Glossary — 70+ Terms, A–Z

Filter this page with the search box above. Each term: one exam-precise sentence, plus context where it matters.

A

• 4D Framework (AI Fluency) — Anthropic's human-side framework: Delegation (hand over vs keep), Description (communicate intent), Discernment (judge output), Diligence (responsibility); each D maps to concrete machinery in this guide (see the AI Fluency Bridge page).
• Agent — a system where the model dynamically directs its own process and tool use in a loop, versus a workflow's predefined path.
• Agent loop — gather context → model decides → execute tools → append results → repeat until a terminal condition.
• Agent SDK (Claude Agent SDK) — the Claude Code engine (loop, tool execution, permissions, subagents, MCP, hooks) as a Python/TS library for building your own agent services; sits between the raw Claude API and Claude Code itself.
• additionalProperties: false — JSON-Schema setting making a schema closed; invented fields fail validation instead of passing silently.
• Allowlist (tool/permission) — explicit enumeration of permitted tools/commands; the deterministic alternative to trusting instructions.
• Artifacts of orchestration — plans, task lists, and summaries a coordinator uses to manage subagents.
• Audit trail — append-only record of every decision, tool call, and gate verdict; the substrate for "explainable, auditable, replayable."

B

• Batch API — asynchronous bulk processing at ~50% cost with hours-scale turnaround; the answer for offline volume (evals, backfills).
• Budget (harness) — hard ceilings on turns/tokens/cost/wall-clock whose breach is a terminal state, not a warning.

C

• cache_control — API marker placing prompt-cache breakpoints; everything before it must be byte-identical to hit.
• Checkpointing — persisting agent state each step so restarts resume rather than replay side effects.
• Chain of thought (CoT) — asking the model to show a step-by-step rationale before its answer; for genuinely hard reasoning prefer extended thinking (the Claude API's thinking parameter) — treat any visible "reasoning" text as a rationale, not guaranteed inner thought.
• CLAUDE.md — Claude Code's memory file; project scope is checked into git and shared, user scope (~/.claude/CLAUDE.md) is personal; more specific scopes win.
• Claude API (Anthropic's Messages endpoint) — the HTTPS service (POST api.anthropic.com/v1/messages) carrying the model calls in this guide; stateless for your conversation (the full history travels in the messages array each call). Distinct from tool backends (your DB, GitHub — called by your harness) and entry points (the webhook/UI a task arrives through). Also served via Amazon Bedrock (AWS) and Vertex AI (Google Cloud) with the same harness code. Every request field: Messages API Spec.
• Claude API response — the JSON the Claude API returns per call: id / type / role / model, content (an array of text / tool_use blocks — never a string), stop_reason (branch on it first), stop_sequence, and usage (token counts + prompt-cache counters). Append the assistant message verbatim to the messages array before the next call. Field-by-field: Messages API Spec.
• Closed schema — a JSON Schema with additionalProperties: false; see additionalProperties.
• Claude Code — Anthropic's agentic coding tool (CLI/IDE) whose configuration surface (memory, skills, hooks, settings, MCP) is Domain 2.
• Compaction — summarizing conversation history to reclaim context window (/compact).
• Confused deputy — a privileged intermediary (tool/server) tricked into misusing its authority; mitigated with least-privilege credentials.
• Context engineering — curating what enters the window per call: retrieval, compaction, isolation, caching, ordering.
• Context isolation — giving heavy work its own window (subagents) so the main context stays clean.
• Context window — the token budget for everything (system, tools, history, docs, output reservation); commonly 200K — check the current model's spec; larger tiers exist.

D–E

• Decision as data — the model returns typed choices (tool_use, schema-bound JSON); deterministic code executes them.
• Elicitation (MCP) — a server requesting additional input from the user through the client.
• Escalation — first-class terminal path handing a case to a human with a context packet.
• Evaluator–optimizer — generator + critic loop; use when clear evaluation criteria exist.
• Evals — programmatic quality gates (golden sets, judges, assertions) run on every prompt/model change.
• Extended thinking — API-enabled internal reasoning with a token budget for genuinely hard tasks; incompatible with prefilling.

F–H

• Few-shot / multishot — 3–5 diverse in-prompt examples; format mirrors matter more than instructions.
• Golden set — fixed eval scenarios with deterministic assertions on behavior (tools called, gates fired, terminal state).
• Graceful degradation — planned fallback ladder: primary model → fallback → template → honest failure; never silent.
• Headless mode — claude -p: Claude Code with nobody at the terminal; machine-readable output, --allowedTools as the gate, --max-turns as the budget; how agents run in CI (continuous integration).
• Guardrail — a deterministic check the model cannot bypass by wording (schema, allowlist, arithmetic bound).
• Harness — the deterministic code around the model: builds prompts, executes tools, applies gates, owns the loop.
• Hooks (Claude Code) — shell commands on lifecycle events (PreToolUse, PostToolUse, Stop…) that can observe, block (exit code 2, on supported events like PreToolUse), or run side effects (e.g. auto-format after a write); deterministic, unlike prompt instructions.
• Host / Client / Server (MCP) — the LLM app / its per-connection connector (1:1, stateful) / the capability provider.
• Human-in-the-loop (HITL) — deterministic approval gate before high-risk actions; silence never equals approval.
• Hub-and-spoke — multi-agent topology where all coordination flows through the coordinator.

I–L

• Idempotency — retried operations produce the same effect once (keys + effects ledgers at the tool layer).
• Interaction modes (automation · augmentation · agency) — AI performs a defined task / AI as iterative thinking partner / AI acting independently under standing rules you configured; a maturity ladder for the same task.
• Indirect prompt injection — adversarial instructions arriving through tool results, documents, or MCP metadata rather than the user.
• is_error (tool_result) — flag returning tool failure to the model so it can adapt; preferable to harness exceptions.
• JSON Schema — the declarative language describing a JSON shape (properties, required, type, enum, additionalProperties). A portable document: the same schema appears in a tool's input_schema (shapes the model's arguments), native structured-output config (where supported), and your harness's validator.
• JSON-RPC 2.0 — the request/response JSON message format MCP uses over its transports (a method name + params in, a matching result or error out).
• LLM-as-judge — grading outputs with a separately validated judge model (often a different family, to reduce self-bias); calibrate the judge against human-labeled examples — judge agreement is a signal, not proof.
• Least privilege — every tool/server/token gets the minimum scope required.

M–O

• max_tokens — mandatory per-call output ceiling, enforced by the Claude API; reserves its allowance from the context window; hitting it = stop_reason: max_tokens (incomplete — never parse as complete); bounds size only, never shape.
• messages array — the whole conversation, oldest-first, resent in every request (the Claude API is stateless); new turns appended at the end: the assistant's response verbatim, then your tool_result in a user-role message; system/tools stay outside as the cacheable prefix.
• MCP (Model Context Protocol) — open standard turning N×M integrations into N+M via hosts, clients, and servers exposing tools/resources/prompts.
• .mcp.json — project-scoped MCP config, checked into git, env-interpolated secrets.
• Model tiering — cheap/fast models for classification, frontier for reasoning, different family for judging.
• Multi-agent system — coordinator + specialized subagents; buys context isolation and parallelism at cost/latency price.
• Orchestrator–workers — the coordinator decomposes dynamically, delegates, synthesizes.

P–R

• Parallel tool use — multiple tool_use blocks in one response; return one tool_result per id.
• Pearson VUE — the certification's proctored delivery platform.
• Permission precedence — enterprise policy > CLI flags > local project > shared project > user settings.
• Prefill — starting the assistant turn (e.g., {) to force format; not combinable with extended thinking, and model-dependent on newer models — check current docs.
• Prompt caching — reusing a byte-identical static prefix across calls; ~90% input-cost reduction on hits; order-sensitive.
• Prompt chaining — sequential calls with programmatic checks between steps.
• Prompt injection — adversarial text steering the model; defended in three layers (bound input → quarantine → deterministic output gates).
• Prompts (MCP primitive) — user-controlled templates a server exposes.
• Quarantine (input) — wrapping untrusted text in tags with a standing treat-as-data rule.
• Rate limiting (429) / Overloaded (529) — HTTP status codes the Claude API returns instead of a normal response: 429 = your throughput ceiling hit, 529 = Anthropic's side temporarily saturated; both → exponential backoff + jitter, respect retry-after.
• Resources (MCP primitive) — application-controlled, URI-addressed context/data.
• Routing (workflow) — classify then dispatch to specialized handling.

S

• Sampling (MCP) — a server requesting an LLM completion from the client's model.
• Scenario-based exam — CCAR-F's format: question clusters under system-description contexts.
• Skills (Claude Code) — folder-based reusable expertise (SKILL.md + resources). “Model-invoked” = model-chosen: it matches your request against the skill’s description and selects it (or you type /name); Claude Code executes — loads the file, runs bundled scripts.
• Slash command — user-invoked prompt template in .claude/commands/ with $ARGUMENTS.
• stdio / Streamable HTTP — MCP transports: a local child process the host talks to over standard input/output, vs a remote networked service (SSE — Server-Sent Events — is the legacy remote transport).
• Stop reason — why generation ended (end_turn, tool_use, max_tokens, stop_sequence, refusal); a closed set emitted by the Claude API; the harness's branch variable.
• Streaming (SSE) — incremental token delivery; UX + stall detection.
• Structured output ladder — prompted JSON → prefill (legacy/model-dependent) → schema-as-forced-tool → native structured outputs / strict tool inputs (where supported — the strongest shape guarantee) → validate + repair regardless.
• Subagent (Claude Code) — a scoped worker with its own context window, system prompt, and tool policy.
• System prompt — the authoritative role/constraint channel, set via the system parameter; cache it.

T–X

• Token / token counting — a subword piece of Claude's own vocabulary (English ≈ ¾ word; code denser); count exactly and free with POST /v1/messages/count_tokens (same body as create, no generation), reuse the last usage, or estimate chars/4 for pre-flight — never tiktoken, never a model call.
• Temperature — sampling randomness; low for extraction/deterministic tasks, higher for ideation.
• Token — the billing and budget unit (~3–4 characters of English); everything is measured in it.
• Tool poisoning — malicious MCP tool descriptions/results carrying injected instructions; mitigated by vetting, pinning, least privilege.
• tool_choice — auto / any / forced specific tool / none; forcing a schema-tool is the structured-output move.
• Tool-use handshake — the model DECIDES and WRITES (tool_use is JSON it authored — a request, not an action); your code EXECUTES (the dispatcher is the only place a tool runs); tools/tool_choice travel you→API, tool_use API→you, tool_result you→API. The API executes only Anthropic-defined server tools.
• Tool registry — where the tool list lives: the Claude API stores nothing between calls (tools[] is resent per request, made cheap by prompt caching), so definitions live in your code (definitions + implementations side by side), a central catalog with per-agent allowlists, or MCP servers discovered at runtime.
• tool_use — the Claude API's signal that the model wants a tool executed: a stop_reason value AND content block(s) carrying the tool name, JSON input, and an id (e.g. toolu_01A) the Claude API generates; echo that id back as tool_use_id.
• tool_result — the harness's reply to a tool_use request, sent in a user-role message; must echo the Claude-API-generated id as tool_use_id (one result per request, matched by id); is_error: true reports failures the model can react to.
• Tools (MCP primitive) — model-controlled executable actions (= the model holds the INITIATIVE to invoke; the SERVER executes — the handshake never changes).
• Trust boundary — the line where code/data you control ends and something you don't begins; every guardrail sits on one (input → harness, model output → execution, tool results → model context).
• Trajectory evaluation — judging the agent's path (tools, order, gates) not just its final answer.
• Workflow — LLM steps orchestrated through predefined code paths; prefer over agents when the path is known.
• Worktree isolation — separate git worktrees so parallel agents can't collide on files.
• XML tags — the Anthropic-recommended delimiter convention for separating instructions, data, examples, and output sections; they guide the model strongly but are not a parser or security boundary.