| Stencil | Description and AI / LLM use cases |
|---|---|
| Model (LLM / Foundation Model) |
Model (LLM / Foundation Model)The model is the trained generative engine at the heart of an AI system: a large language model or other foundation model that turns a prompt into text, code, structured output or a tool call. The shape can carry provider, model name and version, so a reader sees exactly which model is meant. Where it fits: Use it to show that a support assistant runs on one frontier model while a cheaper small model handles classification, or to record that a code-review agent is pinned to a specific model version for reproducible evaluations. It is also the natural place to show a fine-tuned or self-hosted model next to a hosted API model. |
| Embedding Model |
Embedding ModelAn embedding model converts text, images or other content into numeric vectors so that similar meanings sit close together. It is a different kind of model from a chat LLM: it does not generate answers, it produces the representations that search and retrieval depend on. Where it fits: Draw it on both sides of a RAG pipeline: once at ingestion, where policy documents are chunked and embedded into a vector store, and again at query time, where the user's question is embedded with the same model. Showing it explicitly makes the common mistake of mixing embedding models between indexing and querying easy to spot. |
| Reranker |
RerankerA reranker is a model that takes the candidates returned by a first-pass search and reorders them by how well they answer the query. It is usually slower but more precise than vector similarity, so it is applied to a short list rather than a whole corpus. Where it fits: Place it between the retriever and the LLM in a RAG flow: the vector store returns 50 passages, the reranker keeps the best 5, and only those go into the context window. This cuts token cost and reduces the distracting passages that cause an LLM to ground its answer on the wrong evidence. |
| AI System |
AI SystemThe AI system is the top-level, conceptual box for a solution whose behaviour depends on one or more models or agents. It is meant for context-level diagrams that show the system, the people who use it and the outside services it depends on, without exposing its internals. Where it fits: Use it for a customer-service copilot sitting between support staff, the CRM and a ticketing tool, or for an internal research assistant that sits in a diagram next to the HR and finance systems. It is the starting point from which later diagrams zoom into agents, memory and tools. |
| Agent |
AgentAn agent is a model-driven component that pursues a goal by planning, deciding and taking actions, typically in a loop of reasoning, tool calls and observation. What separates it from a plain model call is that it chooses its own next step and acts on the result. Where it fits: Use it for a coding agent that reads a repository, edits files and runs the test suite, or an incident-triage agent that reads alerts, queries logs and proposes a fix. Metadata such as framework and trust level can sit on the shape, which helps when one diagram mixes a LangGraph agent with a vendor-hosted one. |
| Sub-agent |
Sub-agentA sub-agent is an agent that a parent starts for one bounded job. It works in its own context, so its reading and tool output do not fill the parent's context window, and it returns only a result. Unlike a handoff, control comes back to the parent. Where it fits: Use it for a coding agent that sends a sub-agent to search a large repository and report the three relevant files, or a research agent that starts one sub-agent per source. Connect it to the parent with the agent-as-tool connector. Draw an orchestrator instead when coordination is the component's main job, and an agent team when you want to hide the members. |
| Agent Team (nested) |
Agent Team (nested)An agent team is an ensemble of agents drawn as a single agent with a drill-down marker. It hides internal coordination at the level of the current diagram and signals that a more detailed diagram exists. Where it fits: Use it to represent a research crew (searcher, reader, writer and reviewer) as one box in a platform overview, then link it to a detailed diagram showing how they hand work to each other. It keeps top-level views of multi-agent systems readable when there are many specialists. |
| Orchestrator / Supervisor |
Orchestrator / SupervisorAn orchestrator, or supervisor, is an agent that breaks a task into parts, assigns each part to workers and combines the results. It owns the overall goal and decides when the work is finished. Where it fits: Use it for a market-analysis system where a supervisor sends pricing, news and regulatory questions to three specialist agents, then merges their findings into one brief. It is also the right symbol when you must show who can retry a failed sub-task or stop a runaway workflow. |
| Router / Triage |
Router / TriageA router, or triage agent, sits at the front of a system and picks which single specialist should handle an incoming request. Unlike an orchestrator it chooses and hands off rather than splitting the work and merging the answers. Where it fits: Use it for a helpdesk entry point that classifies a message as billing, technical or account security and forwards it to the matching agent, or for a gateway that sends simple questions to a small model and hard ones to a larger one. Its decision logic is a frequent source of misrouting, so it deserves its own symbol. |
| Planner |
PlannerA planner produces a plan or task graph that other agents then follow. It separates thinking about what to do from doing it, which makes the plan inspectable, editable and reusable. Where it fits: Use it for a data-analysis assistant that turns 'explain last quarter's churn' into ordered steps (pull data, segment, test hypotheses, chart, summarise), or for a travel agent that drafts an itinerary for human review before any booking. Showing the planner makes it clear where plan approval can be inserted. |
| Evaluator / Critic / Judge |
Evaluator / Critic / JudgeAn evaluator, also called a critic or judge, checks another component's output and either passes or rejects it. It is the quality gate of an AI workflow and can be an LLM acting as judge, a rule set or a test suite. Where it fits: Use it for an LLM-as-judge that scores generated answers for faithfulness against retrieved sources, or a reviewer agent that rejects a draft contract summary and sends it back with feedback. It is also the right symbol for offline evaluation harnesses that run regression suites before a prompt or model change ships. |
| Short-term / Working Memory |
Short-term / Working MemoryShort-term, or working, memory holds conversation and task state for the duration of a session: recent messages, intermediate results and the current plan. It lives within the context window or a session store and disappears when the session ends. Where it fits: Use it to show that a booking assistant remembers the dates and destination a user gave three turns ago, or that a coding agent keeps a scratchpad of files it has already read. Drawing it separately from long-term memory makes clear what is forgotten at the end of a conversation. |
| Long-term Memory |
Long-term MemoryLong-term memory keeps facts, preferences or experience across sessions. In LLM systems it is usually an external store that the agent writes to and reads from, because the model itself does not remember between calls. Where it fits: Use it for a personal assistant that recalls a user's dietary restrictions next month, or for a sales agent that retains notes about an account's past objections. It is also where privacy reviews should look first, since it determines what personal data persists and for how long. |
| Knowledge Source |
Knowledge SourceA knowledge source is a document corpus or system of record that an AI system uses to ground its answers. It is the authoritative content, as opposed to the index built from it. Where it fits: Use it for a policy library, a product manual set, a wiki or a ticket archive that feeds an internal Q&A assistant. Showing the source separately from the vector store makes ownership, freshness and access rights visible, which is essential when answers must be traceable to an approved document. |
| Retriever |
RetrieverA retriever finds relevant context for a query: the R in RAG. It takes a question, searches one or more knowledge stores and returns passages that are then placed in the model's prompt. Where it fits: Use it for a support bot that fetches the three most relevant help-centre articles before answering, or a hybrid retriever that combines keyword and vector search over legal documents. Because retrieval quality often limits answer quality, drawing it as a distinct component makes it easier to monitor and tune. |
| Vector Store |
Vector StoreA vector store holds embeddings and answers similarity queries, returning the items whose vectors are nearest to a query vector. It is the index that makes semantic search over large collections fast. Where it fits: Use it for the searchable index behind a company-wide document assistant, or for a store of past support tickets used to find similar cases. Draw the link from an embedding model into it to show how content gets indexed, and from the retriever to show how it is queried. |
| Shared Datastore / Blackboard |
Shared Datastore / BlackboardA shared datastore, or blackboard, is common state that several agents read and write instead of messaging each other directly. Agents coordinate indirectly through what they find there. Where it fits: Use it for a multi-agent investigation in which a fraud-detection agent, a document agent and a sanctions-screening agent all post findings to one case file, and a reviewer reads the combined result. It is the symbol to choose when you want to show loose coupling rather than a call chain. |
| Prompt Template |
Prompt TemplateA prompt template is a reusable, parameterised prompt: fixed wording with placeholders that are filled in at run time with user input, retrieved passages or variables. It is a versioned artefact in its own right, not just text inside code. Where it fits: Use it for a 'summarise this ticket in three bullets for an engineer' template filled with each ticket's content, or a classification prompt with a slot for few-shot examples. Showing it lets reviewers see which prompt version feeds which agent, which matters when behaviour changes after a wording edit. |
| System Instructions |
System InstructionsSystem instructions are the standing directions that define an agent's role, tone, boundaries and output format. They are applied to every turn and take priority over what a user types in conversation. Where it fits: Use them for a legal-intake agent told to never give advice, to cite only provided documents and to answer in a fixed JSON format. Drawing them as a separate element helps in security reviews, where the question is which agent has which instructions and who is allowed to change them. |
| Tool |
ToolA tool is a callable action made available to an agent, such as a function, an API call or a code executor. The model decides when to call it, supplies arguments and reads the result. Where it fits: Use it for a calendar-lookup function used by a scheduling assistant, a SQL-query tool used by an analytics agent, or a calculator that spares an LLM from doing arithmetic. It marks the boundary where the model stops generating text and starts causing real effects, which is where permissions belong. |
| External Tool |
External ToolAn external tool is a tool that sits outside the system's own boundary, such as a third-party SaaS or partner API, and is highlighted in red. The highlight draws attention to the fact that data leaves the controlled environment. Where it fits: Use it for an agent that posts to a payment provider, sends email through an external gateway or searches the open web. It helps risk reviews answer which agent can reach outside services and where prompt-injected instructions could cause real-world harm. |
| Agent Skill |
Agent SkillAn agent skill is a packaged folder of instructions, plus optional scripts and resources, that an agent loads only when a task calls for it. Only its name and description sit in context until then, so an agent can have many skills without using up its context window. It teaches the agent how to do something, whereas a tool gives it an action to call. Where it fits: Use it for a 'prepare the quarterly report' skill that bundles formatting rules and a chart script, or a 'review a contract' skill that carries the checklist a legal team expects. Do not confuse it with the skills listed in an A2A Agent Card, which advertise what a remote agent offers to other agents. |
| Generated Code |
Generated CodeGenerated code is code that a model writes during a run and executes as a side step, with the output fed back to the agent. The model uses code instead of answering directly because code is exact, repeatable and can handle more data than fits in a prompt. It is written at run time, so nobody has reviewed it before it runs. Where it fits: Use it for an analyst agent that writes Python to compute statistics over a large file, or an agent that writes a short script to call several tools at once and return only the summary. Draw a trust boundary around it to show where it is sandboxed, and use the direct API call connector for any API it reaches. |
| MCP Host / Client |
MCP Host / ClientAn MCP host, or client, is the application side that connects to MCP servers on behalf of an AI model. It manages the connections, discovers what each server offers and relays the model's requests. Where it fits: Use it for an AI-enabled IDE, a desktop assistant or an agent runtime that links to several servers at once. Drawing it clarifies who holds the user's consent and credentials, since the host usually decides which servers a model may talk to. |
| MCP Server |
MCP ServerAn MCP server exposes tools, resources and prompts over the Model Context Protocol so that any compatible host can use them. It is the standard wrapper around a data source or capability. Where it fits: Use it for a server that exposes a company's ticketing system, a file-system server for a coding assistant or a database server offering read-only queries. Showing it separately from the underlying system makes clear that the integration, and its permissions, are built once and reused across hosts. |
| MCP Tool |
MCP ToolAn MCP tool is a sub-element of an MCP server: a callable action with a name, a description and a typed input schema. The model can choose to call it during a conversation. Where it fits: Use it for 'create_issue' on a project-management server or 'run_query' on an analytics server. Listing tools individually lets you document which actions can change state and which only read, which is the basis for approval rules. |
| MCP Resource |
MCP ResourceAn MCP resource is a sub-element of an MCP server that exposes read-only data, such as a file, a database record or a log. It is something the application can load into context rather than something the model executes. Where it fits: Use it for a repository file served to a coding assistant, a customer record shown to a support copilot or the latest dashboard export. Distinguishing resources from tools clarifies what is only informational and what can cause side effects. |
| MCP Prompt |
MCP PromptAn MCP prompt is a sub-element of an MCP server: a reusable template the server publishes so a host can offer it to users, often as a slash command or menu entry. It packages good instructions together with the data they need. Where it fits: Use it for a 'review this pull request' workflow or a 'draft a customer reply' template supplied by the ticketing server. Drawing it shows that prompt content is managed by the server owner and not only by the application developer. |
| Human Actor |
Human ActorThe human actor is a person who uses, supervises or is affected by the AI system. It keeps people visible in a conceptual picture so that automation is not drawn as if it runs on its own. Where it fits: Use it for a claims handler working with a triage assistant, an analyst receiving reports from a research agent or an administrator maintaining policies. Different people can be shown with different roles, which makes it clear who may approve, override or audit what the agents do. |
| Human-in-the-loop Checkpoint |
Human-in-the-loop CheckpointA human-in-the-loop checkpoint is a step in which the workflow pauses for human approval, correction or input before continuing. It is the point where responsibility for a decision is passed to a person. Where it fits: Use it before a refund is issued by a customer-service agent, before a generated email is sent to a client or before code is merged to production. Showing the checkpoint explicitly makes it easy to discuss which actions need review and what happens when no one responds. |
| Data Classification |
Data ClassificationData classification labels data as it enters an AI system, by sensitivity or type, such as public, confidential or personal. It decides nothing by itself: later steps read the label to choose which model, store, tool or person may handle the data. A guardrail blocks; a classifier labels. Where it fits: Use it at the start of a RAG ingestion pipeline, so confidential contracts are indexed separately and only reach authorised users, or in front of a chat input, so messages containing personal data go to a self-hosted model rather than a hosted API. Link it to the policy that defines the labels and the guardrail that enforces them. |
| Guardrail |
GuardrailA guardrail filters or blocks input and output against a policy. It can sit before the model to stop prompt injection and sensitive data, or after it to catch toxic, off-topic or non-compliant responses. Where it fits: Use it for a PII redactor in front of a hosted model, a topic filter that keeps a banking assistant from giving investment advice or an output validator that rejects malformed JSON. It marks the enforcement point, whereas the policy symbol marks the rule being enforced. |
| Policy |
PolicyA policy is a rule set that governs what agents, tools or data may do. It captures the intended rules, such as who can access which data, which actions need approval and which content is forbidden. Where it fits: Use it for an access policy limiting a HR assistant to non-confidential documents, a spending limit on a procurement agent or a data-residency rule for model calls. Linking policies to the guardrails and checkpoints that enforce them makes compliance reviews traceable. |
| Agent Runtime / Framework |
Agent Runtime / FrameworkThe agent runtime, or framework, hosts the agents and runs their loops: scheduling, state, tool dispatch, retries and tracing. Examples include LangGraph, an agent SDK or a managed agent platform. Where it fits: Use it to show that three agents run inside one framework with shared tracing, or that a legacy agent and a new one run on different runtimes and talk over a protocol. It answers operational questions such as where state is stored and which component enforces timeouts. |
| Model Gateway |
Model GatewayA model gateway is a proxy that routes, meters and guards calls to models. It gives applications a single entry point for provider access, keys, quotas and logging. Where it fits: Use it for a platform team that offers one internal endpoint to many applications, applies per-team budgets, falls back to a second provider during an outage and records prompts for audit. It is also the natural home for caching and for central content filtering. |
| Agent Card |
Agent CardAn agent card is the discovery manifest of the Agent2Agent protocol, published at a well-known URL. It describes who an agent is, what skills it offers, how to reach it and how to authenticate. Where it fits: Use it where one organisation's agent needs to find and call another's, such as a procurement agent discovering a supplier's quoting agent. Drawing it shows what is publicly advertised about an agent, which is relevant when you decide what to expose. |
| A2A Client |
A2A ClientAn A2A client is the agent or application that starts an Agent2Agent interaction. It reads a remote agent's Agent Card, sends it a task and follows the task's progress. The role is per interaction, so an agent can be a client in one exchange and a server in another. Where it fits: Use it for a travel-planning agent that asks a partner airline's agent for options, or an internal procurement agent that requests quotes from a supplier's agent. Connect it to the A2A server with a delegate or handoff edge and add the «a2a» protocol label, because the pattern comes first and the protocol second. |
| A2A Server |
A2A ServerAn A2A server is a remote agent exposed over the Agent2Agent protocol. It publishes an Agent Card, accepts tasks from other agents, and reports progress and results, while its internal tools, memory and prompts stay hidden from the caller. That opacity is what separates it from calling a tool. Where it fits: Use it for a supplier's quoting agent that other companies' agents can call, or a central compliance agent shared by several business units, each built on a different framework. Attach an Agent Card to it, and place a trust boundary between it and the client when they belong to different organisations. |
| Event Channel |
Event ChannelAn event channel is a publish-subscribe channel that agents react to. Producers post events without knowing who consumes them, and any interested agent can respond. Where it fits: Use it for an operations setup where an alert agent publishes 'payment latency rising' and diagnosis, notification and capacity agents all react. It suits loosely coupled systems in which agents are added or removed without redesigning the flow. |
| Task Region |
Task RegionA task region groups the work belonging to a single task, including the agents, tools and data involved in it. It is a marker that tells the reader what is in scope for one job. Where it fits: Use it to separate 'resolve this support ticket' from 'update the knowledge base' in a single diagram, or to show which components take part in one research request. It helps keep multi-purpose platform diagrams understandable. |
| Conversation Boundary |
Conversation BoundaryA conversation boundary marks a group-chat scope with a moderator and shared context. Everything inside it sees the same message history and takes part in the same discussion. Where it fits: Use it for a design-review session in which an architect agent, a security agent and a cost agent discuss a proposal under a moderator, or for a negotiation between buyer and seller agents. It makes clear which agents share context and which do not. |
| Trust / Organisation Boundary |
Trust / Organisation BoundaryA trust or organisation boundary marks where ownership or trust changes. Things inside belong to one organisation or security domain, and anything crossing the line needs scrutiny. Where it fits: Use it to separate your own agents from a partner's agents, an internal network from a hosted model provider or a sandbox from production. It shows where authentication, data-loss prevention and prompt-injection defences need to apply. |
No stencils match your search.