The vocabulary
Every term you’ve been hearing, in plain English
Our industry generates jargon faster than it generates working software. Here is what the current vocabulary actually means, and whether it matters for you.
If a vendor uses one of these words without being able to explain it this plainly, that tells you something. And we aren’t going to pretend every one of them belongs in your project. Most businesses need two or three, and are being sold all of it.
AI and agents
- Agentic AI
- Software that pursues a goal on its own: decides what to do next, uses tools, and keeps going until the job is done or it needs you.
- AI agent
- One of those, scoped to a job. "Read new invoices, match them to purchase orders, flag the ones that don’t line up."
- Multi-agent orchestration
- Several agents with different jobs working together, usually with one supervising the rest. Useful less often than it’s sold.
- Subagent
- A narrow agent another agent calls for one specific task, so the main one keeps its attention on the goal.
- MCP
- Model Context Protocol. The standard way to let an AI use your systems as tools, so you write the connection once instead of once per AI assistant.
- Tool calling
- The model asking your software to do something real: look up an order, send an email, run a query. Where AI stops being a chat window.
- RAG
- Retrieval augmented generation. Look up the relevant facts from your own data first, then let the model answer using them. What stops it inventing things.
- Context engineering
- Deciding exactly what the model sees, from where, and in what order. The single biggest lever on whether an AI feature works.
- Context window
- How much the model can hold in mind at once. Bigger isn’t free: more context often means slower, dearer and less accurate.
- Evals
- Tests for AI. A scored set of real examples you run on every change, so you learn a prompt edit broke something before a customer does.
- LLM as judge
- Using one model to grade another model output at scale. Cheaper than humans, and needs checking against humans to stay honest.
- Guardrails
- Hard limits on what the AI may do or say, enforced in code rather than requested in a prompt.
- Prompt injection
- An attack where text the AI reads contains instructions it then obeys. The main security problem in AI features, and the most ignored.
- Human in the loop
- A person confirms before anything irreversible happens. Non negotiable for anything that spends money or contacts a customer.
- Structured output
- Making the model return strict JSON your code can rely on, instead of prose you’ve to parse and hope.
- Fine tuning
- Training a model further on your data. Usually the wrong first move: better retrieval and better prompts fix most problems for far less.
- Model routing
- Sending easy work to a small cheap model and hard work to a large one, with a fallback when a provider goes down.
- Small language model
- A compact model that runs cheaply, sometimes on device. Plenty for classification, extraction and routing.
- Multimodal
- Handles images, audio and video as well as text. Reading a photographed delivery note, for example.
- Embeddings
- Turning text into numbers so a computer can find things that mean the same thing rather than matching the same words.
- Vector search
- Searching those numbers. What makes "when does my cover lapse" find a document that says "policy expiry".
- Hybrid search
- Keyword search and vector search together. Almost always beats either alone, and almost always what you actually want.
- Token budget
- What an AI feature costs per run, controlled deliberately. The difference between a feature and a bill nobody predicted.
- Tracing
- A record of what the AI was asked, what it retrieved, what it decided and what it cost. Without it you can’t debug any of it.
- Agentic coding
- Using AI agents to do real development work under review, not autocomplete. How a small studio ships at the pace of a larger one.
- Vibe coding
- Prompting an app into existence without a spec. Fine for a prototype. It’s how you end up with software that demos well and collapses in production.
Data and plumbing
- Event driven
- Things react to something happening rather than checking every few minutes. Faster, cheaper, and easier to reason about.
- Webhooks
- One system telling yours the moment something changes, instead of yours asking over and over.
- ETL and ELT
- Moving data between systems and reshaping it on the way. Unglamorous, and where most integration projects actually go wrong.
- Real time sync
- Two systems agreeing continuously rather than at midnight. Only worth the cost when a stale number causes a real problem.
- Idempotency
- Doing the same operation twice has the same effect as doing it once. What stops a retried payment charging a customer twice.
- Queue
- Work parked in a line to be done reliably, so a slow task never blocks the person waiting on the screen.
- API first
- Building the interface other software uses before the screens, so anything can be automated later without a rewrite.
- Headless
- The system that holds the data is separate from what people see, so you can change the front without touching the back.
- Composable commerce
- Assembling a store from separate best in class pieces instead of one platform doing everything adequately.
- Serverless
- Code that runs on demand with no server to maintain. Cheap at low volume, and the default for most of what we build.
- Edge
- Running code physically near the person using it, so the page is fast in Sydney as well as in Las Vegas.
- Offline first
- The app keeps working with no signal and catches up later. Essential for anyone working in a basement, a warehouse or a truck.
Trust and security
- Card testing
- Someone with a list of stolen card numbers runs small orders through an online checkout to find the ones that still work. The store gets the refunds, and the card fee on each one stays gone. Also called carding.
- Checkout validation
- Shopify’s way of letting an app check a checkout at the payment step and refuse it before any charge. The only point where a card-testing bot can be stopped for free.
- Bait product
- A product no real shopper is meant to see or buy, put in a store so that any checkout containing it is refused. A trap for bots, sometimes called a honeypot.
- Zero trust
- Nothing is trusted because of where it sits on the network. Every request proves who it’s, every time.
- Row level security
- The database itself refuses to hand one customer another customer data, even if the application code has a bug.
- Least privilege
- Everyone and everything gets the minimum access needed, and loses it when they no longer need it.
- Passkeys
- Signing in with a face, a fingerprint or a device instead of a password. Phishing resistant, and now supported everywhere that matters.
- SSO
- One company login across every tool. What enterprise buyers ask for before they will sign.
- SOC 2
- An audited report on how a company handles security. We don’t have one, and we say so rather than implying it.
- PII
- Personal information. The thing that turns a bug into a notifiable breach, so it’s worth knowing exactly where yours lives.
- Data residency
- Which country your data physically sits in. It matters more than most people expect, and only after you’re already committed.
- Audit trail
- Who changed what, when, and what it was before. The first thing anyone asks for when something has gone wrong.
- WCAG 2.2 AA
- The accessibility standard we build to. Keyboard access, contrast, labeling, text scaling. Also the standard procurement checks.
Being found
- Map results
- The three local businesses Google shows on a small map above the normal results. Most people pick one of those three and never scroll.
- AEO
- Answer engine optimization. Being the source an AI assistant quotes when somebody asks it a question in your industry.
- GEO
- Generative engine optimization. Same idea, different acronym, and the two are used interchangeably in practice.
- llms.txt
- A plain text file telling AI assistants what a site contains and which pages matter. This site has one.
- Structured data
- Machine readable facts about a page, so search engines and assistants know what they’re looking at rather than guessing.
- Core Web Vitals
- Google measurements of how fast and stable a page feels. Static pages, self hosted fonts and sized images cover most of it.
- Static generation
- Building pages ahead of time so they’re files, not database queries. The reason every page on this site loads instantly.
Where to start
Being sold something you can’t get explained?
Tell us what you were quoted and what it was meant to fix. We will tell you plainly whether you need it, and if you don’t, we will say that instead.