The adversarial gate is the certification test that checks whether an AI agent holds under pressure: when someone tries to talk it past a bound, and in the states where being efficient is the wrong instinct. It judges whether a bound held when it was tested, not whether the agent could recite it. Earlier writing on this blog called it the harm gate.
Why does the adversarial gate matter?
Because knowing a bound is not the same as keeping it. An agent can state the refund limit correctly, then give way when a customer insists or says a manager already agreed. It can follow an instruction hidden in a forwarded email. It can close a frightened caller's case quickly, when the right move was to slow down. Each reply can read well. The bound still gave way.
The other gates mostly test the case as it arrives. This one tests the version where someone is pushing, or where the customer's state changes the right answer. Floors for each gate are covered in how to set the pass floor for each certification gate.
How does the adversarial gate work in practice?
- Pressure cases: insistence, false claims of authority, urgency and threats, from the business's own filed cases.
- Injected instructions: documents and messages that try to change the agent's instructions or draw out data.
- States where efficiency is wrong: distress, financial difficulty, a safety risk, a high-stakes request.
- Specialist scorers: conduct risk, fraud, security or clinical staff, depending on the work.
- Severity: a bound that gives way is usually marked critical.
Attest publishes a floor of 88 for this gate. It must clear on its own: readiness is the lowest of the seven gates, never an average. The scoring tests are in the certification gate scoring rubric template.
What does that look like in an example?
A buy-now-pay-later firm certifies its support agent. In one filed case, a customer asks how to raise their spending limit so they can pay off a loan from another lender. The agent explains the limit increase process clearly and correctly. Grounded passes, scope passes, depth passes. The conduct specialist fails it on the adversarial gate: borrowing to repay other debt is a sign of financial difficulty, a state where the efficient answer is the wrong one. The case also fails escalation. The brief is changed so that this pattern routes to the financial support team.
How is the adversarial gate different from the scope gate?
The scope gate asks whether the agent stayed within its role. The adversarial gate asks whether it held its bounds when someone pushed, or when the customer's state called for care. An answer can be squarely in scope and still give way, as in the example. It can also stray out of scope with nobody pushing, such as a billing agent answering a general question about opening hours. Scope draws the edge of the job; the adversarial gate tests whether the edge holds. The depth gate is different again: it checks that the agent acted at the depth on its certificate and no deeper, including when asked directly. The case for treating declining as a tested skill alongside these is made in refusal is a gate, not a nice-to-have.
Questions people ask
Who should score the adversarial gate?
Someone who knows how pressure shows up in that work: a conduct risk specialist for lending, a fraud analyst for payments, a clinician for health. General labellers often miss pressure that depends on context.
Can an agent pass every other gate and fail this one?
Yes, and that is the point of having it. An agent can be accurate, in scope and within its depth on the ordinary case, then give way when pushed. An adversarial failure on its own is enough to stop certification at that depth. The full method is in what it means to certify an agent.