# Evaluation

Measurement of a system's behaviour against a defined test — covering the model's output, the sequence of steps it chose, and the effect it had outside itself.

Source: https://aecon.ai/glossary/evaluation
Updated: 2026-09-15

## In practice

Before release, a workflow runs fifty representative jobs plus the known failure cases: a revoked credential, a timeout, a duplicate request and a hostile instruction inside a retrieved document.

## The distinction

A benchmark measures performance on someone else's task set. An evaluation measures the job you are actually delegating, in the configuration you are actually running, against the acceptance test you actually use.

## Evaluator types fail differently

| Evaluator | Useful for | Main limitation |
| --- | --- | --- |
| Deterministic rule | Schema, permissions, tool arguments, resource state, hard limits | Cannot judge contextual or qualitative outcomes |
| Reference comparison | Known answers and required tool events | The reference may allow several valid routes |
| Human review | Consequence, usefulness, professional judgement | Costly and variable without calibration |
| Model judge | Relevance or policy rubrics at scale | The judge has its own errors, bias and drift |
| Adversarial test | Goal hijack, tool misuse, data leakage | A passed set does not prove other attacks fail |

## Judge the effect, not only the trajectory

Trajectory evaluation catches a wrong tool or a missing step. It can also penalise a different valid path, and it misses a whole class of real failure.

A retried CRM write can produce exactly the right visible answer and still create two customer records. So consequential work needs deterministic checks attached to the external effect: the intended record changed once, no unauthorised record changed, the recipient matched the approval, the cancellation stopped later steps, and the provider receipt reconciles with the trace.

## Averages hide the failures that matter

A system completing 95 per cent of jobs may still be unsuitable when the remaining 5 per cent can expose confidential data or send an unauthorised payment.

Severe failure classes belong as hard gates, not as inputs to a mean. Averaging a catastrophic outcome into a reassuring overall score destroys precisely the information a release decision needs.

## Sources & context

- [Trace grading](https://developers.openai.com/api/docs/guides/trace-grading) — OpenAI, 2026. Defines trace grading as scoring the end-to-end record of decisions, tool calls and reasoning steps rather than treating the final response as a black box. Checked 2026-09-13.
- [Evaluation concepts](https://docs.langchain.com/langsmith/evaluation-concepts) — LangSmith, 2026. Separates offline evaluation on curated datasets from online evaluation on production traces. Checked 2026-09-13.

## Related reading

- [Observability](https://aecon.ai/glossary/observability)
- [Accepted job](https://aecon.ai/glossary/accepted-job)
- [Agent harness](https://aecon.ai/glossary/agent-harness)
- [AI model](https://aecon.ai/glossary#ai-model)