arcane / glossary
AI agent control plane glossary.
These definitions describe the entities and control model Arcane uses for AI agents. Each term is written as a standalone answer and distinguishes discovery signals from verified evidence.
Core definitions
What language does Arcane use for agent control?
Arcane separates what was observed, what was verified, what was authorized, and what was spent. That separation keeps inventory, access decisions, audit evidence, and cost analysis precise.
- AI agent control plane
- A system that discovers acting agents, verifies identity, evaluates and enforces permissions, records decision evidence, and attributes execution cost across the tools and resources agents use.
- Related · Agent discovery · Continuous authorization · Decision record
- Agent discovery
- The process of building an inventory of active agents, versions, workloads, tasks, tools, and models from registrations, runtime evidence, and observed action boundaries. Discovery signals do not by themselves prove identity.
- Related · Agent identity · Workload identity
- Agent identity
- The verified identity of the software actor performing work. In Arcane, agent identity is evaluated with the delegating authority and attested workload rather than accepted from an agent's self-asserted name.
- Related · Workload identity · Delegated authority
- Workload identity
- Cryptographically verifiable evidence about the runtime executing an agent, such as an attested workload principal. It identifies where code is running; it does not replace the agent, user, or task context.
- Related · Agent identity · Composite principal
- Composite principal
- The effective actor assembled from the delegating user or system, registered agent, attested workload, and task context. Policy evaluates this composition instead of flattening every action into one service account.
- Related · Delegated authority · Agent identity
- Escalation decision
- A runtime outcome that grants no immediate access and opens a durable approval workflow for a precise exception. The target resource owner—not the requesting agent's operator—decides whether to issue the bounded, single-use authority.
- Related · Resource-owner consent · Policy review
- Policy review
- A human workflow for inspecting a proposed policy change or a routed escalation. Review is not itself runtime permission; an agent receives access only through an allow decision or a separately issued approved exception.
- Related · Escalation decision · Decision record
- Resource-owner consent
- An explicit permission from the policy authority responsible for a target resource. In Arcane's model, missing target-zone permission is not treated as an allow.
- Related · Two-sided policy · Subtractive authority
- Two-sided policy
- Joint evaluation of source-zone egress policy and target-zone ingress policy. The resulting record preserves each layer's verdict so the final decision can be explained.
- Related · Resource-owner consent · Decision record
- Decision record
- Structured evidence for an agent action that binds identity, delegated authority, task, requested action, policy versions, per-layer verdicts, approval state, enforcement result, usage, and cost.
- Related · Continuous authorization · AI task
- Task-bound credential
- A short-lived credential restricted to a specific task, audience, scope, and expiration. It reduces the standing authority and reuse risk associated with broad static credentials.
- Related · Delegated authority · Continuous authorization
- AI task
- A bounded objective pursued by an agent across one or more model calls, tool calls, retries, and handoffs. A task is the unit that connects authority, execution, outcome, token use, and spend.
- Related · Decision record · AI agent cost tracking
- AI agent cost tracking
- Attribution of provider usage and execution spend to the agent, task, model, team, delegating authority, and outcome that caused it rather than only to an aggregate provider invoice.
- Related · AI task · Cost per completed task
- Cost per completed task
- Total attributable execution cost divided by successfully completed comparable tasks. The metric should be interpreted beside quality and accuracy signals so cheap failed work is not mistaken for efficiency.
- Related · AI task · AI agent cost tracking
Interpretation
How do the terms fit together?
- 01
Discover
Inventory the agents and versions observed across registered and runtime boundaries.
- 02
Verify
Establish the agent, workload, and delegating authority from trusted evidence.
- 03
Decide
Evaluate the requested action against source and target policy with current task context.
- 04
Enforce
Apply allow, deny, or escalate before the action reaches the protected resource.
- 05
Explain
Preserve identity, policy, approval, enforcement, usage, and cost in one decision record.