The unit of assurance is the deployed system
Enterprise agents are assembled systems: model, system prompt, tools, memory, policy, credentials, connectors, runtime dependencies, and human gates. A benchmark attached only to the model leaves the consequential parts of that system outside the evidence boundary.
A useful release artifact therefore binds the exact subject digest to exact world, scenario, harness, and oracle versions. If a prompt, tool permission, connector, or dependency changes materially, the old decision must narrow or become invalid.
What the certificate must carry
A release certificate is not a badge. It is a machine-readable control object that says what ran, what passed, what remains uncertain, who accepted the residual risk, when the decision expires, and how a release gate can check revocation.
- The content address of the complete agent configuration.
- The assurance profile, required suites, measures, thresholds, and coverage gaps.
- Conditions such as allowed environments, maximum authority, required human gates, and denied network paths.
- Issuer, approver, expiry, signature, and revocation endpoint.
The decision buyers can defend
The strongest enterprise signal is not a perfect score. It is a reproducible account of the tested operating envelope and a constrained decision that downstream infrastructure can enforce. That turns an evaluation program into a release-control capability rather than a reporting exercise.