AI Basics

AI Basics

If you’re just starting to learn about AI, the terminology can get confusing quickly. Here are some of the most common AI terms explained.

Four terms worth understanding first

LLM = Brain

Understands your request and generates responses.

RAG = Research

Lets the AI look through your information before answering.

Agent = Worker

Lets the AI perform multiple steps and take actions.

MCP = Connector Standard

Provides a common way for the agent or LLM to access tools and data.

Once these four concepts make sense, most of the rest of modern AI architecture becomes much easier to understand.

AI Term Breakdown

Term	Plain-English meaning	Simple example
AI	The broad category: computers doing things that normally require human-like intelligence.	Recognizing images, answering questions
Machine Learning (ML)	AI that learns patterns from data instead of being explicitly programmed for every situation.	Spam detection
LLM	A Large Language Model. The actual AI model that understands and generates language.	GPT, Claude, Gemini, Llama
Prompt	The instructions or question you give the AI.	“Explain this firewall rule.”
Context	Information the AI can currently see while answering you.	Your prompt, previous messages, attached documents
Token	Small chunks of text that an LLM reads and generates.	Roughly pieces of words
Context Window	How much information the AI can consider at once.	A model might be able to read a large document plus your conversation
RAG	Retrieval-Augmented Generation. The AI searches your documents/data first, then uses what it finds to answer.	Ask an AI questions about your firewall documentation
Embedding	A mathematical representation of meaning used to find similar information.	Finding documents related to “VPN problems” even if they don’t use those exact words
Vector Database	A database commonly used to store embeddings so AI can quickly find related information.	Searching thousands of internal documents for relevant sections
Agent	An AI that can take actions, use tools, and perform multiple steps instead of just answering a question.	“Check these firewall rules, find risky ones, and create a report.”
Tool	Something an AI/agent is allowed to use.	Web search, Python, database, API
API	A way for one program to communicate with another program.	An AI calling the Palo Alto API to retrieve security policies
MCP	Model Context Protocol. A standard way to connect AI applications to tools and data.	An MCP server gives an AI access to GitHub, databases, or firewall information
MCP Server	The program that exposes tools/data through MCP.	A Palo Alto MCP server might provide get_rules, get_interfaces, and search_logs
Function Calling	A way an LLM tells software which tool/function it wants executed.	AI requests get_firewall_rule("Internet-Out")
Fine-tuning	Additional training that changes how a model behaves or responds.	Training a model to consistently use your company’s terminology
Inference	Running a trained AI model to get an answer.	You ask an AI a question and it generates a response
Hallucination	When an AI confidently gives incorrect or made-up information.	Inventing a firewall rule that doesn’t exist
Guardrails	Rules that limit what an AI or agent is allowed to do.	Let an agent read firewall configs but prevent it from changing them

The easiest way to understand the big pieces

Think of an AI system like an employee at a computer:

LLM
The employee's brain
        |
        v
Prompt
What you ask the employee to do
        |
        v
Agent
The employee deciding what steps to take
        |
        v
Tools / APIs
The applications the employee can use
        |
        v
MCP
A standard way to give the employee access to those tools
        |
        v
RAG
How the employee searches reference material before answering

For example, suppose you want an AI that can answer questions about your firewalls:

You
 |
 | "Which firewall rules allow ANY source?"
 v
LLM / Agent
 |
 +-- MCP --> Palo Alto API
 |              |
 |              +-- Retrieve firewall policies
 |
 +-- RAG --> Your security standards/documentation
 |
 v
Answer
"These 4 rules allow ANY source..."

-eof-