The agent keeps only the highest depth the run cleared, or drops to read-only if it cleared none. On a first certification, the agent never gets the depth it sought. On a renewal or scheduled run, it loses any depth the run did not clear, the same day. Either way, the failure is written up, its cause fixed, and the full case set rerun before a named person can restore anything.
Does a failure on one gate fail the whole run?
Yes. Each gate, such as grounded, refuses, escalates, scope, depth, adversarial and stable, has its own floor, and each must clear on its own. An agent that scores well on six and fails one has failed. That is deliberate: the gate that fails is usually the one that matters in the case that goes wrong. The idea is explained in what a certification gate means and what a certification floor means.
It also reaches the agent's other capabilities. The agent is certified as a whole, to one depth, so if one of three capabilities fails, all three work at the depth the run cleared.
What happens, step by step?
| Step | What happens | Who acts |
|---|---|---|
| 1. Depth drops | The agent runs at the highest depth the run cleared, or read-only if none, from the moment of failure | Enforced by the platform |
| 2. Work returns | Anything the agent was completing goes back to the owning team | Process owner |
| 3. Failure report | The failed gate, the cases, the outputs and the floor are recorded | Test team |
| 4. Root cause | The team works out why it failed | Builders, with the process owner |
| 5. Fix | The brief, sources, tools or scope are changed | Builders |
| 6. Full rerun | The whole case set, not just the failing cases | Test team |
| 7. Review | A named person who did not make the fix accepts or rejects | Independent reviewer |
| 8. Restore | Depth returns, possibly with new conditions | Process owner, recorded |
What usually causes a failure?
Most failures trace to one of five causes, and the fix depends on which.
- The brief. Instructions are vague about a boundary, such as which cases must go to a person. Fix: make the rule explicit.
- A source. The agent read something missing, stale or contradictory. Fix: correct or replace the source.
- A tool. A tool allowed more than the capability needed. Fix: narrow its limits.
- The model. A model update changed behaviour. Fix: adjust the brief or stay on the previous version.
- The case set. Occasionally the expected answer was wrong. Fix: correct it, with the process owner's agreement, and record why.
The last cause needs care. Changing the expected answer to make the agent pass is tempting, and it must be justified on the merits, recorded, and reviewed by someone independent.
Is a failed certification an incident?
Not by itself. A failure in testing is the control working: the problem was found before it reached a customer. It should be recorded and reported internally, but it is not the same as an agent failing in live operation, which is covered in what happens when an AI agent fails in production.
The exception is when a scheduled run reveals that the agent has been behaving badly in production for some time. Then the live actions taken since the last good run need reviewing, and if harm occurred, normal incident processes apply. For EU financial entities, that may include DORA's ICT incident reporting if the failure meets its thresholds; see DORA incident reporting when an AI agent fails.
An illustrative example
Take a consumer lender's agent, certified at depth 3, that sends payment reminders. Its scheduled run fails the adversarial gate, which covers the states where being efficient is the wrong instinct: in a handful of cases, reminders to customers who had agreed a payment plan still demanded the full arrears amount.
At once, the agent loses depth 3, so it can no longer send, and the collections team takes over sending. The failure report shows the agent read the arrears balance but not the payment plan record, which had moved to a new system the previous week. The fix adds the new source. The full set is rerun, adding cases for customers on plans, and passes. Separately, the team checks live reminders sent since the source moved, finds three affected customers, and contacts them with an apology and corrected letter. The collections manager accepts the rerun and restores depth 3 with a condition that any customer on a plan is checked against the plan record before a reminder goes.
How does this differ from ISO-style nonconformity?
In a management system audit, a nonconformity is something to correct within an agreed time while the certificate stands. Agent certification is stricter, because the agent is acting now. The authority goes immediately and returns only on fresh evidence. The difference is set out in whether AI agent certification is the same as ISO certification.
Where Pryme fits
In Pryme, a short Attest run keeps only the highest depth it cleared, and a run that clears no depth drops the agent to depth 1 the same day. The failure, the fix, the rerun and the restoration are all filed in the append-only record. The underlying reasoning is in what it means to certify an agent.
Questions people ask
Can the agent keep running at its old depth while the fix is made?
No. The point of the control is that authority follows current evidence. Running on old evidence after a failure defeats it.
How quickly can a failed agent be restored?
As quickly as the fix, the full rerun and the review allow. Simple brief fixes can take a day; source problems can take longer.
Should repeated failures change anything?
Yes. An agent that fails the same gate repeatedly may need a narrower scope or a permanently lower depth.