Two years ago, saying you evaluated your agents was a differentiator. Now it is table stakes, and the artefact it produces has quietly stopped being useful. Every vendor can show you a dashboard where an agent scores 91 on some suite. Almost none of them can tell you what the 91 does.

In most systems, the honest answer is: nothing. The number lands in a report. A human reads the report, forms an impression, and then separately decides — in a different screen, on a different day, using different reasoning — what the agent is permitted to do in production. The score informs a judgement. It does not constrain an action.

That gap is where the failures live.

What a disconnected score cannot do

It cannot stop the agent from attempting something it scored badly on, because nothing reads the score at execution time. It cannot degrade gracefully when the evidence goes stale, because there is no expiry — a score from March is still 91 in September. It cannot explain a specific refusal, because the refusal, if it happened at all, came from a hand-written rule somewhere else entirely.

And it cannot survive the question that matters, which arrives months later and sounds like this: when this agent did that thing in March, what were we relying on? An eval score cannot answer that. It was never in the causal chain.

What we did instead

In Attest, the score is not the output. The certificate is the output — a depth, per capability, with an expiry, earned by clearing seven gates against a floor. The score is the evidence that produces the certificate, and then the certificate is read at execution time as the second link in the minimum chain.

That has consequences we did not fully anticipate when we designed it:

• A poor score does not produce a warning. It produces a refusal. The finance agent is certified to depth 2, and paying a supplier invoice is a depth 4 action. It does not attempt it and log a low-confidence flag. It declines, and says which gate is short.
• Evidence expires, so the bound moves on its own. A lapsed certificate drops the agent to depth 1. Nobody has to notice and intervene; the absence of current evidence is itself enforced.
• The refusal is legible. Because the certificate is a link in a chain of five bounds, the system can say which link was binding. "Certificate below required depth" is a different answer from "your plan does not include this", and both are different from "the role never permits it".

The uncomfortable part

Wiring the score to enforcement means the score has to be right, because being wrong now has teeth. A scoring harness that is merely indicative can be sloppy at the edges. One that gates production cannot.

This is why Attest scores against your own filed outcomes rather than a public benchmark, why cleared human reviews become scored cases, and why the authoritative gate is supervised review signal — how often a person overturned the agent, weighted by how consequential the overturn was. A benchmark can be gamed by a vendor. Your own overturn rate cannot.

The reasonable objection is that this makes us slower. It does. An agent that has to earn depth reaches full autonomy later than one whose depth is a configuration field. We think that is the correct trade, because the alternative is an agent whose permissions were set by whoever was in the room, justified by a number nobody checked since.