Resources

Glossary

Alphabetical reference of key terms used throughout the Tragentics platform. Each term links to the concept as it appears in documentation and the product interface.

A

A2A

Agent-to-Agent. An open protocol for communication and interoperability between AI agents built on different frameworks or by different vendors. Tragentics exposes a protocol relay surface for A2A: it accepts A2A-native requests and forwards them to the agent's endpoint with credential injection, routing the traffic content-blind without speaking the protocol itself.

ACP

Agent Communication Protocol. A metadata standard that enriches agent cards with structured capability declarations, authentication requirements, and provider information. In the live product, the main discovery workflow is exposed through the Protocols page capability schema, while supporting profile metadata is still edited from registration and the Settings tab.

Admin role

The organization owner — one person with full control over members, settings, SSO, resources, and transfer of the admin role. The admin is the account owner whose personal view already shows everything they own, so admins never context-switch into their own organization. Every organization has exactly one admin.

AES-256-GCM

The authenticated-encryption standard Tragentics uses to encrypt agent credentials and endpoint URLs at rest. AES-256 provides the encryption; GCM (Galois/Counter Mode) adds an integrity check, so tampering with the stored ciphertext is detectable.

Agent

A registered AI agent on the Tragentics platform. Each agent has a permanent ID, an endpoint URL pointing to an external API, optional credentials, and configurable capabilities. Agents can be posted to the board, connected to other agents, and organized into networks.

Agent Board

The public town square where agents are listed for discovery by other users. Agents must be explicitly posted to appear on the board. The board supports search, filtering, comparison, and direct connection.

Agent Card

A structured JSON document describing an agent's capabilities, protocols, and metadata. Agent cards are generated automatically from the agent's configuration and served through protocol discovery endpoints. Each protocol has its own card format.

Agent Pool

A routing structure with one orchestrator agent and ordered member agents. Each pool call selects a single member using the pool's strategy — round-robin, failover, or random — skipping unavailable members and trying a member's fallback before advancing. Pools provide load balancing and redundancy.

Agent status

A registered agent's live availability, shown as one of three states: online (endpoint reachable, with runtime activity in the last 15 minutes), idle (reachable but no recent activity — still available), or offline (unreachable, timed out, failed a probe, or otherwise not available for runtime use). Status is derived from three signals — heartbeat, successful proxy activity, and the scheduled health check — and offline targets are rejected by relay routes unless a fallback is configured.

AI agent security

The practice of protecting AI agents — autonomous systems that use large language models to reason, use tools, and act toward a goal — from the risks their autonomy creates. It spans two planes: what an agent decides and does (the behavior plane) and the identity, credentials, and connections it depends on (the infrastructure plane). Tragentics operates on the infrastructure plane.

ANP

Agent Network Protocol. An open protocol for decentralized agent discovery and secure communication across networks. Tragentics exposes a protocol relay surface for ANP: it accepts ANP-native requests and forwards them to the agent's endpoint with credential injection, routing the traffic content-blind without speaking the protocol itself.

API Key (Tragentics)

A Bearer token prefixed with tk_ used to authenticate an agent's requests to Tragentics — proxy calls, heartbeats, and async jobs. Generated exactly once at agent registration and shown once; only a hash is stored, there is no rotation, and a lost token can only be replaced by deleting the agent and registering a new one. Passed in the Authorization header.

Async Job

A long-running proxy call that returns immediately with a job ID. The caller polls a status URL to check for completion and retrieve the result. Used for tasks that exceed the synchronous timeout.

B

Behavior plane

The half of AI agent security concerned with what an agent decides and says: its prompts, memory, tool choices, and outputs. Securing it requires inspecting content — prompt-injection defense, runtime monitoring — the opposite requirement of the infrastructure plane, since content-blind and behavior-inspecting cannot coexist in one layer. Tragentics does not operate on this plane; the two are complementary.

Broadcast Group

A network entity that sends the same request to all member agents simultaneously and collects their responses. Used for fan-out scenarios where multiple agents should process the same input.

C

Canvas

The visual topology manager built on React Flow. Canvas provides a drag-and-drop interface for viewing and managing network members, connections, schedules, pools, and broadcast groups within a network.

Capability schema

The structured, discovery-facing description of an agent — models, task categories, input/output formats, tags, permitted message types, and a declared rate limit — edited on the Capabilities view of the Protocols page. Tragentics uses it to generate the agent's protocol cards, capability descriptions, and discovery summaries. It describes the agent for discovery; it does not govern how calls are routed.

Connection

A link between two agents that enables one to call the other through the proxy. Board connections are created through the Agent Board. Private connections are created within networks using the agent connection system.

Content-blind relay

The authenticating transport at the center of Tragentics. Before forwarding a call, the relay authenticates the caller at a trust level you set per agent — from a secure-by-default floor up to per-call Ed25519 identity — then injects the target's credentials, forwards the call, and records it, routing the traffic without ever reading, storing, or executing the payload. It is content-blind: it moves what an agent sends without inspecting it — the road the call travels, not a reader of the message.

Context switching

A member moving between their personal view and an organization view. Context is not cosmetic — it drives the authorization model, resolving which agents, networks, analytics, and operations a member can read and mutate, combined with their permissions and access scope. Admins never context-switch into their own organizations; their personal view already shows everything they own, so context switching is a members-only concept.

Credential Injection

The process by which the proxy attaches an agent's endpoint API key to the forwarded request. Credentials are decrypted server-side and injected into the Authorization header. The calling agent never sees the target agent's credentials.

Credential Vault

The encrypted store that holds an agent's credentials so the agent never holds them itself. Keys are encrypted at rest with AES-256-GCM and injected into a call server-side, at the moment it is forwarded, so a calling agent never sees the credentials it uses.

D

DID

Decentralized Identifier. A W3C standard for a globally unique, verifiable digital identifier that does not depend on a centralized registry. A DID resolves to a DID document listing the public keys and service endpoints used to verify control of the identifier. Tragentics generates a DID document for each agent and serves it through a discovery endpoint, giving the agent a portable, verifiable identity.

E

Ed25519

The public-key signature scheme behind optional mutual agent identity authentication. An agent holds an Ed25519 key pair, and the platform verifies a per-call signature to confirm a caller is the agent it claims to be.

Endpoint API Key

The API key for the external service your agent points to (e.g., an OpenAI API key). Stored encrypted at rest (AES-256-GCM) and injected into proxy requests via credential injection. Never exposed to callers.

Endpoint URL

The URL of the external API your agent wraps. All proxy and relay calls are forwarded to this URL. Stored encrypted at rest. Can be overridden on a per-protocol basis using protocol endpoint URL overrides.

External invocation

An opt-in setting, per protocol, that lets systems outside Tragentics call an agent directly through its protocol relay endpoints without a Tragentics account or Bearer token. When enabled, the relay accepts unauthenticated, protocol-native requests and still injects the target's credentials server-side; when disabled, those endpoints reject unauthenticated calls with a 403. External relay traffic is rate-limited per agent, per protocol, per IP.

External membership

A relationship in which your agent participates in a pool, broadcast, or schedule owned by another user. It is created when you accept that user's invite; your agent then receives calls from their orchestrator, but you keep unilateral control and can leave at any time without their approval. Contrast with your own groups, where you are the orchestrator.

F

Fallback Agent

A single backup agent configured per agent — not per connection — from the Settings tab. When a proxy call targets an offline agent, the proxy checks that agent's fallback: if it is active, unarchived, and has a valid endpoint for the requested protocol lane, the call is transparently rerouted and the response carries an x-tragentics-fallback header.

G

Group Invite

An invitation for another user's agent to become a member of your broadcast group or agent pool, sent by permanent ID from the Broadcast or Pools tab. The agent's owner must accept before the agent starts receiving group calls, and the member can leave unilaterally at any time.

H

Health check

The platform's background job that keeps agent status current. It runs two staleness sweeps — moving an agent from online to idle after 15 minutes without activity, and to offline after 12 hours — plus a rotating endpoint probe that can recover an offline agent back to idle when its endpoint responds again.

Heartbeat

A signal that updates an agent's liveness status. Agents can send heartbeats explicitly via the heartbeat API using their agent token, or status updates automatically when successful proxy calls flow through the platform. The platform's scheduled health check also probes endpoints and applies staleness sweeps (online → idle after 15 minutes of inactivity, idle or online → offline after 12 hours). Current status is shown as a colored dot on the board and agent management pages. Agents in an offline state are rejected by relay routes.

I

Infrastructure plane

The half of AI agent security concerned with what an agent is and touches: its identity, its credentials, the transport its calls travel over, and the audit record of what it did. It secures the agent at the system level, not the model level, and never reads the content an agent sends. Tragentics is the integrated, content-blind platform for this plane.

M

MCP

Model Context Protocol. An open standard for connecting AI models and agents to external tools, data sources, and context. Tragentics exposes a protocol relay surface for MCP: it accepts MCP-native requests and forwards them to the agent's endpoint with credential injection, routing the traffic content-blind without speaking the protocol itself.

Member role

An invited user who operates inside an organization under delegated permissions and a defined access scope, not org-wide control. A member is a different person from the admin; they context-switch into the organization to work under its scoped visibility, and can leave at any time from their own settings. Members do not manage organization-wide settings unless explicitly granted the permission.

Metadata-only audit trail

What Tragentics records for every call: caller and target identity, timestamp, status, latency, request and response sizes, and authorization decisions — without storing the payload itself. The trail proves what happened without retaining what was said; it records the envelope, never the contents.

Mutual authentication

An optional mode in which both ends of a connection prove their identity, not just the caller. Built on Ed25519 key pairs and per-call signatures, it lets a target agent verify that a caller is the specific agent it claims to be before the call is forwarded. Also called agent identity authentication, or mutual trust.

N

Network

A container for organizing agents, connections, schedules, pools, and broadcast groups. Networks provide private topology management for complex multi-agent systems. Managed through the Networks page and Canvas.

O

OAuth2 credentials

A credential mode in which Tragentics exchanges an agent's stored OAuth2 client credentials for a short-lived access token at call time (just-in-time), caches it in memory, and injects it into the forwarded request. The long-lived secret stays in the Credential Vault and is never exposed to callers.

OpenAI Responses

OpenAI's Responses API — an interface for building agentic applications on OpenAI models with built-in tool use and stateful interactions. Tragentics exposes a protocol relay surface for OpenAI Responses: it accepts Responses-native requests and forwards them to the agent's endpoint with credential injection, routing the traffic content-blind without speaking the protocol itself.

Orchestrator

A regular agent that owns a broadcast group or pool — there is no special mode or designation. The orchestrator's own running code decides when to call the group; its token authenticates the call, and the platform fans out (broadcast) or selects one member (pool). Schedules use the same ownership model, but the platform's cron performs the timed dispatch.

Organization

A team-governance boundary around a set of Tragentics resources. One admin groups agents, networks, schedules, pools, broadcasts, and logs under a single operating boundary and invites members into it with scoped permissions. An organization does not replace the account owner — ownership stays attached to the admin account; the organization adds a team layer on top. Business tier includes one; additional organizations are an add-on.

P

Payload size limit

A 1 MB cap on request bodies for the relay lanes that buffer the payload in memory — broadcast, pool, async, webhook-trigger, and agent-to-app calls — where a copy is needed to fan out, retry, or deliver after the caller disconnects. Requests over the limit are rejected with HTTP 413 before being forwarded, and broadcast member responses are individually capped at 1 MB. Streaming lanes (sync connections and the protocol relays) pass the body through without buffering, so the limit does not apply to them; schedule payload templates are held to the same cap when saved.

Permanent ID

A unique, immutable identifier assigned to each agent at registration. Format: agt- followed by a random string. Used in API routes, discovery endpoints, and audit logs. Never changes, even if the agent is renamed.

Permissions and access scopes

The two separate controls that govern a member. Feature permissions decide what a member can do — toggleable capabilities across Agent Management, Analytics, Protocols, Networks & Canvas, Operations, and Security. Access scope decides what a member can see — all agents, specific networks, or specific agents. Both are set per member, and access scope is required, never assumed.

Private Connection

A connection between two agents within the same network, managed through the agent connection system. Private connections are not visible on the public board.

Private Group

A named cluster of private connections inside a network — purely organizational. Every private connection belongs to exactly one group; groups are created automatically from the group name given at connection creation and have no effect on routing, permissions, or proxy behavior. Deleting a group deletes the connections inside it.

Private Invite

An invitation that creates a cross-account private connection. The sender targets the recipient agent by its permanent ID; the recipient's owner accepts, declines, or blocks it. Private invites expire after 1 hour, with at most 3 attempts per rolling hour — there are no invite codes.

Protocol Relay

The set of endpoints that accept protocol-native requests (ACP, A2A, MCP, OpenAI, ANP) from external callers and forward them to the agent's endpoint with credential injection. Does not require Tragentics authentication when external invocation is enabled.

Proxy

The Tragentics intermediary that forwards authenticated API calls from one agent to another. The proxy handles credential injection, protocol routing, fallback logic, rate limiting, and audit logging. Four proxy types: sync, async, broadcast, and pool.

R

Rate limiting

Tragentics' layered request throttling, rather than one flat limit. Separate caps govern authenticated session API traffic (150/min per user), internal runtime calls from registered agents (80/min per calling agent + IP, plus a per-account ceiling of max(180, active agents × 60)), public protocol relay (10/min default, up to 100, per agent per protocol per IP), and public discovery (60/min default, up to 200, per IP). Broadcasts are charged per member, and an exceeded limit returns HTTP 429 with a Retry-After header.

Replay protection

A safeguard on signed agent calls that prevents a previously valid, captured request from being re-sent and accepted a second time. Part of Tragentics' Ed25519 authentication.

Reputation badge

A tier automatically assigned to a public board agent from its accumulated user reviews (1–5 stars). The four tiers are Copper (starting tier for a newly posted agent), Silver (earned with positive reviews), Gold (a strong review history and high average rating), and Platinum (the highest tier, an exceptional record across many reviews). Badges are public on the board.

S

Schedule

A timed trigger within a network that automatically sends proxy calls at configured intervals. Schedules support cron-like expressions and can be paused, resumed, or deleted from the Canvas or Networks page.

Secret detection

A safeguard that scans an agent's free-text fields — name, description, service description, and documentation — when it is registered or updated, and rejects the request if it finds a pasted API key pattern (OpenAI, Anthropic, AWS, GitHub, Google, or Stripe formats). It keeps credentials from being accidentally exposed in fields never meant to hold them.

Server-side injection

The mechanism by which credentials are attached to a call inside Tragentics' servers — decrypted from the Credential Vault and placed into the outbound request at the moment it is forwarded — rather than by the calling agent. Plaintext exists only in server memory, for the duration of a single request.

SSO

Organization-level SAML single sign-on, letting members on a verified company domain sign in through their identity provider instead of local email-and-password. It is configured per organization by the admin (company domain plus IdP metadata URL) and is offered as an add-on rather than a default. On the infrastructure side it depends on the deployed auth stack supporting SAML.

Sub-agent

An agent within a network that receives work from the orchestrator or other agents. Sub-agents handle specific tasks as part of a larger workflow coordinated by the network topology.

T

Time-scoped credentials

A restriction that limits when an agent can be called — for example, to business hours or a scheduled window. Outside the allowed window the relay declines to inject the credential and the call is refused.

Trace

The metadata record of a single proxy call, keyed by a unique trace ID assigned to every call. A trace captures caller and target identity, HTTP status, latency, request and response sizes, connection source (direct, schedule, pool, or broadcast), and any error — but not the payload. The Trace explorer is the analytics view for searching traces by ID, filtering by protocol or status, and expanding a call to see its full recorded metadata.

Tragentic

(adj.) Of or relating to the agentic infrastructure plane — the infrastructure of AI agent security. Coined from Targeted Routing, Agentic, and Security.

Tragentic infrastructure

The infrastructure plane of AI agent security: the system-level, content-blind relay that gives every agent an identity, injects its credentials from a Credential Vault so it never holds them, routes every call without reading it, and records a metadata-only audit trail. Tragentics is the integrated platform for this layer.

V

Version history

An automatic record of an agent's version changes. The version field is a free-form string on the Settings tab; when you change and save it, a database trigger appends the previous value and a timestamp to a history that keeps the last five entries. It is informational only — the proxy never routes or enforces calls based on version.

W

Webhook signing

The HMAC-SHA256 signature Tragentics attaches to every platform event it delivers to an agent's webhook URL, carried in an X-Tragentics-Signature header. Verifying it confirms the event genuinely came from Tragentics and was not tampered with in transit.

Webhook URL

An optional URL where Tragentics sends platform events — connection established, connection severed, agent status changes. Only custom agent servers typically set this. Unlike the endpoint URL, the webhook URL receives platform events, not proxied API calls.

Z

Zero trust

The security principle of never trusting an agent by default and verifying every connection — assume breach. It exists because the network perimeter agents once sat behind is gone: an agent reaches internal systems and external APIs at once, a boundary a perimeter cannot define. Tragentics applies zero trust as a per-agent dial rather than an all-or-nothing switch: every agent starts on a secure-by-default floor (Credential Vault, content-blind relay, tenant isolation, instant revocation, live rate limits) and can be turned up to full zero trust with per-call Ed25519 identity, where a stolen token proves nothing.

Next

For technical details on how proxy routes behave, see Proxy route behavior →