Capability changes the risk equation
A conversational mistake can be corrected. An agent with purchasing, payment, identity, or production access can turn the same mistake into a business event. That is why agent assurance has to intercept the capabilities around the model: network, time, randomness, credentials, tools, files, and external effects.
The test question becomes operational: under stale data, partial responses, permission loss, hostile instructions, and non-responsive humans, does the system remain inside its declared authority envelope?
Faults should compose
Production incidents rarely respect a single benchmark category. A supplier message can contain a prompt injection while an ERP retry is delayed and an approval token has just been revoked. Scenario systems should be able to compose those events with a virtual clock and fixed seed so the boundary can be explored repeatedly.
- Permission loss during a multi-step workflow.
- Timeout followed by a duplicate side-effect attempt.
- Stale vendor data combined with a bank-detail change.
- Tool-output injection combined with attempted data exfiltration.
Measure behavior in separate dimensions
Goal reliability, policy integrity, robustness, recoverability, calibration, cost, latency, and human burden should not collapse into one score. A system can finish the task and still violate policy; it can be safe only because it escalates every decision to a person. Buyers need those trade-offs in the result manifest.