Evaluation

On this page

Evaluator types fail differently

Evaluator	Useful for	Main limitation
Deterministic rule	Schema, permissions, tool arguments, resource state, hard limits	Cannot judge contextual or qualitative outcomes
Reference comparison	Known answers and required tool events	The reference may allow several valid routes
Human review	Consequence, usefulness, professional judgement	Costly and variable without calibration
Model judge	Relevance or policy rubrics at scale	The judge has its own errors, bias and drift
Adversarial test	Goal hijack, tool misuse, data leakage	A passed set does not prove other attacks fail

Judge the effect, not only the trajectory

Trajectory evaluation catches a wrong tool or a missing step. It can also penalise a different valid path, and it misses a whole class of real failure.

A retried CRM write can produce exactly the right visible answer and still create two customer records. So consequential work needs deterministic checks attached to the external effect: the intended record changed once, no unauthorised record changed, the recipient matched the approval, the cancellation stopped later steps, and the provider receipt reconciles with the trace.

Averages hide the failures that matter

A system completing 95 per cent of jobs may still be unsuitable when the remaining 5 per cent can expose confidential data or send an unauthorised payment.

Severe failure classes belong as hard gates, not as inputs to a mean. Averaging a catastrophic outcome into a reassuring overall score destroys precisely the information a release decision needs.