Glossary

In short: forty-five terms used across the key, each defined in plain language first. They range from ownership ideas such as agent owner and shadow agent to protocol details such as ID-JAG, CIMD and SPIFFE. Each term page notes where it shows up in vendor material.

A2A protocol: The A2A protocol, Agent2Agent, is an open protocol for AI agents to discover each other, exchange tasks and return results.
agent identity: An agent identity is a distinct, verifiable identity given to an AI agent, separate from the person or service it works for.
agent owner: An agent owner is the named person accountable for an AI agent's access and behaviour.
agent registry: An agent registry is the inventory of every AI agent you run, with its owner, purpose, credentials, tools and status.
agent sponsor: An agent sponsor is Microsoft's term for the person responsible for an agent in Entra Agent ID.
agent-to-agent: Agent-to-agent describes one AI agent calling another to complete part of a task.
allow ask deny: Allow, ask and deny are the three outcomes of a per-action policy.
API key: An API key is a static secret string that grants access to an API.
audit trail: An audit trail is the record of what an agent did, for whom, under which policy and with whose approval.
blended identity: Blended identity is Aembit's term for an identity that combines the agent and the human it acts for.
CIBA: CIBA, Client-Initiated Backchannel Authentication, is an OpenID standard that lets an application ask a user to approve a request on a separate device.
CIMD: CIMD, Client ID Metadata Documents, lets an OAuth client identify itself with a URL that hosts its metadata, instead of registering in advance.
conditional access: Conditional access applies policy to a sign-in or token request based on signals such as identity, device, location and risk.
Cross App Access: Cross App Access, or XAA, lets an agent request app access for a user through the company's identity provider.
delegation chain: A delegation chain is the sequence of hand-offs from a person to an agent and then to further agents or tools.
DPoP: DPoP, Demonstrating Proof of Possession, binds an OAuth token to a key the client holds.
Dynamic Client Registration: Dynamic Client Registration is an OAuth mechanism that lets a client register itself with an authorization server at run time.
Enterprise-Managed Authorization: Enterprise-Managed Authorization is an MCP extension that lets a company's identity provider decide which MCP servers an agent may use for a user.
human in the loop: Human in the loop means a person reviews and approves an agent action before it takes effect.
ID-JAG: ID-JAG, the Identity Assertion Authorization Grant, is the token an identity provider issues in Cross App Access.
identity graph: An identity graph maps people, their accounts across systems, the agents they own and the access paths between them.
just-in-time access: Just-in-time access grants permission only at the moment a task needs it, and removes it when the task ends.
kill switch: A kill switch is a control that stops an agent, or all agents, from acting immediately.
MCP: MCP, the Model Context Protocol, is an open protocol for connecting AI agents to tools and data.
MCP authorization: MCP authorization is the part of the Model Context Protocol that defines how a client proves it may call an MCP server.
MCP gateway: An MCP gateway sits between agents and MCP servers so every tool call passes through it.
MCP server: An MCP server is a program that exposes tools, resources or prompts to AI agents over the Model Context Protocol.
mTLS: mTLS, mutual TLS, means both sides of a connection present certificates, so the server verifies the client as well as the reverse.
non-human identity: A non-human identity is an identity used by software rather than a person.
OAuth 2.1: OAuth 2.1 is a consolidation of OAuth 2.0 and its security best practices into one specification.
on-behalf-of: On-behalf-of describes an agent acting with a specific person's authority, such as a copilot sending email as its user.
per-call authorization: Per-call authorization means every tool call an agent makes is checked against policy at the moment it happens.
PKCE: PKCE means Proof Key for Code Exchange.
policy enforcement point: A policy enforcement point applies a decision to allow or stop a request.
secretless access: Secretless access means an agent reaches a resource without holding any stored secret.
service account: A service account is a non-human account used by an application to access systems.
shadow agent: A shadow agent is an AI agent running in your environment that security does not know about.
short-lived credential: A short-lived credential is an access token or certificate that expires after minutes or hours.
SPIFFE: SPIFFE, the Secure Production Identity Framework for Everyone, is an open standard for giving workloads cryptographic identities without stored secrets.
standing credential: A standing credential is a secret that stays valid until someone revokes it, such as a long-lived API key or password.
step-up authentication: Step-up authentication asks for stronger proof of identity before a sensitive action, even inside an existing session.
SVID: An SVID, SPIFFE Verifiable Identity Document, is the short-lived certificate or token that proves a workload's SPIFFE identity.
token exchange: Token exchange is an OAuth pattern where one token is traded for another with a different audience, scope or subject.
workload identity federation: Workload identity federation uses a platform identity to obtain credentials elsewhere without a stored key.
zero standing privilege: Zero standing privilege is the goal that no identity holds permanent access.