Reference

Glossary

The 145 terms of the agentic-systems field, each defined in one sentence: from the context window to the lethal trifecta, from GRPO to task time-horizon.

145 terms

(θ, C) pair: Framing an agent as fixed model weights θ (set at training) plus runtime context/memory C; in modern agents 'learning' updates C in token-space rather than retraining θ.
A2A (Agent2Agent): An emerging horizontal interoperability standard that connects agents to each other via Agent Cards, JSON-RPC, and SSE — complementing MCP's vertical agent-to-tool connection.
Action space: The complete set of actions an agent can take — in an LLM agent, its available tools; restricting it lowers policy variance and shrinks the attack surface.
Agent control loop: The repeating cycle where a model decides an action, the harness executes it against the environment, and the resulting observation is fed back for the next decision until a stopping condition is met.
Agent-Computer Interface (ACI): The design of the tools an agent can call — names, formats, examples, error-proofing — effectively the design of the POMDP's action space and a major reliability lever.
Agentic search: Retrieval done in a loop at runtime: the model uses tools (grep, read, SQL, APIs) to navigate a corpus, reads current data, and reformulates its next query from what it just found, with no precomputed index.
Agents Rule of Two: Meta's design guideline that an autonomous agent (no human in the loop) may hold at most two of three properties: processes untrusted input, accesses sensitive data, or can change state/communicate externally.
AST matching: Comparing the abstract syntax tree of a model's generated function call against a reference call to verify name, parameters, and types without executing code or invoking an LLM.
At-least-once delivery: The realistic guarantee of distributed queues: a message may be delivered more than once (e.g., a worker finishes but crashes before acknowledging), which is why consumers must be idempotent.
Attack Success Rate (ASR): The fraction of attack attempts that achieve the adversary's goal against an agent — a benchmark metric (e.g., in AgentDojo) measuring security under attack rather than just task success.
Attention / O(n²): The transformer mechanism that relates every token to every other token; because it is all-pairs, prefill compute grows quadratically with context length.
Attention budget: The idea that a transformer has a finite, degradable capacity to attend across tokens, so context tokens are a scarce resource to spend rather than free storage.
Augmented LLM: Anthropic's basic building block of agentic systems: a model enhanced with augmentations like retrieval, tools, and memory, exposed to it through an easy, well-documented interface. Workflows and agents are both built on this unit, not on the raw model.
Automation bias / overreliance: The tendency of human approvers to rubber-stamp AI outputs without genuine scrutiny, eroding the safety value of a human-in-the-loop even when people are trained to resist it.
Batch invariance: The property (usually absent in default GPU kernels) that an inference result is independent of the batch size it was computed in; its absence is why identical inputs can yield different outputs even at temperature 0.
Belief state: The agent's running estimate of the hidden world state formed from observations; in an LLM agent this is the curated context window, not the raw prompt.
Benchmark contamination / saturation: Contamination is benchmark solutions leaking into training data (inflating scores via memorization); saturation is frontier models all scoring near the ceiling, so the benchmark no longer discriminates.
Best-of-N with a verifier: Generating N candidate answers and selecting the best using an external truth signal (a test, a search, a checker), which beats blind majority voting at lower token cost.
BFCL (Berkeley Function Calling Leaderboard): A standard benchmark for how accurately LLMs call functions/tools, including irrelevance detection (knowing when not to call) and, in V4, agentic skills like multi-hop web search and memory.
Blast radius: How many systems, users, or records an action affects if it goes wrong — used alongside reversibility to decide whether an action needs human confirmation.
BM25: A classic lexical ranking function scoring documents by exact term matches; strong on identifiers, codes, and symbols but weak on pure synonyms.
bypassPermissions mode: A permissive Agent SDK mode that auto-approves tool calls, but where deny rules and ask rules still override — so those two remain effective security boundaries even under it.
Chain-of-thought (CoT): Intermediate reasoning tokens a model emits before its final answer; originally a prompting trick, now often trained in, it can improve accuracy on multi-step problems.
Chunking: Splitting documents into smaller passages before embedding/indexing; it can break coreference and context (e.g., a chunk says 'margin grew 3%' without which company or quarter).
Circuit breaker / spend cap: An infrastructure-level hard limit (max iterations, per-tenant daily token budget, or a breaker that trips on spend-velocity spikes) enforced before the model call, outside the agent's control — not requested in the system prompt.
Code execution with MCP: A pattern where the model writes a program that calls tools in a sandbox, so intermediate results stay out of its context and only the final answer returns — cutting token cost dramatically.
Code-based grader: A deterministic, rule- or code-driven evaluator (e.g., checking tool order or confirmation gates) that scores agent behavior without an LLM, making it cheap, reproducible, and bias-free.
Cohen's kappa: An inter-rater agreement statistic that corrects for chance, used to calibrate an LLM judge against human labels, with >0.6 acceptable and >0.8 strong.
Compaction: A deliberately lossy operation that discards parts of the accumulated context (often old raw tool outputs) while preserving distilled decisions — directed information loss, and also a poisoning channel.
Compounding error: The phenomenon where small per-step error rates accumulate over a long task, collapsing success probability (heuristically p^t; rigorously a quadratic εT² bound in imitation learning per Ross & Bagnell).
Confirm/execute non-divergence: The guarantee that the exact normalized input a human approved is byte-for-byte what gets executed, achieved by persisting the validated input before asking and running that stored record rather than a fresh model call.
Confused deputy: A classic security flaw where a trusted component with legitimate authority is tricked by a third party into misusing it on the attacker's behalf — here, an agent acting on instructions buried in poisoned data; MCP's OAuth Resource Indicators (RFC 8707) aim to stop tokens being reused across servers.
Constitutional AI / RLAIF: Anthropic's approach where a model critiques and revises its own outputs against written principles (a constitution) to generate preference data, replacing human labels with AI feedback.
Context engineering: Curating the entire token stream fed to an agent each turn (system prompt, history, tool results, retrieved data, memory) so the model has the smallest high-signal set it needs, rather than just writing one good prompt.
Context isolation (sub-agents): Spawning a sub-agent with a clean window to do bounded work and return only a small distilled result, keeping the coordinator's context uncontaminated — reliable for read-only tasks but risky for coordinated writes.
Context poisoning: A failure mode where a hallucinated or hostile fact enters the context and gets repeatedly cited in later turns, self-reinforcing until the agent chases a false or impossible goal.
Context rot: The empirical finding that an LLM's accuracy degrades non-uniformly as input length grows — even well within the window — so more tokens can make the model reason worse, not just cost more.
Context window: The finite maximum number of tokens (prompt plus output) the model can attend to in a single call; beyond it, content must be dropped, summarized, or retrieved.
Context window vs memory: The context window is the volatile token buffer the model sees this turn (lost on compaction/reset); memory is external durable state with explicit write, retrieval, and decay policies that survives across turns and sessions.
Contextual Retrieval: Anthropic's preprocessing technique that prepends an LLM-generated, document-aware blurb to each chunk before embedding and BM25 indexing, reducing failures from chunks losing their surrounding context.
Continual learning in token-space: Improving an agent by accumulating readable textual experience (notes, reflections, memories) rather than fine-tuning weights — interpretable, versionable, and portable across models.
Control plane vs execution plane: An architectural split where a stateless fast edge only validates, persists, and enqueues a request, while a durable slow worker performs the model call and tool execution behind a queue.
CoT faithfulness: Whether the visible reasoning text actually reflects the computation that produced the answer; research shows it often does not, so CoT is not a reliable audit trail.
Credit assignment (sparse reward): The problem of deciding which actions in a long trajectory deserve reward when success is only known at the end — addressed with dense per-turn rewards, token-level credit (GAE/TD), and trajectory curation.
DAgger (Dataset Aggregation): Ross, Gordon & Bagnell's 2011 imitation-learning algorithm that mitigates compounding error by training the policy on the states it actually visits, replacing quadratic error growth with a linear O(εT) term.
Darwin Gödel Machine (DGM): A self-improving coding agent that rewrites its own code, empirically validates each variant against a benchmark, and keeps an archive of diverse variants to avoid local optima.
Default-deny / least privilege: A fail-closed security posture where anything not explicitly permitted is rejected and an agent starts with no capabilities, granted only the specific tools the current task or role requires via an explicit allowlist.
Digit quantization: The arithmetic errors that come from how a model chops numbers into tokens: byte-pair encoding can group digits inconsistently (e.g. '1234' as '123'+'4'), so the model never sees clean place value and miscalculates. It's a tokenization artifact, not a reasoning failure.
DPO (Direct Preference Optimization): A method reaching the same aligned policy as RLHF by minimizing a classification loss over (preferred, rejected) response pairs, removing the separate reward model and RL loop.
Dual-LLM / quarantine pattern: An architecture where a privileged LLM orchestrates but never reads untrusted text, while a separate quarantined LLM processes untrusted content and returns only typed values (a date, a boolean), never instructions the privileged model obeys.
Dual-write problem: The inconsistency arising when an application writes to two systems (e.g., a database and a queue) as separate non-atomic operations, so a crash between them leaves a phantom record or a lost message.
Durable execution: A distributed-systems pattern (e.g., Temporal) of checkpointing each completed step and recording non-deterministic effects so a crashed run replays finished steps from storage and resumes instead of restarting from zero.
Durable execution state: The journaled progress of a multi-step agent turn (tool calls, human-in-the-loop) that survives a crash via replay, treating completed LLM calls as idempotent activities not re-executed — distinct from durable memory.
Effort budget: An explicit per-subtask limit (number of sub-agents and tool calls) the orchestrator assigns to workers to prevent duplicated work and over-research.
Effort parameter: The Claude API control (low through max) that sets how hard a reasoning model works on a turn — the successor to the deprecated budget_tokens knob.
Elicitation: An MCP capability (added in the 2025-06-18 spec) letting a server pause mid-operation to ask the user for additional structured input.
Embedding: A numeric vector representation of text that places semantically similar text close together, enabling similarity search but losing precision on rare tokens, exact identifiers, and proper nouns.
Entropy collapse: A GRPO failure mode where the policy becomes nearly deterministic — probability mass concentrates on single tokens — and the model stops exploring alternatives during training.
Error analysis (open / axial coding): An ethnographic method of reading real traces, writing free-form notes on each failure (open coding), then grouping them into themes (axial coding) to derive graders from the real failure distribution.
Evaluator-optimizer: A workflow where one LLM generates output and a second scores it against criteria and returns feedback in a loop until a quality threshold is met — capped with an iteration limit to avoid infinite loops.
Failure attribution: Identifying which agent and which decisive step caused a failure in a multi-agent system; research shows full input+context traces make this materially more accurate than output-only logs.
GraphRAG: A retrieval method that builds an entity-relationship knowledge graph and hierarchical community summaries (via Leiden community detection) to answer global, whole-corpus questions flat vector RAG cannot.
Ground truth: An observable external fact injected into the loop — a real tool result, a passing/failing test, a concrete error — as opposed to the model's own unverified self-assessment.
GRPO (Group Relative Policy Optimization): An RL algorithm (DeepSeekMath, 2024) that drops the value/critic network by sampling a group of responses per prompt and using the group's mean reward as the baseline for each response's advantage.
Harness: All the code, configuration, and execution logic wrapping the model — the loop, tool execution, state persistence, stopping conditions, and observability — i.e., everything in an agent that isn't the model itself.
HMAC / pepper: A keyed hash using a secret 'pepper' to deterministically obfuscate identifiers in traces — the same ID always maps to the same value so you can correlate, without leaving the real ID brute-forceable like a plain hash would.
Human-in-the-loop (HITL): A deterministic control step that pauses the agent for human approval, correction, or escalation to reset accumulated error and gate high-stakes or irreversible actions — not a prompt asking the model to check in when unsure.
Hybrid search / RRF: Combining dense (embedding) and sparse (BM25/lexical) retrieval and fusing their rankings, commonly via Reciprocal Rank Fusion (RRF), to get both semantic and exact-match strengths.
Idempotency: A property where running an operation twice has the same effect as once — typically enforced by a deterministic key (e.g., from workflow_id + step_id, or a pending-action id) so retries after a crash, network failure, or queue redelivery are deduplicated rather than double-applied.
Implicit decisions: The unstated assumptions (style, format, interpretation) an agent bakes into its output; when two agents make incompatible implicit decisions on the same artifact, the results can't be reconciled afterward.
Index lag / staleness: The gap between when source data changes and when a precomputed vector index is rebuilt, during which the index returns outdated results — a problem agentic search avoids by reading current bytes.
Indirect prompt injection: Prompt injection delivered not by the user but through content the agent reads while working (a fetched web page, a RAG document, a tool result), so the attacker never talks to the agent directly.
Induction head: A two-attention-head circuit that detects a prior 'A→B' pattern and predicts B after seeing A again — the mechanistic engine of in-context (few-shot) learning.
Injection Success Rate (ISR) vs Attack Success Rate (ASR): In memory-attack papers, ISR measures whether a malicious record lands in memory while ASR measures whether a later victim query actually produces the malicious action — ISR is typically much higher than ASR.
Intrinsic self-correction: A model trying to fix its own answer using only its internal judgment with no external feedback; research shows this often fails to help and can degrade reasoning.
Just-in-time retrieval: Letting the agent hold lightweight identifiers (file paths, queries, links) and load data on demand with tools as it discovers relevance, instead of pre-loading a large retrieved blob.
KV cache: Stored key/value projections for already-processed tokens so they aren't recomputed at each decode step; its memory grows linearly with context length, unlike the quadratic attention compute.
Late interaction (ColBERTv2): A multi-vector approach that keeps a separate embedding per token and scores relevance with per-token MaxSim, sitting between single-vector dense retrieval and lexical search in precision and cost.
Lethal trifecta: Simon Willison's model: an agent becomes a guaranteed exfiltration tool when it simultaneously has access to private data, exposure to untrusted content, and a channel to send data externally — removing any one breaks the chain.
LLM-as-judge: Using a language model to score or compare outputs against a rubric — useful for subjective qualities but subject to systematic biases like position, verbosity, and self-preference.
Lost in the middle: The empirical U-shaped pattern where models recall information at the start and end of a long context well but systematically under-attend to the middle.
MAST (Multi-Agent System failure Taxonomy): A UC Berkeley taxonomy of 14 multi-agent failure modes grouped into specification/system-design (~42%), inter-agent misalignment (~37%), and task-verification (~21%) categories.
MDP (Markov Decision Process): A decision model where the agent sees the full state of the world before each action. It's the fully-observed special case of a POMDP; a single, self-contained LLM API call is a degenerate one-step MDP, while a real agent acting on partial information is a POMDP.
Memory poisoning: An attack that plants malicious content into an agent's durable memory so it persists across sessions — strictly worse than a single-turn prompt injection because it survives the turn that planted it.
Model Context Protocol (MCP): An open standard from Anthropic (Nov 2024) that connects agents to external tools and data sources through one uniform interface; because tool descriptions and results flow unsanitized into context, a malicious or swapped server can inject instructions.
Needle-in-a-haystack (NIAH): A long-context test that hides a specific string in a large body of filler; because exact-string retrieval is easy it scores near 100%, masking the real degradation on semantic, multi-step tasks.
Next-token prediction: The core operation of an LLM: given the tokens so far, output a probability distribution over the next token, sample one, append it, and repeat.
Online evals: Quality checks on live sampled production traffic — cheap heuristics on all traffic plus an LLM-as-judge on a fraction — that catch distribution drift offline test sets miss and feed new failures back into the offline dataset.
Orchestration determinism: Keeping coordination logic deterministic and resumable (the Temporal model) while confining non-deterministic LLM/tool calls to discrete activities, so a crashed run can resume instead of restarting.
Orchestrator-worker: A multi-agent pattern where a lead agent decomposes a task, spawns specialized workers with bounded mandates, and synthesizes their results into one answer.
OTel GenAI semantic conventions: OpenTelemetry's standardized attribute schema for LLM/agent telemetry (the gen_ai.* namespace) that lets you switch observability backends without re-instrumenting — still experimental as of 2026.
pass@k vs pass^k: pass@k is the probability that at least one of k attempts succeeds (a capability/best-case measure); pass^k is the probability that all k independent attempts succeed (reliability, ≈p^k), and production cares about pass^k.
Permission chain: The fixed evaluation order the Claude Agent SDK applies to each tool call — hooks/deny rules, then ask rules, then permission mode, then allow rules, then the canUseTool callback — determining what runs, waits, or is blocked.
Plan-then-execute: An agent pattern that produces an explicit, reviewable plan before taking any action, enabling human interception of write operations and better control of dependencies.
Poka-yoke: A design principle borrowed from manufacturing: making tools and formats error-proof so the agent structurally cannot make certain mistakes.
Policy (π): The function mapping what the agent has observed so far to its next action; in an LLM agent, the reasoner conditioned by its system prompt IS the policy π(action | observation, history).
POMDP (Partially Observable Markov Decision Process): A decision-making model where an agent never sees the true world state directly and must act on a belief inferred from partial observations — the formal lens for LLM agents.
Position / verbosity / self-preference bias: Systematic LLM-judge errors: favoring an answer by its presentation order, rewarding longer answers regardless of quality, and preferring outputs from its own model family.
Progressive disclosure: Loading only a tool's name and short description up front and revealing fuller instructions and materials only when the tool becomes relevant, to save context tokens.
Prompt caching: Reusing the model's cached computation for a stable, byte-for-byte-identical prompt prefix so repeated requests are far cheaper (cached reads cost roughly 10% of normal input price); any change to the prefix invalidates the cache.
Prompt injection: An attack where instructions hidden in untrusted content (a document, email, web page) are processed by an LLM as legitimate commands, hijacking the agent's behavior.
Provenance / source-aware memory: Tagging each memory entry with its origin and a trust level so retrieval can quarantine or down-weight entries from untrusted sources.
RAG (Retrieval-Augmented Generation): Chunking and embedding documents into an index, then retrieving the top-k most relevant chunks into the prompt before the model answers — a single retrieval pass against the original query.
ReAct (think-act-observe): An agent loop interleaving reasoning traces ('think') with environment-affecting actions ('act') and their feedback ('observe'); its append-only transcript adapts to dynamic tasks but causes context growth and error compounding on long horizons.
Read/write asymmetry: The principle that read-only work can be safely parallelized across agents (no shared mutable state), while write/generation work must be serialized on one thread to avoid conflicting decisions.
Reflexion: A technique where an agent verbally reflects on its own past failures to improve; fragile without an external truth signal because models tend to rationalize rather than correct.
Reliability composition (geometric decay): The fact that if each step succeeds with probability p, an n-step chain succeeds at p^n, so even near-perfect per-step agents become unreliable over long horizons.
Replay over recorded tool-responses: Re-running an agent against captured production messages and recorded tool results (used as fixtures) instead of calling tools live, turning a non-reproducible failure into a deterministic, token-free test.
Reranking / cross-encoder: A second retrieval stage that reorders a large set of cheap candidate chunks with a model that reads query and document together, producing more accurate top-k at the cost of added latency.
Reversibility gate: A control point that intercepts actions which are expensive or impossible to undo before they execute, while letting reversible reads run automatically.
Reward hacking / Goodhart's Law: When an optimizer or agent satisfies a weak verifier without truly solving the task (e.g., overwriting a test to make a suite pass), which is why graders must check the real effect on the world.
RLHF (RL from Human Feedback): Aligning a model by training a reward model on human preference comparisons, then optimizing the policy against it with RL so outputs match what human annotators prefer.
RLVR (RL from Verifiable Rewards): RL where the reward is a programmatic, checkable function — did the test pass, is the math correct, was the goal state reached — making it much harder to game than a learned reward model and shaping reasoning and tool-use.
Row-level security (RLS): A database feature (e.g., Postgres) that filters rows by a per-session policy such as tenant/org id, enforcing tenant isolation in the data layer even if application code forgets a WHERE clause.
Rug pull: An attack where a previously approved tool or MCP server silently changes its definition or behavior afterward (e.g., CVE-2025-54136 'MCPoison' against Cursor, patched July 2025).
Self-consistency: Sampling several independent reasoning traces for one prompt and taking the majority-vote answer; gains typically plateau around 10–15 samples and it often rivals multi-agent debate at equal compute.
SFT (Supervised Fine-Tuning): Training a base model on curated input-output examples (often distilled from a larger teacher) to teach response format, tone, and chain-of-thought structure — it grabs form, not new factual knowledge.
Span vs metric cardinality: Spans want high-cardinality fields (unique IDs, content) to make individual traces findable, while metrics need bounded low-cardinality labels because each label-value combination creates a separate time series — mixing them is the core architectural mistake.
Spotlighting: Microsoft's prompt-level technique of marking untrusted text via delimiting, datamarking, or encoding so the model is likelier to treat it as data — a probabilistic mitigation, not a hard security boundary.
Stateless: The model retains nothing between API calls; a 'conversation' only exists because you resend the prior history on every request.
Stateless reducer: Treating the model as a near-pure function from current state plus a new observation to the next action, holding no durable memory of its own so all persistent state lives outside it.
Stochastic: The output isn't fixed: run the model twice on the same input and you can get different answers, because each next token is sampled at random from a probability distribution. This is why one passing run proves little and you measure reliability across many (pass^k), not one.
Sub-agent: A separate LLM invocation with its own isolated context window, spawned to handle a slice of work and return only a distilled result to the main thread — a context-management device, not an org-chart role.
Sycophancy: A trained bias where models flatter, over-assert, and avoid contradicting the user, arising because RLHF optimizes for what human annotators prefer rather than what is correct.
Taint tracking / information-flow control (IFC): Marking each value with its provenance (trusted vs untrusted) and propagating that mark through deterministic code, so a consequential action derived from untrusted data is automatically blocked.
Task time-horizon: METR's metric for agent capability: the human-time length of task an agent can complete at roughly 50% reliability — a better proxy for agentic ability than single-turn benchmarks.
Temperature / top-p (sampling): Parameters that control how spread-out the model's sampling is — higher values make output more varied — though the newest reasoning models replace them with an effort control.
Termination tool: An explicit action the model can call to declare it is finished or to escalate to a human, giving the loop a clean, intentional way to stop instead of trailing off.
Test-time compute / extended thinking: Spending extra inference-time reasoning tokens to improve answer quality, controlled on current Claude models by the effort parameter rather than a fixed token budget.
TOCTOU (time-of-check to time-of-use): A class of bug where what was checked and what gets used drift apart between the two moments. In an agent: a human approves one action, but the model is re-invoked and runs a slightly different one. The fix is to persist the validated input at check time and execute that exact record, not a fresh model call.
Token / BPE (Byte-Pair Encoding): The model reads and writes in subword chunks ('tokens') produced by byte-pair encoding rather than characters or whole words, which is why digit grouping breaks arithmetic and exact character counting.
Tool (for an LLM): A function the model can invoke by name with structured arguments; the set of available tools defines everything the agent is able to do.
Tool poisoning: An attack where malicious instructions are hidden inside a tool's description or metadata, which the model reads into its context before the tool is ever called.
Trajectory: The actual ordered sequence of an agent's decisions, tool calls, arguments, and results over a turn — the thing you reconstruct to debug, as opposed to the model's narrated explanation.
Trajectory evaluation: Grading how an agent reached an answer — the sequence of tool calls, parameters, and confirmations — rather than only whether the final outcome was correct.
Transactional outbox: A pattern solving the dual-write problem by writing an 'enqueue this job' event into an outbox table inside the same DB transaction as the state change, then having a separate relay publish it — making persist-and-enqueue atomic.
Transition dynamics (T): The rules by which an action changes the world and produces the next observation — the harness (workers, database, locks, persistence) that executes and persists effects.
Tree-of-Thoughts (ToT): A reasoning method that explores multiple branching paths with self-evaluation and backtracking; strong on puzzles like Game of 24 but rarely cost-justified in production agents.
Tulving's memory taxonomy: A cognitive-science classification adapted by CoALA — working (current turn), episodic (past trajectories), semantic (facts about world/user), and procedural (skills/how-to) — each needing a different write and decay policy.
Turn trace (span tree): A hierarchical record of one agent turn: a root span (e.g., invoke_agent) with child spans for each generation and tool call, capturing timing, tokens, args, and results.
Verifiable grader / fitness function: An external, objective evaluator against which self-improvement is measured; its quality is the ceiling on how much an agent can improve, since a weak grader invites Goodhart gaming.
Workflow vs agent: A control-flow distinction: in a workflow, code predefines the trajectory and the LLM fills slots; in an agent, the LLM chooses its own actions and tools at runtime.
World model: A model that learns environment dynamics so an agent can plan and learn from simulated 'what-if' rollouts in a latent state rather than only imitating text (e.g., Genie 3, DreamerV3).
Write-path / trust boundary: The moment untrusted input (a document, a user message) is committed into durable memory and thereafter re-read as the agent's own trusted knowledge — the key place to enforce provenance and policy checks.
Write-through memory: A long-term memory pattern where an external store (database or notes file) is the source of truth that survives context resets, with the in-window copy acting as a cache for the current turn.