Glossary: the field coined the vocabulary, the handbook coined four terms

Of the terms below, exactly four are the handbook's own: the four-transfer standard, the four-axis audit query, AI user, and human gate as a workflow primitive. Everything else was coined by practitioners under fire, in the Replit postmortem threads, the Cursor attribution fights, and the review-refusal posts, or by named authors (Simon Willison, Seth Larson, Anthropic). Where the corpus records a coiner, the entry credits them. Where it does not, it says so.

AI user. A distinct synthetic identity under which agent work runs, scoped to the human who initiated the task, so AI-authored and human-authored work are always distinguishable and always trace to a person. Handbook term; see Agent identity.

Approval fatigue. The attention decay that sets in when an agent asks permission dozens of times a day and engineers stop reading the prompts; the community names velocity pressure plus prompt fatigue as a systemic slide, not individual laziness. Named in a 2026 r/ExperiencedDevs thread titled "Race to the --dangerously-skip-permissions bottom". See Approval fatigue.

Approval machines. What senior engineers fear becoming as AI "changes the engineer's role from maker to judge." From a June 2026 r/ExperiencedDevs thread on role change under AI volume.

Assisted-by tag. The Linux kernel's commit trailer recording which model and analysis tools assisted a patch, paired with the rule that "no AI gets a Signed-off-by": humans sign, AI is annotated. Reported and debated in an April 2026 r/ExperiencedDevs thread (306 points).

Babysitting. Supervising an agent change by change because the system cannot be trusted unattended; the canonical usage is a senior engineer in the Copilot coding agent launch thread saying being "forced to babysit an AI in its PRs" would make him quit within a week.

Brain / hands / session. Anthropic's three abstractions for a managed agent system: the brain is the stateless reasoning loop, the hands are the sandbox where code runs and files change, and the session is an append-only event log stored durably outside both. From Scaling Managed Agents.

Co-authored-by trailer. The git commit trailer (Co-authored-by: Claude <[email protected]>) that marks AI participation in a commit; valued by reviewers for calibrating review, trivially stripped in settings, and now used as incident forensics. The Moonwell hack was reported as "a bug that was introduced in a commit that was co-authored by Claude. $2M got stolen" (r/ExperiencedDevs); the policy fight runs through r/git and beyond.

Credential brokering. Routing every credentialed call through a proxy so the agent never holds the secret, which also yields "an immutable record of every call made with each credential." Named as a pattern in Infisical's Agent Vault launch thread on HN.

Credential exfiltration. Agents being manipulated, typically via prompt injection, into leaking the credentials they need to operate. Stated as the motivating problem in the same Infisical thread.

Dead weight. Anthropic's term for harness code that encodes a limitation a newer model no longer has; their context resets for Claude Sonnet 4.5 "had become dead weight" on Opus 4.5. From Scaling Managed Agents.

Delegation chain. The GRC argument that the audit primitive for agents is not "did the agent have the credential" but "who authorized this agent to act in this context and was the action within the scope." From an April 2026 r/grc post arguing ISO 42001 and NIST AI RMF treat audit as a log of human actions.

Four-axis audit query. Handbook coinage: an audit trail only counts if it is queryable per task, per environment, per actor, and per time window, because an auditor's question is always "show me everything that touched X between these dates." See The four-axis audit query.

Four-transfer standard. Handbook coinage: a human takeover is seamless only when the branch, the environment, the conversation, and the process state all transfer, with no reconstruction of what the bot was doing. See The four-transfer standard.

Handcrafted. The 2026 inversion in which human-written code is the marked case; a boss told an engineer his code "looked handcrafted" as a mild pejorative (r/ExperiencedDevs).

Harness. The agent loop that calls the model and routes its tool calls: stateless, holding no customer code, reaching the execution environment through one tool call. The handbook's preferred term for what Anthropic calls the brain; see Brain / hands / session above and Brain and hands.

Human gate. A required human approval step that a workflow parks at: the change cannot advance without a real person acting, and the action is recorded. Handbook usage, built on Intercom's opt-out principle that "any engineer can request a human review on any change, at any time".

"If an agent has access, it has permission." The community's maxim that instructions in a prompt or CLAUDE.md are not access control; only infrastructure-enforced boundaries count. From the defining comment of the Replit incident thread: "Permissions aren't something you establish with an LLM by conversing with it."

Infinite junior engineers. The framing born in the Codex launch thread: "as if you have an infinite number of junior engineers at your disposal now all working on different things." It carried two immediate objections in the same thread: review overhead does not parallelize, and a field that stops hiring juniors stops producing seniors.

Intent-vs-effect gap. The hole in agent audit logs between what the agent says it decided and what actually changed: "the ai's reasoning log says 'decided to deploy' and the actual change log says 'deployed to prod' and nobody knows if those happened in the same millisecond." From a February 2026 r/devops thread on auditing agent actions.

Know Your Agent (KYA). A fintech-born framework requiring "named agents, bounded authorization, audit trail, one human on the hook for each agent in production." Surfaced to the broader community in an April 2026 r/ExperiencedDevs thread, whose author noted most non-fintech teams cannot answer its questions in under a minute.

Lethal trifecta. Simon Willison's name for the combination that makes an agent exploitable: access to private data, exposure to untrusted content, and the ability to communicate externally. Coined in June 2025. See The lethal trifecta.

RDE (Remote Developer Environment). Brex's per-task isolated workspace carrying the same toolchain its engineers use (CI, test runners, review bots), so the feedback loop closes without a human relaying logs. From Brex's autonomous agents.

Rubber-stamping. Approving PRs without genuinely reading them because AI volume outruns human review capacity; the sharpest formulation is an ops engineer's "human review seems like CYA... 'Why yes SOC2 auditor, we review all PRs'" in the Stage launch thread. The escalation point was a 1,560-point r/ExperiencedDevs post announcing refusal to review AI PRs at all.

Sandbox. The isolated execution environment where the model's generated code runs: Anthropic's hands. Provisioned per task and torn down after; see Brain / hands / session above and Sandboxing.

Shadow AI. The unapproved AI tooling that proliferates after a blanket ban; the standard argument for governed access over prohibition, as in regulated-org rollout threads on r/devops ("avoid the shadow AI problem that usually follows blanket bans").

Slop. Low-quality AI output produced faster than anyone can absorb it; in team contexts, specifically "unmergeable slop," the phrase a YC founder used to describe what happened when he rolled his personal agent workflow out to the rest of the team (Runtime launch thread). The term has since spread to commit messages and to AI-written forum posts.

Slopsquatting. Registering a package name that LLMs commonly hallucinate, so developers following AI-generated install instructions pull malware; the AI-era cousin of typosquatting. Coined by Python Software Foundation Developer-in-Residence Seth Larson and popularized by Andrew Nesbitt (Socket).

Vibe coding. Building software by conversational prompting without reading the code. The corpus does not record the coiner, but it records the drift: by mid-2025 it was a product category (Replit billed itself "the safest place for vibe coding"); by 2026 it is mostly pejorative in team contexts ("vibe-coded internal apps," "vibe-coded crypto protocol got hacked").

YOLO mode. Running an agent with all permission checks disabled: --dangerously-skip-permissions, --yolo, --trust-all-tools. The term hardened during the Nx s1ngularity thread, where the malware found victims' AI CLIs already running with exactly these flags.