Glossary of AI, email and product analytics terms

Agents and tools

AI agent

A model that decides its next step itself, calls tools and repeats until the task is done.

Agentic loop

The cycle of model call, tool call and result that an agent repeats until it stops.

Tool use (function calling)

The model returns a structured request to run a function you defined; your code runs it.

MCP (Model Context Protocol)

An open protocol for plugging tools and data into AI apps: write a server once, use it from any client.

Agent Skills

Folders with instructions, scripts and references that an agent loads only when the task needs them.

Subagent

A separate agent run with its own fresh context, started by a main agent for one subtask.

Harness

Everything around the model that makes it an agent: the loop, tools, permissions, memory, context management.

Human in the loop

A person approves, edits or rejects the agent’s action before it takes effect.

RFQ automation (quote automation)

An agent that reads requests for quotation, asks suppliers for prices and drafts a quote for a person to approve.

Forward Deployed Engineer

An engineer who works with a customer or business team to turn AI models into systems that run in their environment.

Context and prompts

Context window

The maximum number of tokens the model can read and write in one request.

Context rot

Model quality drops as the context fills with old, irrelevant or conflicting material.

Context engineering

Deciding what goes into the model’s context, in what order and when, across a whole task.

Compaction

Replacing the older part of a long conversation with a summary so the agent can keep going.

RAG (retrieval-augmented generation)

Finding relevant documents first and putting them into the prompt, so the model answers from them.

Embeddings

Vectors of numbers that place texts with similar meaning close together.

Structured outputs

The model’s answer is constrained to match a JSON schema you provide.

Quality and safety

Evals

A repeatable test set that scores an AI feature, so changes can be measured instead of guessed.

LLM as judge

Using a model with a rubric to grade another model’s output.

Hallucination

A fluent, confident answer that is false or not supported by the sources.

Prompt injection

Instructions hidden in data (a web page, an email, a file) that the model follows as if they came from you.

Guardrails

Checks around a model that block, fix or flag inputs and outputs that break the rules.

Slop (AI slop, workslop)

Low-quality content mass-produced with AI: it looks finished and says little.

Prompt regression

An answer that used to be right goes wrong after a change to the prompt or the model.

Golden dataset

A fixed set of real inputs with expected answers or checks, used to test an AI feature after every prompt or model change.

Production and cost

Tokens

The pieces of text models read and write, and the unit you pay for.

Prompt caching

Reusing an identical prompt prefix across requests so it is cheaper and faster to process.

Cost cap

A hard spending limit enforced by your code, per user, per day or per month.

Model routing and fallback

Sending each request to the model that fits it, and to another one when the first fails.

AI gateway

A proxy between your app and model providers that adds logging, caching, limits, billing and fallbacks.

LLM observability

Tracing every model call with inputs, outputs, latency, tokens, cost and the user outcome.

Reasoning and effort

Models that think before answering, with a setting for how much thinking to spend.

Runbook

A short document that tells someone else how to run a system: where it lives, how to deploy, how to recover.

SLA (service level agreement)

A contract that defines availability, response and fix times per priority, and what happens when they are missed.

Local LLM

A language model running on hardware you control instead of a provider’s API, so documents stay where you decide.

Quantization

Storing a model’s weights with fewer bits, so it needs less memory and runs faster, at a small cost in quality.

KSeF (Polish National e-Invoice System)

Poland’s central system for structured e-invoices: invoices are sent as FA(3) XML and receive a KSeF number.

Observability (o11y)

Being able to tell what a running system is doing, and why, from the data it emits: logs, metrics and traces.

OpenTelemetry (OTel)

An open, vendor-neutral standard and set of SDKs for producing and sending traces, metrics and logs.

SLO and SLI

An SLI is a measured indicator of service quality; an SLO is the internal target for it, stricter than any SLA you sign.

Kubernetes (k8s)

An open source system that runs containers across many machines and keeps them running, scaled and connected.

Edge computing (Workers)

Running code in data centers close to the user, on the CDN, instead of in one central region.

Durable Objects

Cloudflare’s single-instance objects with their own storage: one place in the world that owns a piece of state.

Idempotency (idempotency key)

An operation is idempotent if doing it twice has the same effect as doing it once. Retries become safe.

Dead letter queue (DLQ)

A separate queue where messages land after failing processing too many times, so they are kept instead of lost or retried forever.

Webhook

An HTTP request one system sends to another when something happens, instead of the other system asking repeatedly.

Authoritative server (netcode)

In multiplayer games, the server decides the true game state; clients only send inputs and predict what will happen.

UPO (KSeF receipt)

The official confirmation KSeF issues for received invoices, with the KSeF number and the date the invoice entered the system.

KSeF offline modes

Ways to issue invoices when KSeF or your connection is down, then send them later, marked with QR codes.

Coding with agents

AGENTS.md and CLAUDE.md

Files in a repository with the rules a coding agent reads at the start of every session.

Coding agent

An agent that reads a repository, edits files, runs commands and tests, and opens pull requests.

Hooks

Scripts the harness runs automatically at fixed points, such as before a tool call or after an edit.

Spec-driven development

Writing the specification and acceptance tests first, then letting agents implement against them.

Vibe coding

Building by prompting and accepting the result without reading the code closely.

Audit-driven development

A loop for code you maintain: an AI agent audits it against a checklist, the findings become small fixes, and it audits again until nothing is left.

Software projects and pricing

MVP (minimum viable product)

The smallest version of a product that tests whether people want it enough to use or pay.

Riskiest assumption

The one belief that, if false, ends the idea. Test it first.

Fixed price

A contract where scope and price are agreed up front and the vendor carries the risk.

Time and materials (T&M)

Paying for the hours actually worked; scope can change, cost and timeline move with it.

Cone of uncertainty

How wide an honest estimate is at each stage: from 0.25× to 4× at the idea stage, narrowing as decisions are made.

Reference class forecasting

Estimating from what similar finished projects actually cost, instead of from your own feature list.

Scope creep

Small additions that each seem reasonable and together blow the budget and the date.

PWA (progressive web app)

A website with a manifest and a service worker, so it can be installed, work offline and be packaged for app stores.

Build vs buy

The choice between paying for a ready-made product and building your own software, including what each costs over time.

Function point

A unit of software size based on what the system does for users, independent of the programming language.

Multi-tenancy (multi-tenant SaaS)

One application and one deploy serving many client companies, with each client’s data kept apart.

White-label

A product sold under the buyer’s brand: their logo, colors and domain on software someone else builds and runs.

Merchant of record (MoR)

A company that sells your software to customers in its own name, handling payments, sales tax, invoices and refunds for you.

D-U-N-S number

A nine-digit company identifier from Dun & Bradstreet that Apple and Google require to publish apps as an organization.

TWA (Trusted Web Activity)

An Android way to ship a web app as a store app: the browser shows your site full screen inside an app package.

Capacitor

An open source runtime that packages a web app as native iOS and Android apps, with plugins for device features.

Fractional CTO

A senior technical leader hired part time, for a few days a month, instead of a full-time CTO.

Definition of Done

A shared checklist of what must be true before work counts as finished: tested, reviewed, deployed, documented.

Payback period

How long it takes for savings or extra revenue from an investment to cover what it cost.

EDI (electronic data interchange)

Standard machine-to-machine exchange of business documents (orders, delivery notes, invoices) between trading partners.

CPQ (configure, price, quote)

Software that helps sales configure a product, apply the right prices and discounts, and produce a quote without errors.

Vesting and cliff

Shares that a co-founder or employee earns over time, with nothing earned before a first milestone (the cliff).

Programming systems product (Brooks)

Fred Brooks’s name for software that is both a product others can use and a system that fits with others; about nine times the cost of a working program.

Product analytics

Activation rate

The share of new users who reach the first real use of a product within a set time.

Tracking plan

The short list of events a product sends, with names, properties and where each is captured.

Conversion funnel

The ordered steps users take towards a goal, such as visit, sign-up and payment, with the share who get from each step to the next.

Retention

The share of users who come back and use a product again in later weeks or months, usually shown per sign-up cohort.

A/B test

Showing two versions to randomly split users and measuring which one moves a chosen metric.

Session replay

A reconstruction of what a user saw and did on a site: clicks, scrolls, page changes and errors, played back like a video.

First-party analytics proxy

Sending analytics through a path on your own domain, so ad blockers that block known analytics hosts do not drop the data.

AI search

AI visibility

How often an AI assistant names or cites your brand when buyers ask it which product to pick.

GEO (generative engine optimization)

Making a brand and its pages the ones AI assistants name and cite, the way SEO does it for search results.

llms.txt

A plain-text file at /llms.txt that summarizes a site for language models: what it is and which pages matter.

Email authentication and deliverability

SPF (Sender Policy Framework)

A DNS record listing which servers may send email for your domain.

DKIM (DomainKeys Identified Mail)

A signature on each message, checked against a public key in your DNS.

DMARC

The policy that tells receivers what to do when mail fails SPF and DKIM, and where to report.

One-click unsubscribe (RFC 8058)

A standard way for mail apps to unsubscribe a reader with one POST request, required by Gmail and Yahoo for bulk senders since 2024.

List-Unsubscribe header

An email header (RFC 2369) with a mailto or web address that mail apps use to show their own Unsubscribe button.

DMARC alignment

The DMARC rule that SPF or DKIM only counts when its domain matches the domain in the visible From address.

Phishing

An email that pretends to come from someone you trust to get your password, payment or personal data.

BIMI

Your logo next to your messages in supporting inboxes, once DMARC is enforced.

VMC and CMC

Mark certificates that prove you own the logo BIMI shows: Verified (trademark) or Common (12 months of use).

MTA-STS and TLS-RPT

A policy that makes senders deliver to you only over verified encryption, plus reports when it fails.

Hard bounce

A permanent delivery failure: the address or its domain does not exist or refuses mail.

Disposable email address

A temporary mailbox from a throwaway provider, used to sign up without giving a real address.

Null MX record

A DNS record (MX 0 .) that says a domain accepts no email at all (RFC 7505), so senders give up at once and list checks can drop its addresses.

Email signature

The block at the end of an email with the sender’s name, role and contact details, often with a logo, added by the mail client or the server.

Catch-all domain

A domain whose mail server accepts mail for any address, so a check before sending cannot tell whether a mailbox really exists.

Spam trap

An email address no real person uses, kept by a mailbox provider or a blocklist operator to catch senders with poor list practices.

Role address

An address for a function rather than a person, such as info@, sales@ or support@, often read by several people or a ticket system.

MX record

A DNS record that names the mail servers accepting email for a domain, each with a preference number: lower numbers are tried first.

Suppression list

Addresses you must never email again: unsubscribes, hard bounces and spam complaints, checked before every send.

TLS-RPT

A DNS record that asks other mail servers to send you daily reports when encrypted delivery to your domain fails.

CAN-SPAM Act

The US law for commercial email: honest headers and subjects, a postal address, a working opt-out and honoring it within 10 business days.

Google Postmaster Tools

Google’s free dashboard for senders: how Gmail sees your domain, spam complaint rate and whether you meet its bulk-sender requirements.

Web and front-end

Numeronym (a11y, i18n, k8s)

A word shortened to its first letter, the number of letters in between and its last letter, like a11y for accessibility.

Accessibility (a11y)

Building software that people with disabilities can use: with a keyboard, a screen reader, zoom or captions.

WCAG

Web Content Accessibility Guidelines: the W3C standard of testable accessibility criteria, at levels A, AA and AAA.

Internationalization (i18n)

Preparing code so it can support any language and region without changes: texts, dates, numbers, plurals and writing direction.

Localization (l10n)

Adapting a product to one market: translation, currency, formats, legal texts, images and tone.

Globalization (g11n)

The whole effort of taking a product to many markets: internationalized code, localized content and the processes around them.

React Server Components (RSC)

React components that run only on the server, send rendered output instead of JavaScript, and can read data directly.

Hydration

The step where JavaScript in the browser attaches to server-rendered HTML and makes it interactive.

SSR, SSG and ISR

Three ways to render pages: on every request (SSR), once at build time (SSG), or at build time and refreshed later (ISR).

Request waterfall

Requests that wait for each other in sequence when they could run in parallel, so load time adds up.

Event loop

How JavaScript runs one task at a time and queues the rest: callbacks, promises (microtasks), timers and rendering.

Core Web Vitals (LCP, INP, CLS)

Google’s three metrics of real user experience: loading (LCP), responsiveness (INP) and visual stability (CLS).

Server-Sent Events (SSE)

A standard way for a server to push a stream of updates to the browser over one long HTTP response.

Discriminated union

A TypeScript type made of variants that share one literal field, so the compiler knows which variant you have.

Runtime validation (Zod)

Checking at run time that data from outside (requests, APIs, files, models) matches the type your code assumes.

Visual regression testing

Automated screenshots of pages or components compared with approved ones, so unintended visual changes fail the build.

Design system (Storybook)

Shared components, tokens and rules that keep a product consistent across screens, teams and platforms.

Static site

A website served as ready-made files (HTML, CSS, images) with no server code or database running per visit.

Headless CMS

A content management system with only an editing panel and an API; the website itself is built and hosted separately.

301 redirect

An HTTP response saying a page has moved permanently, so browsers and search engines go to the new address.

Shipping and maintenance

CI/CD

Continuous integration and continuous delivery: every change is built and tested automatically and can be released at any time.

Trunk-based development

Everyone merges small changes into one main branch at least daily, instead of keeping long-lived feature branches.

Blue-green deployment

Two identical production environments: the new version goes to the idle one, then traffic switches over, and back if something breaks.

Feature flags

Switches in code that turn a feature on or off for some or all users without a new deploy.

Strangler fig pattern

Replacing a legacy system piece by piece, routing one feature at a time to new code until the old system can be switched off.

Codemod

A script that rewrites source code automatically, used for upgrades and refactors across many files at once.

Monorepo

One repository that holds several apps and shared packages, versioned and changed together.

DORA metrics

Research-based measures of software delivery: how fast changes reach production and how often they fail.

Technical debt

Shortcuts in code and design that speed up delivery now and make every later change slower until they are paid back.

Software takeover (handover)

Moving an existing app to a new developer or team: access, code, infrastructure and the knowledge in people’s heads.

Dependency updates (Dependabot, Renovate)

Keeping libraries and frameworks current, usually with bots that open pull requests for new versions.

Backup (3-2-1 rule)

Three copies of data, on two kinds of storage, one of them off-site, plus regular restore tests.

RPO and RTO

How much data you can afford to lose (RPO) and how long you can be down (RTO) after a disaster.

Postmortem (blameless)

A written review after an incident: what happened, why, how it was handled and what changes so it does not repeat.

Technical due diligence

A review of a company’s software, team and processes before an investment or acquisition, to price the technical risk.

Bus factor

How many people would have to disappear before a project stalls. A bus factor of one means one person holds the keys.

LTS and EOL (long-term support, end of life)

LTS is a release supported with fixes for years; EOL is the date after which a version gets no more security fixes at all.

App Store Small Business Program

Apple’s program that cuts its commission on in-app sales to 15% for developers who earned up to USD 1 million in the previous year.

Target API level (Google Play)

The Android version an app declares it was built for; Google Play raises the minimum every year and hides apps that fall behind.

16 KB page size (Android)

Newer Android devices use 16 KB memory pages; apps with native libraries built for 4 KB pages must be rebuilt or they will not run there.

Security and login

SSO (single sign-on)

Logging in once with a company account (Microsoft, Google, Okta) to use many apps, managed centrally by IT.

OAuth

A standard that lets an app act on a user’s account elsewhere (mail, calendar, files) without ever seeing the password.

CSP (Content Security Policy)

An HTTP header that tells the browser which scripts, styles and connections a page may use, limiting the damage of injected code.

WAF (web application firewall)

A filter in front of a web app that blocks malicious HTTP requests before they reach your code.

Rate limiting

Capping how many requests a user, key or IP can make in a time window, and answering HTTP 429 above it.

CASA (Cloud Application Security Assessment)

The security assessment based on OWASP ASVS that Google requires for apps using restricted scopes, such as Gmail data.

CVE (Common Vulnerabilities and Exposures)

A public catalog that gives each known security vulnerability one ID, such as CVE-2025-55182, so everyone talks about the same bug.

CVSS (vulnerability severity score)

A 0 to 10 score of how severe a vulnerability is, from how it is exploited and what it lets an attacker do.

RCE (remote code execution)

A vulnerability that lets an attacker run their own code on your server or device over the network.

XSS (cross-site scripting)

Attacker-controlled script running in your page in another user’s browser, with that user’s session.

SQL injection

Input that changes the meaning of a database query because it was pasted into the SQL text instead of passed as a parameter.

CSRF (cross-site request forgery)

Another site making a logged-in user’s browser send a request to your app, which the app trusts because the cookie came along.

SSRF (server-side request forgery)

Tricking your server into fetching a URL the attacker chose, often an internal address the attacker cannot reach directly.

Zero-day

A vulnerability attackers know about or exploit before the vendor has a fix, so defenders have had zero days to patch.

Software supply chain attack

Compromising software through what it is built from: a package, a build tool, a CI action or a maintainer’s account.

SBOM (software bill of materials)

A machine-readable list of every component and version inside a piece of software, like an ingredients label.

OWASP Top 10

The OWASP Foundation’s list of the ten most critical web application security risks, updated every few years.

MFA (2FA, multi-factor authentication)

Logging in with two or more kinds of proof, such as a password plus a code from an app or a security key.

Passkeys

Passwordless login with a key pair stored on your device or password manager, unlocked by fingerprint, face or PIN.

JWT (JSON Web Token)

A signed, compact token that carries claims about a user, such as who they are and when the token expires.

CORS (cross-origin resource sharing)

Headers that tell the browser which other websites may read responses from your API.

Secrets management (leaked API keys)

Keeping API keys, passwords and tokens out of code and chats, in a store with access control, rotation and audit.

security.txt

A small file at /.well-known/security.txt that tells security researchers how to report a vulnerability to you.

Row Level Security (RLS)

Database rules that decide, row by row, which records each user may read or change. Missing RLS is a common leak in AI-built apps.

Shadow IT (shadow AI)

Apps, AI tools and accounts that employees use or build for work without the IT team knowing or managing them.

Microsoft Entra ID (formerly Azure AD)

Microsoft’s cloud identity service behind Microsoft 365 logins, renamed from Azure Active Directory in 2023.

SCIM (user provisioning)

A standard API that lets a company’s identity system create, update and remove user accounts in your SaaS automatically.

OWASP ASVS (Application Security Verification Standard)

An open checklist of security requirements for web apps and APIs, in three levels, used for design, testing and assessments such as CASA.

HSTS (HTTP Strict Transport Security)

A response header that tells browsers to reach your domain only over HTTPS for a set time, so nobody can downgrade the connection.

Vulnerability disclosure program (VDP)

A public policy that tells security researchers how to report a flaw, what is in scope and that they will not be sued for reporting in good faith.

Penetration test (pentest)

An authorized, time-boxed attack on your app by security testers, ending in a report of what they could break and how badly.

Law and compliance

GDPR

The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.

Data processing agreement (DPA)

The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.

NIS2

The EU cybersecurity directive that requires medium and large organizations in 18 sectors to manage cyber risk and report incidents.

Cyber Resilience Act (CRA)

The EU regulation that sets security requirements for products with digital elements, from smart devices to software, sold in the EU.

Source code ownership (IP assignment)

Who legally owns the code you paid for. In Poland, a contractor’s code becomes yours only through a written transfer of rights.

Source code escrow

The vendor deposits source code with a neutral third party, released to the customer if the vendor goes under or stops support.

Zero data retention (ZDR)

An arrangement in which an AI provider does not store your prompts and outputs after returning the response, beyond what is needed to serve it.

EU AI Act

The EU regulation on AI systems: bans some uses, regulates high-risk ones, and sets transparency and AI literacy duties.

AI literacy (AI Act Article 4)

The AI Act duty, in force since February 2, 2025, for companies using AI to ensure their staff understand it well enough to use it.

Employer of record (EOR)

A company that legally employs someone in their country on your behalf, handling contracts, payroll and taxes, while you direct the work.

B2B contract (Poland)

How many Polish developers work: as their own registered business, invoicing the client monthly instead of being employed.

European Accessibility Act (EAA)

The EU law that since June 28, 2025 requires many consumer products and services, including e-commerce and banking apps, to be accessible.

COPPA (Children’s Online Privacy Protection Act)

The US law on collecting personal data from children under 13: sites and apps aimed at kids need verifiable parental consent first.

SOC 2 and ISO 27001

The two security attestations enterprise buyers ask vendors for: an auditor’s SOC 2 report and an ISO/IEC 27001 certificate.

VAT OSS (One-Stop Shop)

The EU scheme that lets a seller declare and pay VAT on consumer sales in other EU countries through one return at home.

NIP and CEIDG (Polish business identifiers)

NIP is the Polish tax number on every invoice; CEIDG is the public register where you can check a Polish sole proprietor exists.

CCPA and CPRA (California privacy law)

California’s consumer privacy law: rights to know, delete, correct and opt out of the sale or sharing of personal data, browser signals included.

Global Privacy Control (GPC)

A browser signal that tells every site the person does not want their data sold or shared; California and other states treat it as a legal opt-out.

EU-US Data Privacy Framework (DPF)

The legal basis that lets EU personal data go to US companies that certify under it, without extra transfer contracts.

Native advertising disclosure

Labeling ads that look like regular content, such as sponsored items in a feed or inbox, so people can tell them apart before they click.

Reverse charge (VAT)

For cross-border B2B services in the EU, the buyer accounts for VAT instead of the seller, so the invoice shows no VAT.