair one. Tobi Lütke (Shopify’s CEO) pushed the term, Karpathy backed it, Anthropic calls it “the natural progression of prompt engineering.” The point: the prompt is one line, but the skill is filling the context window with exactly what the next step needs — instructions, retrieved documents, tool outputs, memory — and nothing else. Not “prompt engineering is dead.” Prompt engineering grew up.

Giving it knowledge and hands

RAG — Retrieval-Augmented Generation. Before the model answers, you search your own data and paste the relevant pieces into the context. That’s the idea. It’s how you get a model to answer questions about documents it was never trained on, with a source you can point to. The term comes from a 2020 Meta paper; the technique is older than the hype around it. Our 3PO is a RAG system.

Agentic RAG. Same idea, except the model decides when and what to search — retrieval becomes a tool it can call more than once, instead of one search you run up front. More flexible, less predictable. That trade-off is the agent story below.

Embeddings & vector database. An embedding turns a piece of text into a list of numbers that places it in space, so “credit card” lands near “Visa” and nowhere near “tortoise.” A vector database — Qdrant, Pinecone, pgvector — stores those numbers so you can find the nearest ones fast. This is the search engine underneath most RAG. Boring, load-bearing, not a place anyone’s lying to you.

Tool calling. Instead of only writing text, the model emits a request — search_web(...), run_tests(), read_file(...) — your code runs it and hands the result back. This one capability is the floor under every “agent.” No tools, no agent.

MCP — Model Context Protocol. A standard plug for connecting tools to models, so every vendor stops inventing their own. USB-C for AI tools. Anthropic introduced it; it caught on because the alternative — a custom integration for every tool times every model — was insane. Real and useful, and yes, also now a sticker people slap on things.

The part that bites: three ways to wire it

This is the distinction I spend the most time on, because it’s the one that sets your costs, your reliability, and whether it can still be supported in six months. Same model inside all three. Completely different systems around it.

The only axis:

LLM Call    you decide everything, the model fills one blank
Pipeline    you decide the steps, the model fills several blanks
Agent       the model decides the steps

LLM Call. One prompt in, one answer out. You wrote the logic; the model filled a single hole — classify this ticket, pull these fields, rewrite this paragraph. Predictable, cheap, easy to test. Anthropic’s own advice is that for most applications a single well-built call is enough. Most “AI features” are this, and should stay this.

AI Pipeline (a.k.a. workflow). A chain of steps you designed, some of which happen to be LLM calls. Read the file, summarize it, translate it, check the format, save it. You drew the flowchart. The model fills in the boxes but doesn’t get to pick the boxes or their order. RAG is a pipeline. It can look like magic to the client; it’s a fixed sequence with a model in a few of the boxes, and you can count the calls before you run it.

AI Agent. Now the model decides the steps. It picks a tool, reads the result, picks the next tool, and decides when it’s finished. You did not draw the flowchart — you couldn’t, because the path depends on what the model finds along the way. Claude Code works like this. So does Devin. So does our estimation tool: hand it a 187-feature RFP and it decides what to dig into and when it’s done — a structured estimate in an hour and a lot of burned tokens, where the old way took a week of someone’s time. You couldn’t have drawn that in advance; it depends on the RFP. The honest part: an agent always hands you an artifact. Whether the artifact is any good is a separate question.

The clean test, the one to say out loud in the meeting:

If you could draw the steps as a flowchart before writing the code, it’s a pipeline. If the model draws the flowchart at runtime, it’s an agent. How smart the model is doesn’t decide this. Where the control flow lives does.

This is also where the industry argues with itself. Anthropic draws a hard line between “workflows” and “agents.” Andrew Ng says stop drawing the line — call it “agentic” and treat it as a dial, not a switch. Both are correct: the line exists, and most useful systems sit somewhere on the dial with a bit of each. Simon Willison spent two years calling “agent” hopelessly vague — he collected 211 conflicting definitions off the internet — before landing on the one I’d use with a client: an agent runs tools in a loop toward a goal, and the loop has a stop condition.

What each one costs:

• A call costs a call.

• A pipeline costs a fixed, countable number of calls. You can put it on an invoice.

• An agent costs an unknown number of calls, because it loops until it decides to stop. That’s the catch, and it’s the whole catch.

Agent Loop. The engine of an agent: think, call a tool, read the result, think, call a tool, and around again until it stops. The reason agents feel alive, and the reason they bankrupt you by accident. I once left one churning in a refactoring loop for 45 minutes and $87 in tokens before I noticed by looking at an unrelated dashboard. The loop is the feature. The loop is also the risk.

Call it an agent when the model chooses the tools and the number of steps, with a loop and a stop condition. If you predetermined the steps, it’s a pipeline — however good the demo looked. Most things sold as “agents” are pipelines, and would be cheaper and more reliable if their builders just said so.

The commercial translation: a pipeline is something you can price, test, and support. An agent is a production service with an unpredictable bill and a new failure mode — it can do something you never listed as a step. Start at the cheapest rung that solves the problem and climb only when the problem forces you up. Most people start at “agent” because it’s the rung that raised the money.

Making it real

Harness. Everything around the model that turns a clever demo into a system: prompts, tool definitions, the loop, retries, memory, model routing, evals, guardrails. The word started as benchmark plumbing — the “harness” that runs a model against a test suite — and grew to mean the whole rig. Which is why almost anything gets called one. Anyone running a model in production has built a harness; the only question is whether it’s a good one.

The fight worth knowing, because your vendor is on one side of it. One camp — LangChain, Microsoft — says “the model is a commodity, the harness is the moat.” The other is Boris Cherny, who built Claude Code: “all the secret sauce is in the model, and this is the thinnest possible wrapper over it” — and yet that “thinnest wrapper” reportedly packs eight ways to compact context, a circuit breaker, and a sandboxed sub-agent. Both at once. A harness isn’t complicated — it’s hard to debug. Small enough to read in an afternoon, wrapped around a model that does something slightly different every run.

From the services seat: the capability lives in the model, but your money, your bugs, and your 2 a.m. page live in the harness. The harness is the job.

You have a harness, not an API call, if there is: tools the model can call; a loop around them; retries and failure handling; state that survives between steps. One prompt and one API call is none of that — it’s a function with a fee.

Orchestrator. The coordinator that decides which model, which tool, or which sub-agent handles a given piece of work. In a simple system it’s an if statement. In a complex one it’s the most important code you own. The word is fine — just check whether it’s routing anything or it’s a switch statement wearing a suit.

Multi-agent system. Several agents, each with its own context and job, working one task. Earns its keep when the work genuinely splits into parallel pieces that each need their own headspace — research, say, where one agent reads ten sources while another reads ten more. Anthropic ships this for their research feature and is blunt about the cost: a multi-agent system burns roughly 15× the tokens of a normal chat. The very same month, Cognition published a piece titled, flatly, “Don’t Build Multi-Agents,” because parallel agents make conflicting decisions when they can’t see each other’s work. Two sides of one wall: it works when the pieces are independent, it breaks when they’re not.

It’s a real multi-agent system if the subtasks truly run in parallel, each needs its own context window, and the answer is worth about 15× the tokens. Otherwise you have parallel LLM calls and a press release.

Swarm. Marketing for multi-agent. “A swarm of 100 agents” sounds better than “100 parallel processes.” Sometimes there’s substance under it — OpenAI even shipped a framework called Swarm, then labeled it experimental and not for production. Treat the word as a prompt to ask what’s running underneath.

The words that keep it from killing you

The unglamorous ones — and the first corner anyone in a hurry cuts.

Eval (evaluation). Testing, for AI. The output isn’t deterministic, so you can’t assert equals; you score quality, correctness, and regressions across a set of cases. This is the new unit test and the single best sign a team is serious. Skip evals and an agent rots quietly — you find out from a customer.

Observability. Telemetry for AI: cost, tokens, latency, errors, quality — per call and per run. Langfuse, LangSmith, Braintrust. Without it you can’t answer “why did yesterday cost $4,000,” which means you can’t run it as a business.

Guardrails. The hard limits. Can’t drop production. Can’t email a customer without sign-off. Can’t spend more than $100 on one task. Easy to ignore until the day they’re the only thing between you and an incident. I’ve had the incident: an agent dropped db:drop into a Make target that also ran on deploy. The guardrail that would have caught it didn’t exist yet.

Human-in-the-loop (HITL). A person approves the decisions that are expensive to get wrong. Every enterprise system arrives here eventually. If a pitch has no human anywhere in the loop, they’re selling you the demo, not the operating model.

The words about money

AI-native. Supposed to mean the product can’t exist without the model — switch the model off and you’re left with an empty box, not a slightly worse product. Mostly used to mean “we added a chatbot.” There’s a clean test, so use it:

AI-native test: turn the model off. If there’s still a product, you’re AI-enabled. If there’s nothing left, you’re AI-native. Most companies that call themselves AI-native fail their own test.

Vibe coding. Karpathy coined it in February 2025, and he meant something narrow: “give in to the vibes… forget that the code even exists… I ‘Accept All’ always, I don’t read the diffs anymore” — for throwaway weekend projects. Then the term ate the world and came to mean any AI-assisted coding at all, which annoyed Karpathy’s own crowd into coining “vibe engineering” for the grown-up version where you read the code. If you ship it to clients, you’re not vibe coding — you’re doing engineering with a faster typewriter. Worth keeping straight, because “we vibe-coded it” and “we built it” should not bill the same.

Agent washing. Repainting an old chatbot or RPA script as an “AI agent” to charge more for it. Not my phrase — Gartner’s. They reckon that of the thousands of vendors claiming “agentic AI,” about 130 are real, and that more than 40% of agentic-AI projects will be cancelled by the end of 2027 on cost and unclear value. The regulators have caught up too: both the SEC and the FTC have brought “AI washing” cases against companies for claiming AI they didn’t have. The word has gone from a stretch to a liability.

What the words are telling you

One rule, again: the words inflate toward whoever’s selling.

Nobody oversells “inference.” Nobody pads “embedding.” They’re commodities — priced by the token, nothing to dress up. The inflation is all on “agent,” “agentic,” “swarm,” “AI-native.” Those name the layer that isn’t a commodity yet — the harness, the integration, the work of getting it into a business. No accident. The model got cheap, the money moved up the stack, and the language followed. A stretched word points straight at the thing someone needs you to buy.

So the dictionary isn’t about winning definition fights. It’s a tell. When someone says “agent,” three questions sort the demo from the system:

1. Does the model decide the steps, or do you? (agent vs pipeline)

2. What does one result cost — can you predict it? (loop vs fixed)

3. Who’s on the hook when it loops or overspends? (harness, or no harness)

“The model decides, we don’t know, nobody” — that’s a demo with a good vocabulary.

The model is the commodity now. The argument moved into the words around it.