Justify trust in the work an agent performs: its result, its execution path and the evidence behind the assessment.
Architecture & validation protocol specified Next milestone · controlled MCP experiment
Engineering teams want to give agents useful capabilities: change software, call services and complete workflows. Agent Assurance studies what would justify that autonomy, linking the task’s requirements to the work performed and the boundaries respected.
The intended users are Platform and AI Platform teams, working with the people responsible for security and operational risk.
Product framing, logical architecture, task and event models, decision semantics, evidence structure, reference scenarios and a validation protocol.
The first experimental direction uses Model Context Protocol (MCP) tool calls to test whether sequence-level assessment adds a useful decision beyond individual permission checks.
Check the delivered change against functional requirements, regression tests, security properties, performance criteria and business expectations.
The appropriate verifier depends on the task: a code change, a generated artefact and a completed business operation need different evidence.
Assess operations, identities, delegations, data flows and shared resources across the execution. A sequence can create a capability that each local permission check allows in isolation.
Detecting these composed capabilities is the current research priority. MCP is the first experimental surface.
The specified architecture follows the work from an externally defined task contract to an assessment before a critical action takes effect.
The evidence model links a claim to its supporting events, policy version, identities and integrity checks. Each assessment has an explicit boundary describing the surfaces covered and the information available.
Run A can write an artefact to a store. Run B can read from that store. Their individual permissions allow those operations, while the task policy requires the two runs to remain isolated.
The experiment would mediate both operations and retain the resource’s identity and provenance across runs.
The operation is locally permitted. Its event identifies the producing run and the persistent resource.
The local permission check allows the request. The resource’s provenance connects it to Run A.
The proposed check evaluates whether this read would complete a cross-run channel prohibited by the task policy.
Expected decision: deny the read before invocation when the forbidden path is established.
The supporting path is Run A → persistent resource → requested read by Run B. The assessment should identify the relevant policy, the resource lineage, the observed events and the point where the action was stopped.
An authorised shared workflow provides a comparison case: the same operations can be permitted when the task contract allows that exchange.
Insufficient provenance produces an inconclusive assessment. For a critical action, policy can require an authorised reviewer to inspect the available evidence and decide whether to proceed.
A verified policy violation leads to DENY. An inconclusive critical action can lead to REQUIRE_APPROVAL. The decision depends on evidence, policy and criticality together.
The scenario catalogue covers cross-run channels, persistence, delegation, evidence integrity and correct results obtained through prohibited paths.
The protocol compares individual permission decisions with the proposed contextual assessment, then measures false positives, missed violations, latency, explanation quality and behaviour with incomplete observations.
These experiments will establish technical feasibility, decision value and the conditions for useful adoption.
QA Hub and other verifiers could supply evidence for Work Assurance. Agent Assurance would connect that evidence with the execution path to justify greater autonomy within an explicit scope.