Pick one action at one depth and prove it on your own filed cases. A named owner defines the capability, approves the case set and sets a floor for each of the seven gates. The agent is replayed against every case and scored. If every gate clears, the certificate records the agent, the depth and an expiry 90 days out.
What is a single-capability agent, and who owns it?
A capability is one thing an agent does at one depth, in one customer's operation. "Handles refunds" is not a capability. "Drafts refunds up to the customer's limit for a person to send" is one. "Issues refunds within the daily limit" is another, at depth 4, and needs an agent certified to depth 4. Splitting work this finely is the point: an agent can be trusted to draft and not to send, or to read and not to write, and the record should say so.
This is why we argue that autonomy levels are not enough. A general level tells you how much freedom a vendor designed for. An agent's certificate tells you what this agent has proven it can do on your work.
The capability owner is usually the head of the team whose work it is. They own the definition and the decision to go live. Risk or compliance reviews the floors. The platform enforces the result.
What are the steps?
- Person, capability owner: defines the capability. The action, the depth, the systems touched, the customers or products in scope and what is out of scope.
- Person: sets the ceiling. The agent's role sets the most depth it may ever have. Evidence will set the actual depth; the lower wins.
- Agent, depth 1: assembled as a candidate. The brief, its sources and its connections. At this stage it is a candidate with no live depth.
- Person: approves the case set. Filed cases from your own operation that exercise this capability, including edge cases, cases where the right answer is to refuse, and cases where it should escalate.
- Person: sets the floors. One floor for each gate: grounded, refuses, depth, escalates, scope, adversarial, stable.
- Agent, replay only: answers every case. In replay, every action is simulated. Nothing touches a live system.
- Scoring: every answer against every gate. Each gate clears or fails on its own. A strong grounded score cannot make up for a weak escalation score.
- Person: reviews failures and signs. The owner reads the failed cases, even when every gate clears, and approves go-live at the evidenced depth.
- Platform: issues the certificate. It lapses after 90 days. A run before then that clears no depth drops the agent to depth 1 the same day.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Define | Nothing | None | The capability's scope |
| Ceiling | Nothing | None | Role ceiling |
| Candidate | Brief, sources, connections assembled | None live | Approving the brief |
| Case set | Nothing | None | Choosing the cases |
| Floors | Nothing | None | Setting each floor |
| Replay | Answers every case, simulated | Replay only | None |
| Score | Scored per gate | Replay only | None |
| Review | Nothing | None | Reading failures, approving go-live |
| Certificate | Granted evidenced depth | Lower of evidence and ceiling | Revocation |
What decisions does a named person keep?
Four decisions never move to the platform or the agent. The definition of the capability, because a vague definition lets the agent pass on easy work and act on hard work. The case set, because whoever picks the cases decides what "proven" means. The floors, because a floor is a statement of how much error the business accepts. And go-live, because someone must be accountable for switching it on.
Each of these is filed with the person's name. If an auditor asks why the agent may issue refunds at depth 4, the answer is a chain of named decisions, not a configuration screen.
What record does it produce?
The certificate itself states the agent, the customer, the depth granted, the ceiling, the case set version, the floor for each gate, the score for each gate, the reviewer, the date and the expiry. Behind it sits the run record: every case, every answer, every score, every failure.
That record does three jobs. It shows a supervisor what was proven. It gives you the baseline the next run is compared against. And when the brief changes, it shows exactly what has to be proven again, which is the subject of re-certifying an agent after its brief changes.
What should you measure?
- Gate scores against floors, gate by gate, run by run.
- Live verdicts that contradict the certificate. An agent certified to draft that is refused for trying to send is telling you something about its brief.
- Days to expiry across all certificates, so none lapse by surprise.
- Failed cases reviewed by the owner. Should be all of them.
Where does it usually go wrong?
Capabilities defined too broadly. "Customer service" cannot be certified. If you cannot write a case that clearly passes or fails, the capability is too vague.
Generic test sets. Public benchmarks measure models on someone else's work. Benchmark scores do not certify an agent for your operation, because your cases, your policies and your edge cases are what matter.
No real cases yet. New products have no filed history. Certifying an agent without real data is possible with constructed cases, but the certificate should say so and the depth should stay low until real cases exist.
Certifying the vendor instead of the agent. A vendor's certificate says something about the vendor. It does not say what this agent will do with your customers.
The full picture of what certification means is in what it means to certify an agent.
Questions people ask
Can one run cover several capabilities at once?
One run can replay cases for several capabilities, and the agent is certified to one depth: the highest its evidence proved. A pass on drafting says nothing about sending.
Who should not be the capability owner?
The person who built the agent's brief. Ownership of the result should sit with the team whose work and customers are affected.
What happens if the ceiling is lower than the evidence?
The agent runs at the ceiling. Raising it is a risk decision for the customer, and the evidence is already on file if they do.