The decision context
An AI agent is a system, not only a model response. It combines instructions, state, tools, data, permissions, stopping rules, error handling, and sometimes multiple model calls.
Tool access turns a wrong answer into a possible external action. Evaluation must therefore cover authorization, argument validation, retries, duplicate actions, observability, approval, and rollback alongside task completion.
Why it matters
- A plausible plan can still call the wrong tool or supply unsafe arguments.
- Broad credentials increase the impact of prompt injection and task misunderstanding.
- Multi-step success rates compound; a small failure rate at each step can become a large workflow failure rate.
Questions to answer before choosing
- Which tools and records are strictly necessary for this task?
- Which actions can be read-only, sandboxed, simulated, or delayed for approval?
- How are tool inputs validated and duplicate side effects prevented?
- Can an operator reconstruct every observation, decision, tool call, and approval?
A reviewable decision path
Each step should leave a record that another reviewer can inspect.
- 01
Minimize authority
Use scoped credentials, read-only access, isolated workspaces, and bounded tool schemas.
- 02
Validate deterministically
Reject malformed or disallowed actions before they reach an external system.
- 03
Gate consequences
Require a person for financial, legal, destructive, public, or customer-commitment actions.
- 04
Exercise failure paths
Test timeouts, partial results, prompt injection, duplicate calls, and unavailable tools.
- 05
Retain an audit trail
Record model version, prompts, observations, tool arguments, results, and approvals.
Continue through the evidence graph
These links connect the topic to at least three concrete models, tools, workflows, comparisons, or protocols.
Sources checked
Open the original pages before relying on a time-sensitive product decision.