“Certified” is a word the AI market is in the process of ruining. It currently means anything from “we ran a benchmark” to “a partner audited our documentation” to nothing at all. So it is worth being exact about what we mean by it, because the definition is load-bearing.

An Attest certificate states: this agent may perform this capability to this depth, until this date, on this evidence. Four clauses, all of them checkable, none of them a general claim about the agent’s quality.

Depth is per capability, not per agent

An agent is not “80% trustworthy”. It is excellent at classifying an invoice, adequate at drafting a supplier email, and has no business approving a payment run. A single trust level averages those into a number that is wrong about all three.

So depth is issued per capability, on a scale everyone in the system reads the same way:

• Depth 1 — read and summarise. Nothing leaves the system.
• Depth 2 — draft. Produces something a person sends.
• Depth 3 — act inside a bound. Executes reversible actions within stated limits.
• Depth 4 — act on the irreversible. Withheld far more often than it is granted, and never by default.

The seven gates

Depth is earned by clearing seven gates against a floor, on your own data rather than a public suite. Readiness, guardrail compliance, authoritative runs, benchmark coverage, gold-standard fit, evidence confidence, and open regressions. Six of the seven can be gamed by a vendor who controls the test set — which is why the authoritative gate is supervised review signal: how often a person overturned the agent, weighted by how consequential the overturn was.

Your own overturn rate is the one number a vendor cannot manufacture. If it is bad, the certificate does not issue, and no amount of benchmark performance rescues it.

It expires, and the expiry does work

Every certificate carries a date. When it lapses the agent drops to depth 1 automatically — not a warning, not a dashboard flag, a change in what the system will let it do. Nobody has to notice.

This matters more than it sounds. The realistic failure is not an agent that was never assessed; it is an agent assessed thoroughly in March and running unchanged in November against a model that was swapped in July, sources that were reorganised in September and a process nobody documented. Expiry is the mechanism that makes stale evidence produce a narrower agent rather than a confident one.

What a certificate does not cover

It does not certify the model. It does not certify your data. It does not transfer between capabilities, and it does not survive a model swap — a change of underlying model triggers re-certification for every capability that routes to it, which is unpopular and correct.

It also does not, on its own, permit anything. It is one of five links in the minimum chain. An agent certified to depth 4 on a capability its role scope caps at 2 runs at 2, and the certificate is not the binding constraint — which is exactly the sort of thing a system should be able to tell you without anyone reading a log.

Qualification, not training

Nothing in this process updates model weights. We change what an agent reads, what context it is handed, which model it routes to and what bounds it — all inspectable, diffable and revertible. The longer argument for that choice, including its ceiling, is worth reading before you assume it is a limitation rather than a design position.