AI Operations glossary

A complete, tamper-evident record of what an AI agent did and why: what it was asked, what data it used, which tools it called, what it decided, who approved it and how it ended.

Agent consumption pricing is a billing model where the vendor charges for agent activity (queries, completed tasks, tokens or credits) rather than per user or a fixed license.

The single layer where a company registers, authorises, watches and stops its AI agents. It doesn't do the work: it decides which agent may act, on which systems, with which permissions, and leaves an auditable trail of every session. If you can't switch an agent off from one place, you don't have a control plane. You have loose agents.

A repeatable set of cases with expected outcomes, run against an agent before and after every change. It measures whether the agent does the client's job, not whether it sounds good. It is what turns "seems to work" into a number you can defend.

Agent evaluations (evals) are systematic, repeatable tests that measure whether an agent does its job well: accuracy, safety, cost and behavior on hard cases. They are to an agent what tests are to software: without them you cannot tell whether a change improved it or broke it.

A bounded environment where an agent executes actions under explicit limits on filesystem, network, credentials and tooling. Not a promise in the prompt — a boundary the agent cannot cross even when asked to, even when it's wrong, even when someone has injected instructions into it.

The discipline of allocating, controlling and optimising what it costs to run agents — tokens, tool calls, retries, context — with the same rigour you apply to cloud spend.

An agent gateway is the control point through which an agent's calls to tools, data and other agents pass, where identity, permissions, limits and logging are enforced.

Agent governance is the set of policies, permissions, limits and audit that decides what an autonomous agent may do: which data and systems it can reach, which actions it executes on its own and which need human approval, and how everything is logged so it can be reviewed later.

Controls that run in real time over what goes into an agent, what comes out, and what it's allowed to touch: they block, redact or stop the action before it reaches a user or a system.

An agent harness is the software layer around an AI model that gives it tools, context, limits and traceability so it can act as an agent inside an organization.

A cryptographic, verifiable identity assigned to an AI agent (not a person) so other systems know who it is, what it is allowed to do, and for how long — without hardcoded keys.

A living register of every agent in production: what it does, who owns it, which systems and data it reaches, its autonomy level, which evals cover it and when it was last reviewed. If it isn't in the inventory, it shouldn't be running.

An agent inventory is the up-to-date register of the AI agents operating in an organization: what they are, who is accountable for them, which tools and data they touch and with which credentials.

An agent kill switch is the control that lets you immediately stop an AI agent's activity, usually by revoking its session or credentials.

Instrumentation that shows what an agent did and why: prompt, model response, tokens, tool calls, latency, cost and outcome for every step. Without it you cannot audit a decision, and you cannot tell whether the agent got worse this week.

The layer that decides which agent acts, in what order, with which tools and which data — and that owns retries, escalation and handoff to a human. It is not the model. It is the system that coordinates several agents and tools to finish a job end to end.

Agent orchestration is the coordination of several AI agents, systems and workflows so they run in the right order, share context and do not step on each other.

How many of your agents actually run live processes, divided by how many you've built. It's the number that separates an AI programme from a folder full of pilots.

A living inventory of every AI agent an organisation runs in production, with its owner, the process it operates, the systems it can reach, its autonomy level and the date of its last evaluation. This is an Implementa editorial formulation: we treat it as the first governance deliverable of any deployment.

The decision and the work of switching off an agent that no longer earns its keep: who signs it off, what happens to its permissions, its data and the process it ran. This is an Implementa editorial formulation, not an established industry term.

Agent runtime security is the set of controls that observe and limit what an agent does while it operates: which code and resources it uses, which actions it attempts and whether it respects guardrails.

A packaged unit of capability you install into an agent so it knows how to do one specific thing: instructions, tool access and sometimes code. It ships like a plug-in used to ship, and installs just as casually.

The set of third-party components an agent loads at runtime — skills, MCP servers, tools, instruction templates — and the chain of trust behind them. Installing a skill isn't installing a text file. It's handing someone else's code the permissions of the agent that loads it.

AI agents getting built, deployed and wired into systems faster than the company can inventory them, assign an owner, control their permissions and retire them once they stop earning their keep.

Every piece of third-party software your agent loads to get work done: skills, plug-ins, MCP servers, add-ons and connectors. You didn't write it, nobody signed it, and it runs with your agent's permissions.

Relabelling as an "AI agent" a product that isn't one: assistants, RPA or chatbots sold under a new name without real ability to plan, act and adapt. The term is Gartner's, which in June 2025 estimated only around 130 of the thousands of vendors marketing themselves as agentic actually are.

The function that coordinates several agents working across different processes: it balances load, resolves conflicts between them and decides which one acts when two could.

An open protocol that lets agents from different vendors discover each other, exchange messages and hand off tasks, instead of one bespoke integration per pair of agents.

Protecting goal-driven systems that act on their own: dynamic controls, continuous monitoring and adaptive access — because the attack surface is no longer the application, it's what the agent can do with its permissions.

Buying where the agent does the work -searching, comparing and increasingly paying- while the merchant is still the one who charges the card, confirms the order and handles the complaint.

Agentic commerce is buying and selling in which AI agents search, compare, or even decide and pay on behalf of a person or a company.

The emerging body of rules and standards on how law reaches an AI agent acting on its own: who answers for what it does, how much authority it can hold, and what evidence it must leave behind.

Agentic operations is a label several vendors use for running AI agents in production; it has no standard definition and its scope shifts by domain (network, Kubernetes, business).

An Implementa editorial distinction. «Agentic services» is what you sell: an outcome delivered by agents. «Agentic operations» is what you have to build inside to deliver it repeatably: registry, permissions, sandbox, measurement, owners. Confusing the two is why a brilliant pilot never turns into a business.

AgenticOps is a term popularized by Cisco for operations in which AI agents reason and act at machine speed, a step beyond classic AIOps that stops at alerts and recommendations. The idea: the agent does not just flag the problem, it resolves it within set limits.

AgentOps is the practice of managing the full lifecycle of AI agents once they move from prototype to production: deploying, observing, versioning, cost-controlling and governing them. It combines DevOps, MLOps, LLMOps and observability applied to agents that act, not just models that predict.

The EU obligation that a person knows, from the very first interaction, that they're talking to an AI system rather than a human. It applies expressly to AI agents and avatars. The «unless it's obvious» carve-out exists — and is to be read narrowly.

AI agent governance is the set of policies, controls and accountabilities that ensure autonomous agents act within defined limits: permissions, traceability (audit trail), human approvals, continuous evaluation and accountability. It answers who is accountable when an agent gets it wrong.

Independent verification that an AI system does what the organisation claims it does, and that it leaves enough evidence to defend it to a third party: auditor, regulator, customer or court.

A central team that concentrates AI judgement, standards and reuse for the rest of the organisation; it accelerates when it unblocks and slows things down when it becomes the desk everything must pass through.

The technical layer everything your company's AI does has to pass through: identity, permissions, policy, model routing and a record of every call. It isn't a dashboard to look at — it's the pipe execution runs through.

A single layer from which a company discovers, inventories, observes, governs, secures and measures every piece of AI it has deployed, whoever built it. It answers one question: what AI is running in here, who put it there, and what is it doing?

The discipline of getting an organization to actually adopt and use AI: training, internal playbooks, coordination with governance and measuring real usage. It answers the problem that the tool gets bought but nobody uses it: the brake is rarely the model, it's adoption.

The single point all traffic between your applications and the models passes through: it authenticates the caller, applies policy, meters spend and leaves a trail. It's the proxy layer for AI.

Function that sets and enforces the framework under which an organisation deploys AI: approval, documentation, risk assessment and ongoing supervision. Not the DPO, who protects personal data, nor the generalist Compliance Officer: its object is the AI system and its lifecycle.

The living record of which AI systems and agents are running in your company: for which process, over which data, with which permissions, who uses them and who answers for each one.

AI limbo is the state in which an organization already uses or announces AI agents but has not trained its people, assigned owners, or communicated how work will change.

The EU obligation that the people operating or using AI on your behalf actually understand it: what the system does, where it fails, what the law says and what your internal policy allows.

AI Operations is the function that actually keeps a company's AI running in production: deploying, governing, measuring and maintaining agents and models as working systems, not demos. At Implementa we treat it like operating any critical system: with an owner, metrics and accountability.

Un modelo en el que un proveedor externo asume la operación de la IA de una empresa —identificar casos, construir, gobernar y mantener agentes— como servicio gestionado, en lugar de que la empresa monte todo el equipo internamente.

The person accountable for a company AI systems still working after deployment: reliability, continuous evaluation, cost to operate and incident handling.

La persona responsable de un proceso de negocio operado con IA: decide qué se automatiza, valida la calidad, gobierna los agentes de ese proceso y responde por su resultado.

AI SRE is the use of AI agents to investigate incidents, propose or execute fixes and optimize costs in software systems, work traditionally done by a Site Reliability Engineering team.

AIOps (Artificial Intelligence for IT Operations) is the use of AI and machine learning to automate and improve IT operations: anomaly detection, event correlation, root-cause analysis and incident response. It is a legacy term focused on infrastructure, not business agents.

Two meanings the market mixes up because they share a name. AIOps (and its extension, Agentic AIOps) is operating IT infrastructure with AI: monitoring, detecting and autonomously resolving systems incidents. AI Operations is operating the business's AI function: orchestrating, supervising, evaluating, governing and scaling the agents and AI that do business work.

Fallo en el que todas las llamadas del agente devuelven exito y la latencia es normal, pero el resultado esta mal: eligio la rama equivocada, clasifico mal o ejecuto acciones validas en un orden inseguro.

Blast radius is the maximum damage an AI agent action can cause if it goes wrong: how many customers, systems or euros it reaches, and how costly it is to undo.

The share of cases an AI agent closes end to end without a human stepping in. Implementa uses this formulation — adapted from contact-centre practice — as the headline metric for whether an agent is actually doing work or just standing in front of the queue.

The practice of deciding what information lands in a model's context window at every step: system instructions, retrieved data, tool definitions, conversation history and memory. If prompt engineering works on the sentence, context engineering works on everything surrounding that sentence.

Total cost of closing a case end to end with an agent — tokens, tools, infrastructure and the human time still required — divided by the cases actually resolved. Escalated cases land in the cost denominator, not the success one.

El salto de una prueba de concepto de IA que funciona en demo a un sistema que la empresa opera de forma fiable, gobernada y medible en el día a día.

A pattern where the agent leaves the action ready in a state that has no effect and a person confirms it. Technically it writes, but nothing has happened yet.

An agent the company treats like someone on the payroll: it has a role, permissions, a human owner, a record and a performance review. Not a marketing metaphor — a change in how it gets governed.

ISCO-08 is the international classification of occupations; ESCO is the European classification built on top of it, mapping each occupation to exactly one ISCO-08 code. It is the glue that lets you assert a role in Spain and the same role in Germany are the same role.

La medición sistemática de la calidad de un agente antes y durante producción: si acierta, con qué fiabilidad, dónde falla y si mejora o empeora al cambiar algo.

Explainable AI is the set of practices that let a person understand why an AI system made a decision or took an action, instead of accepting it as a black box.

A technical profile embedded inside the client's team to take an AI use case from demo to a system running in production. Not a consultant, not an in-house developer: the bridge between a model that already works and an operation that still doesn't use it.

El conjunto de agentes de IA que una organización despliega para ejecutar trabajo, gestionados como una plantilla: con roles, responsabilidades, supervisión y métricas de desempeño.

An explicit ladder of agent permissions: suggest, execute with approval, execute and notify, execute silently. Each rung is earned with evidence — green evals, clean traces — and can be walked back the same day if quality slips.

Ultimately accountable for keeping deployed AI running in production, and for making sure someone answers when it stops. Defined by operational accountability rather than org-chart position: validates, releases, monitors, responds to incidents and iterates.

Human-in-the-loop (HITL) is the pattern where a person approves, corrects or supervises an agent's decisions before or during the action, instead of letting it act alone. It is the practical lever for giving an agent autonomy without giving up control.

Human-on-the-loop is the model where the agent acts on its own and a person supervises, able to intervene or stop it, instead of approving each action as in human-in-the-loop.

Malicious instructions hidden inside content the agent was going to read anyway -a web page, a PDF, a ticket, a database row- which the model then obeys as if the user had typed them.

Inference cost per workflow is what it costs in model consumption (tokens and calls) to complete one end-to-end run of an agentic workflow, rather than a single answer.

The discipline of translating regulatory text and legal judgement into logic an AI system can execute and verify, so the rule stops living in a document and starts living inside the agent.

The discipline of running language-model applications in production: versioning prompts and retrieval, evaluating output that is never the same twice, tracing every step and keeping the cost per token under control.

An open standard for connecting AI applications to external systems — data, tools and services — through a common interface instead of a bespoke integration per model-system pair. Anthropic introduced it in November 2024 and donated it in December 2025 to the Agentic AI Foundation, under the Linux Foundation.

The quiet decay of an AI system that used to get it right: the world shifts, the inputs shift, or the model underneath shifts, and quality drops without a single error being raised.

Model fallback is a mechanism where an agent automatically switches to another model when the primary one fails, is overloaded or exceeds a limit, so the task is not interrupted.

La forma en que una organización se estructura para operar la IA: roles y equipos, procesos de decisión, gobierno, presupuesto y cómo se reparte la responsabilidad entre negocio y tecnología.

A non-human identity is a credential or account that software (a service, script, pipeline or AI agent) uses, instead of a person, to access systems and data.

La capacidad de ver qué hace un agente en producción: sus pasos, herramientas invocadas, coste, latencia, errores y decisiones, para poder depurar, auditar y mejorar.

A model where the provider charges for work delivered or effect achieved, not for hours spent or per-seat licences. It is becoming the standard in AI services because the cost of repeatable work is collapsing.

The line separating an agent that only queries systems from one that leaves a record in them. It is the single variable that moves an agent project cost, timeline and approval count the most.

A record of why an agent did what it did: the steps it took, the data behind each decision and the alternatives it ruled out. Not a record of what happened, but of how it got there.

Runtime authorization is the check, at the exact moment an AI agent requests an action, of whether that specific action is allowed, rather than relying only on permissions granted in advance.

A failure where every agent call returns success and latency looks normal, yet the outcome is wrong: it took the wrong branch, misclassified, or executed valid actions in an unsafe order.

Employees using AI tools outside company-approved channels: no inventory, no data processing agreement, no audit trail. It's the AI version of shadow IT, and it usually appears not out of rebellion but because the official route is slower than the unofficial one.

Sovereign AI is an organization's ability to decide where its data, models and AI agents live and who can audit them, without depending on a third party it does not control.

An AI agent whose only job is to review what another agent does before the action ships: it checks the output against company policy, flags what is missing, and decides whether it passes, is blocked, or escalates to a person.

La proporción de un proceso, equipo o base de usuarios que realmente usa la solución de IA desplegada, frente a los que podrían usarla.

Registro de por que un agente hizo lo que hizo: los pasos que siguio, los datos que sostuvieron cada decision y las alternativas que descarto. No es el registro de que hizo, es el de como llego ahi.

The period during which an agent-executed action can be reversed at no cost. Outside that window the action stops being reversible and requires prior human confirmation.

Un flujo de trabajo en el que uno o varios agentes de IA toman decisiones y ejecutan acciones con herramientas para alcanzar un objetivo, en lugar de seguir pasos fijos predefinidos.

Zero standing privilege is the principle that no one, neither a person nor an AI agent, keeps privileged access by default: access is granted only when needed, for as long as needed and with justification.