When Is an Agent Evaluation Over? Outcome Finality and Cross-Unit Separation
cs.AI, cs.CY
Submitted: 2026-08-14
Updated: 2026-08-27
License: http://creativecommons.org/licenses/by/4.0/
The gist: Agent evaluations commonly score the state observed when a run stops and count the run as one trial.
Terminology
Abstract
Agent evaluations commonly score the state observed when a run stops and count the run as one trial. Interpreting that score as a final result from a separate trial requires outcome finality and cross-unit separation. Outcome finality requires that later events cannot change the claimed result, while cross-unit separation requires that earlier runs cannot change the relevant conditions of later ones. The endpoint establishes neither condition by itself, and the two can hold independently. Waiting for a delayed outcome may settle the label even though its state remains available to another run. Isolation may prevent carryover even though the scored outcome remains unresolved. We develop a completion argument that identifies the evidence needed for each decision. A final success or failure label is justified only when every relevant effect is resolved or bounded tightly enough to fix the outcome. Any remaining uncertainty must be reported. First, in a controlled replay with fixed agent actions, we find that endpoint and terminal labels differ for every nonzero-delay operation and that a delayed write changes the next run's score under shared state but has no such effect after namespacing or verified reset. Second, in a review of ten public protocols, we find that reset or deliberate retention is documented explicitly more often than unfinished operations or evidence for separate scoring. Finally, we propose an open-effects record for operations and resources that may remain relevant after the endpoint, their status, and their possible effects on the scored outcome or another run.
Sources
- Declare and Justify: Explicit assumptions in AI evaluations are necessary for effective regulation
- Done, But Not Sure: Disentangling World Completion from Self-Termination in Embodied Agents
- Cordon: Semantic Transactions for Tool-Using LLM Agents
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
- How Benchmarks Mis-Score Computer-Use Agents
- WorkArena: How Capable Are Web Agents at Solving Common Knowledge Work Tasks?
- Can Agent Benchmarks Support Their Scores? Evidence-Supported Bounds for Interactive-Agent Evaluation
- Scaling Agents for Computer Use
- Measurement and Fairness
- SWE-bench: Can Language Models Resolve Real-World GitHub Issues?
- Training Agents to Self-Report Misbehavior
- Engagement Process: Rethinking the Temporal Interface of Action and Observation
- AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments
- ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities
- What Twelve LLM Agent Benchmark Papers Disclose About Themselves: A Pilot Audit and an Open Scoring Schema
- Do Agent Benchmarks Measure Capability? Protocol Validity in the Age of Agentic AI
- AsyncTool: Evaluating the Asynchronous Function Calling Capability under Multi-Task Scenarios
- Audit Cards: Contextualizing AI Evaluations
- Do Androids Dream of Breaking the Game? Systematically Auditing AI Agent Benchmarks with BenchJack
- Automated Benchmark Auditing for AI Agents and Large Language Models
Related papers
- MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
- Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
- Agents' Last Exam
- The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
- MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
- Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems