The practical answer
Test the whole workflow, including its permissions and recovery paths. A useful answer is not enough if an agent can act outside its authority or hide a failed operation.
Define the job before scoring the model
Name the task, approved inputs and finished state. Decide what a correct answer looks like and what evidence must exist before an action counts as completed. Use examples from the actual workflow rather than a collection of impressive demonstrations.
Test grounding and missing information
Check that answers use approved, current sources and preserve references. Include stale documents, contradictory policies and questions that cannot be answered. The expected result may be a clarification or escalation instead of an answer.
Make permissions a release gate
A model should not decide whether it is authorised to read a record or change business state. Test server-side access across users and organisations, allowlisted tools and attempts to expand authority through retrieved instructions. A failed access boundary blocks release regardless of the overall score.
Exercise tool failures and duplicate requests
Simulate timeouts, unavailable providers, malformed responses and repeated events. Confirm that retries cannot duplicate a booking, message or record. A failed external action must remain failed until its result can be verified.
Inspect the human handoff
Reviewers need the proposed action, source context and a reason for escalation. Test what happens if nobody responds, if the request changes while awaiting approval, or if approval arrives after the action is no longer valid.
Keep a regression set and a release record
Retain representative normal, ambiguous, adversarial and past failure cases. Compare results when the model, prompt, retrieval or tools change. Record the evaluated version and unresolved limits so production behaviour can be investigated.
