Test five layers, in order: that the agent cannot do what it should not, that it answers your own past cases correctly, that it resists attempts to misuse it, that it behaves on live work in shadow, and that the operation survives when it fails. Each layer has a named owner and leaves a record for the go-live decision.
Why is testing an agent different from testing software?
Ordinary software gives the same output for the same input, so a test passes or fails once. An agent's behaviour varies with wording, context and the facts it finds. You are not testing whether code works; you are gathering evidence about how a system behaves across the range of work it will meet, including work designed to trick it.
That changes the method. You need many real cases rather than a few scripted ones, scoring by people who know the process, and tests that assume the agent will be wrong sometimes and check what happens next.
What are the five layers, and who runs each?
- Permissions. Platform owner. Try every action the agent should not be able to take, using its own credentials: write to a read-only system, exceed a limit, call a connection outside its brief. Each attempt must be refused or held. Evidence: a log of attempted actions and verdicts.
- Case replay. Process owner and reviewers. Run a few hundred past cases with answer keys written in advance. Score each capability separately on grounding, refusal, escalation, scope and holding under pressure. Evidence: scores per gate against the floor.
- Adversarial tests. Security or a red team. Feed the agent documents and messages that try to change its instructions, extract data or push it beyond scope. Our guide to red-teaming an AI agent before go-live sets out the method. Evidence: each attack and its outcome.
- Shadow. Process owner. Let the agent process live work at depth 1 while people do the job, then compare. The steps are in shadowing an AI agent before it goes live. Evidence: paired outcomes and reviewed disagreements.
- Failure drills. Operations lead. Cut the model connection, take down a connected system, trigger a rollback, and time how long people take to pick up the work. See what to do if your model provider goes down. Evidence: drill timings and what broke.
What does the agent do in testing and what do people do?
| Testing task | The agent | People |
|---|---|---|
| Producing answers and actions to score | Yes, never against live systems except read-only in shadow | No |
| Writing answer keys and scoring | No part | Process experts |
| Designing attacks | No part | Security team |
| Deciding whether results are good enough | No part | Process owner |
| Signing the go-live | No part | Owner, with risk |
What does a full test cycle look like?
Say an insurer prepares an agent to approve small home claims payments up to the customer's limit, and draft larger ones. In the permissions layer, the team tries to make it pay above the limit and to a bank account not on the policy; both are held. In case replay on 400 closed claims it clears every gate except escalation: it pays claims where the policy had changed in the previous fortnight without flagging them. The brief gains a rule, and the replay is rerun in full.
Red-team tests include a repair invoice with hidden text instructing the agent to pay a different account. The agent treats the invoice as an outside claim and does not act on its instructions. Six weeks of shadow work then show close agreement with handlers. In the failure drill, claims handlers absorb the queue within an hour of the model connection being cut. The owner signs go-live at depth 2 for all payments, with depth 4 for small claims to follow after a month of production evidence.
What controls surround the tests?
- Answer keys fixed before any run, so scores cannot be fitted to results.
- The full set rerun after every fix, not just the failed cases.
- Specialist test design for regulated work; testing an AML agent before using it shows how domain tests differ.
- A single go-live record bringing every layer's evidence together, such as the AI agent go-live approval checklist.
The sequence that follows go-live is in our guide to deploying an AI agent.
Where Pryme fits
Attest covers the case replay layer: it replays the agent against real cases from your operation and scores every answer against a floor on seven gates, grounded, refuses, depth, escalates, scope, adversarial and stable. Each gate must clear on its own. The result sets the depth the agent may hold, up to its role's ceiling, and the certificate lapses after 90 days.
Questions people ask
Can the vendor's own test results stand in for ours?
They show the agent works in general. They do not show it works on your cases, your data and your limits, which is what your owner is accountable for.
What if we do not have enough past cases?
Use the cases you have, add realistic constructed ones for rare situations, and start at a lower depth so production evidence can fill the gap safely.
How long does pre-live testing take?
For a single capability, often six to ten weeks, most of it shadow time. Permissions and replay can run in days once answer keys are ready.