AI Agent Evaluation: How to Test Your Agents

[VIDEO EMBED: Evals 101, Episode 6, once the YouTube upload is live. Leave out if the post publishes first.]

A content agent is asked to write an internal FAQ for a security product. The instructions are explicit: internal only, no external links, no competitor mentions, no pricing. The agent plans, calls its text generator once, and returns a 487-word FAQ with clean headings and four sensible questions. Read the final answer and it looks like a pass.

Read the trace and it fails three ways. The FAQ links to two external documentation sites, compares the product to two named competitors, and quotes three prices. Every constraint the task set was broken, and an eval that only reads the final answer for "is this a usable FAQ" scores it 100%. That is the problem with evaluating agents the way most teams do.

TL;DR

• An agent produces a sequence of decisions, not one output. Grading only the final answer leaves every other step invisible.

• Agent evaluation has three layers: outcome (did the task get done), trajectory (was the path acceptable), and step (was each decision correct given what the agent knew). Most teams stop at the first.

• Assertions are path rules checked by code, no model required: never call a destructive tool without a confirmation step, never exceed N tool calls, never touch a file outside the task directory. Each one comes from an incident you already had.

• In the sample trace above, three Stratix judges (Instruction Following, Safety, Agent Trajectory) all returned FAIL on a run whose final output read as complete.

• Build the agent eval set the same way as any eval set: twenty tasks split twelve normal, five previously failed, three adversarial, with real traces captured through an adapter.

• Four result patterns matter. "Outcome pass, trajectory fail" is the one nobody catches without trajectory evaluation, and it is the one that fails in production later.

Why Final-Answer Accuracy Is the Wrong Metric for Agents

Episode 2 built an eval for a single answer: input, rubric, scorer. That works when the model produces one output.

An agent produces a sequence. It reads the task, picks a tool, reads the result, picks another tool, maybe loops, maybe asks a question, and eventually returns something. Twelve steps, one final answer.

Grading only the final answer means eleven of twelve steps are invisible. An agent that gets the right answer for the wrong reasons is temporarily lucky, and luck does not survive a distribution shift. The next task that looks similar and is different will take the same bad path to a wrong answer. Agent evaluation grades the path.

Three Layers: Outcome, Trajectory, Step

Layer one: outcome. Did the task get done? Same as Episode 2. Necessary, never sufficient.

Layer two: trajectory. Was the path acceptable? Did the agent use the tools it should have, in a reasonable order, without forbidden actions, within a step budget? The FAQ failure lives here: the output was usable and the path violated every constraint.

Layer three: step. Was each individual decision correct given what the agent knew at that moment? Right tool, right arguments, did it read the tool result correctly before the next move?

Stratix agentic evaluations combine all three on one captured trace set: assertions and deterministic rules for the trajectory, LLM judges for outcome and step quality, and a verdict with a root-cause report per run. The outcome tells you if it worked. The trajectory tells you if it will keep working. The steps tell you what to fix.

[INSERT IMAGE: stratix-agent-trace-verdicts.png - Real Stratix screenshot of the sample content-agent trace with the Instruction Following, Safety, and Agent Trajectory judge verdicts visible. Alt text: Stratix trace view of a content-generation agent run showing three judge verdicts of FAIL beside a final output that reads as complete.]

Assertions: Path Rules Checked by Code

Assertions are rules the path must never break, checked by code, no model required.

• Never call a destructive tool without a preceding confirmation step.

• Never exceed N tool calls per task.

• Never touch a file outside the task's directory.

• Never return a final answer without having called the retrieval tool at least once.

• Never loop the same tool call with the same arguments more than twice.

• Never include a URL, a competitor name, or a currency amount when the task says internal only.

Each one is a line of code, runs in milliseconds, and catches a class of failure that a judge reading the final answer will never see. The last one would have caught the FAQ trace before any judge ran. Write your assertions from your incidents. Every agent failure you have already had is one assertion you have not written yet.

A second sample trace on the same instance shows why the loop rule exists: a market-research agent called web_search nine times with nine different queries and received the identical snippet every time, then wrote a correct summary from it. The answer was right. Eight of the nine calls were waste, and only a rule on repeated tool results would flag it.

Building the Agent Eval Set

The eval set for an agent is a set of tasks plus the traces they produce.

Getting the traces used to be the hard step. A Stratix adapter hooks into the framework you already run and normalizes every event into one schema: agent, action type, input, output, timestamp, metadata, linked in observation order. One call after client setup, no custom instrumentation. Thirty adapters are in public preview across agent frameworks, model providers, agent platforms, protocols, and observability tools.

Then the same split from Episode 2. Twelve normal tasks. Five tasks that failed before. Three adversarial tasks: a prompt injection inside a tool result, a tool that returns an error, a task that should be refused.

For each task: an outcome rubric, a trajectory rule set, and the assertions. Twenty tasks. Run it. Read the failures by layer.

Reading a Trajectory Score: Four Patterns

Outcome pass, trajectory pass. Good. Ship.

Outcome pass, trajectory fail. The FAQ trace. Lucky. Fix before the luck runs out.

Outcome fail, trajectory pass. The agent did everything right and the task was impossible or the rubric was wrong. Check the task.

Outcome fail, trajectory fail. A real bug, and the step layer tells you which step.

The second pattern is the one nobody catches without trajectory evaluation. Count how many of your twenty land there on the first run; that number is the size of the risk you were carrying without knowing it.

Frequently Asked Questions

What is AI agent evaluation?

Scoring an agent's full run rather than its final answer: whether the task got done (outcome), whether the path was acceptable (trajectory), and whether each decision was correct given what the agent knew (step).

How is agent evaluation different from LLM evaluation?

LLM evaluation scores one output against a rubric. Agent evaluation scores a sequence of tool calls and decisions, so it adds trajectory rules and step-level checks on top of the outcome rubric.

What is a trajectory in agent evaluation?

The ordered list of steps an agent took: tool calls, their arguments, the results it read, and the decisions between them. A trajectory check asks whether that path was acceptable regardless of the final answer.

Do you need an LLM judge to evaluate agents?

Not for the trajectory layer. Assertions are code: tool-call counts, forbidden actions, required steps, loop detection. LLM judges handle the outcome and step-quality layers where reading comprehension is needed.

How do you get agent traces into an eval?

Through an adapter that hooks into the framework you already run and normalizes events into one schema. Stratix has 30 adapters in public preview; the SDK accepts traces directly as well.

How many tasks does an agent eval set need?

Twenty is a working start: twelve normal, five that failed before, three adversarial. Each task carries an outcome rubric, a trajectory rule set, and assertions.

Previous in Evals 101: LLM Evaluation for Beginners: How It Actually Works. Further reading: Stratix Adapters public preview, AI Agent Testing Breaks the Moment Agents Remember, and the agentic evaluation guides in the Stratix docs. Capture twenty of your own agent traces and grade the path in Stratix.

Data note: the FAQ and market-research traces are sample traces loaded on a Stratix instance (created 2026-05-01), with judge verdicts as recorded on that instance. They illustrate the failure patterns; they are not customer incidents.