Glossary

An Agent Card is a machine-readable profile of an AI agent in the Agent2Agent protocol that describes its name, capabilities, address and supported authentication.

An agent mandate is a principal's signed, machine-readable authorization for an AI agent that defines which actions are allowed, to what extent and until when.

An agent passport is a signed credential about an AI agent's identity, usually with a bound key, that does not itself grant any authority.

The Agent Payments Protocol (AP2) is an open protocol by Google that secures payments by AI agents with signed mandates for intent, cart and payment.

The Agent2Agent protocol (A2A) is an open protocol through which AI agents from different vendors discover each other, hand over tasks and exchange results.

Agentic commerce refers to purchases and payments that an AI agent selects and carries out on behalf of a person or a company.

The Agentic Commerce Protocol (ACP) is an open specification by OpenAI and Stripe that describes checkout between an AI agent and an online shop.

An AI agent is a software system that uses a language model to pursue goals and carries out actions on its own to reach them, such as buying, booking or filing applications.

Authority to act is the power to bind another person through legal acts in their name; for AI agents, it defines what an agent may commit its principal to.

A blanket authority is a mandate without a defined scope that allows an agent any action and therefore cannot be meaningfully verified.

Canonicalization brings data into a unique, defined representation so hashes and signatures always come out the same regardless of formatting; for JSON, RFC 8785 describes the JSON Canonicalization Scheme (JCS).

A confused deputy is a program with far-reaching rights that a less privileged party tricks into using those rights in its favor.

A Decentralized Identifier (DID) is an identifier following a W3C standard that points to a document with public keys and works without a central registry.

A decision token is a verifying party's signed record that a specific agent action was allowed, denied or escalated before execution.

A delegation chain is the sequence of signed transfers through which an authority passes from the principal via intermediate steps to the acting agent.

DPoP (Demonstrating Proof of Possession) under RFC 9449 binds an OAuth token to a client key, so a stolen token cannot be used without the matching private key.

eIDAS 2.0 is the revised EU regulation on electronic identification and trust services, which among other things introduces the EUDI wallet.

An electronic seal is the electronic signature of an organization rather than a person; it proves the origin and integrity of data issued by a company or authority.

The EUDI wallet is the European digital identity wallet that all EU states must offer their citizens under eIDAS 2.0.

An evidence pack bundles mandate, decision, receipts, status lists and timestamps into one file whose content is protected against change by a manifest.

An execution receipt is the entry that records, after an agent action, what was executed and references the related decision and mandate.

Fail-closed means a system denies when in doubt: if information is missing or a check fails, the action is not executed.

Guardrails are protective mechanisms around a language model that filter inputs and outputs, such as harmful content, confidential data or topics outside the intended use.

HTTP Message Signatures are an IETF standard (RFC 9421) that lets senders sign selected parts of an HTTP message so that recipients can verify its origin and integrity.

Human in the loop describes an approach in which a person reviews certain actions of an AI agent before execution and approves or rejects them.

ID Austria is Austria's government electronic proof of identity, with which people can identify online and create qualified electronic signatures.

A JWKS (JSON Web Key Set) is a list of public keys in JSON format following RFC 7517 that verifying parties use to check an issuer's signatures.

Key binding is proof that whoever presents a credential holds the private key bound to it.

Know Your Agent (KYA) is the verification of whether an AI agent was authorized for a specific action – with evidence third parties can recompute independently.

Know Your Business (KYB) is the verification of companies as business partners: their existence, owners, beneficial owners and persons authorized to represent them.

Least privilege is the principle of giving an agent only the rights it needs for a specific task, and only for as long as it needs them.

The Model Context Protocol (MCP) is an open protocol through which AI applications connect tools, data and services in a uniform way.

Mutual TLS (mTLS) is a TLS connection in which the client also identifies itself with a certificate; RFC 8705 uses this to authenticate OAuth clients and bind tokens to their certificate.

Network tokenization replaces the card number with a token from the card network that applies only to a specific merchant, device or agent and requires its own cryptogram for every payment.

OAuth 2.1 is a consolidation of OAuth 2.0 being developed in the IETF that makes proven security rules mandatory and removes insecure flows such as the implicit grant.

OAuth Token Exchange under RFC 8693 is a procedure in which a service exchanges an existing token for a new one, for example to continue working on behalf of a user or as that user's representative.

OpenID Federation is a specification by the OpenID Foundation with which organizations prove, through signed trust chains, that an issuer or service belongs to a trusted federation.

OpenID for Verifiable Presentations (OID4VP) is a protocol by the OpenID Foundation in which a verifying party requests credentials from a wallet and the wallet presents them.

Passkeys are password-free credentials based on asymmetric cryptography following the FIDO and WebAuthn standards and bound to a specific website.

A payment initiation service triggers a payment directly from a customer's bank account on her behalf; in the EU, it is a regulated payment service under the Payment Services Directive PSD2.

A policy decision point (PDP) is the component that decides, based on rules, whether a requested action is allowed; a policy enforcement point (PEP) enforces that decision.

The principal is the natural or legal person on whose behalf an AI agent acts and who granted it the mandate.

Prompt injection is an attack in which hidden instructions in texts, websites or documents make a language model do something other than intended.

A qualified electronic signature (QES) is an electronic signature with a qualified certificate from a recognized provider that is legally equivalent to a handwritten signature.

A qualified timestamp is an electronic timestamp from a recognized trust service for which the law presumes the accuracy of time and the integrity of the data.

A receipt chain is a sequence of execution receipts in which every entry contains its predecessor's hash, so that any change or gap breaks the chain.

A replay attack is an attempt to resubmit an intercepted, valid message or credential in order to trigger an action a second time or at a different recipient.

Rich Authorization Requests (RAR) are an OAuth extension defined in RFC 9396 that lets a client request fine-grained permissions as structured details instead of plain scopes.

SD-JWT VC is an IETF format for verifiable credentials in which the issuer signs hashes and the holder selectively discloses individual claims.

Selective disclosure means revealing only the details of a signed credential that a verification needs, without breaking the signature.

A status list is an issuer-signed, compressed bit list that indicates for every issued credential whether it is valid, revoked or suspended.

Strong customer authentication (SCA) is the obligation under the EU Payment Services Directive PSD2 to confirm electronic payments with two independent factors from knowledge, possession and inherence.

The e-ID is Switzerland's government electronic proof of identity, which people keep in the swiyu wallet app and present selectively.

An RFC 3161 timestamp is a timestamp authority's signed confirmation that a specific hash existed at a specific time.

Tool poisoning is an attack in which hidden instructions in a tool's description or responses lead an AI agent into unwanted actions.

A trust anchor is a certificate or key that the verifying party explicitly trusts and to which other certificates must be traceable.

The Trusted Agent Protocol is an approach by Visa in which AI agents identify themselves to merchants with signed requests and pass on details about the customer and payment.

Verifiable Intent is an open format by Mastercard in which a user signs the limits of an agent purchase and the agent provably binds the final values to them.

A verifier is the point in a flow where an agent action is checked against the mandate before execution, for example a gateway in front of a tool.

The verifying party is the party that verifies agent evidence and decides which issuers and timestamp authorities it trusts.

W3C Verifiable Credentials 2.0 is a data model by the World Wide Web Consortium for digital credentials that an issuer signs and a holder presents to verifying parties.

Web Bot Auth is an approach in which bots and AI agents sign their HTTP requests cryptographically so that websites can reliably recognize the operator.

A workload identity is a cryptographically proven identity for software rather than people; SPIFFE is an open standard for it, with short-lived identity documents for services, containers and agents.

An X.509 certificate is a signed data structure following RFC 5280 that links a public key with an identity and is issued by a certificate authority.

Zero trust is a security model that trusts no request on the basis of its network location alone but checks every request individually based on identity, context and rules.