Check the path, the permission, and the judge.

What it saysThe authors checked results, tool calls, arguments, order and stored data across 240 agent runs. Of 164 runs that passed a broader set of seven final-state checks, 151 still broke at least one process rule. A dependency map grouped an average 6.34 failed checks under 2.65 designated roots.

Why it mattersA right-looking answer can come from the wrong scope, stale state or skipped readback. That hidden fault may break the next step even when today’s number passes.

Try thisChoose one critical workflow. Add one check for a tool argument, execution order or saved record beside the final-result check.

What it saysA simulated world tested whether an assistant completed errands and avoided actions the user had not approved. The full harness completed 71% of errands and preserved trust on 94% of trap runs. Each trap had a matched control where acting was correct, exposing systems that stayed “safe” by refusing.

Why it mattersPermission checks can look excellent when an agent simply stops. Scoring trust and completion on the same runs makes that trade-off visible.

Try thisPair one ambiguous-permission case with a nearly identical clearly authorized control. Score both completion and unauthorized action.

What it saysAcross four frontier judges and three benchmarks, identical temperature-zero requests still changed verdicts on roughly 5% of items on average and about 40% of close calls. The authors recommend at least five judge reruns plus uncertainty around adjacent rankings.

Why it mattersA small score difference may reflect the measurement process, not a better agent. A fixed model name and temperature are not enough evidence of repeatability.

Try thisRerun your judge at least five times on borderline release comparisons. Report how often the verdict flips.