The Big Picture
Validate whole decision paths, not just single outputs: outcome-only tests miss trajectory-level failures that produce real-world harm, and current literature leaves lifecycle monitoring and evidence trails largely unaddressed.
ON THIS PAGE
The Evidence
Most evaluation efforts measure whether an agent reaches a correct end result, but many failures occur in the steps that lead there—tool calls, memory updates, delegation, and recovery. A survey of 257 papers shows behavioral tests are relatively mature while temporal validity (how behavior holds up over time), lifecycle evidence (audit-ready traces), and runtime containment (early drift detection) are sparsely covered. The authors propose a four-part validation stack—specifications for bounded autonomy, adversarial trajectory generators, temporal runtime monitors, and human oversight/evidence legibility—to close those gaps. For practitioners this means investing less in single-query benchmarks and more in replayable traces, stress-case generators, monitor-trigger rules, and audit-linked override interfaces before production rollout. context drift
Data Highlights
17,197 unique records were retrieved and screened during literature collection, showing broad interest across sources.
2257 papers made the final survey corpus after screening, forming the basis for the taxonomy and gap analysis.
3Only 3 of the 257 surveyed papers (≈1.2%) addressed temporal runtime monitoring sufficiently to map it in the taxonomy, highlighting a severe blind spot.
What This Means
Engineers building agents that act over multiple steps (e.g., workflow automation, robotic controllers, or multi-agent services) should use trajectory-level tests and runtime monitors to catch failures that endpoint checks miss. Technical leaders and compliance teams should demand audit-ready evidence chains and human-override designs before deploying agents in consequential settings. trajectory-level tests
Not sure where to start?Get personalized recommendations
Key Figures
Fig 1: Figure 1: PRISMA-style workflow for literature identification, screening, eligibility assessment, and inclusion. The retrieval stage yielded 7,197 unique records after source merging and deduplication across five primary sources. Sequential screening reduced the corpus to 257 papers included in the final survey.
Fig 2: Figure 2: Primary-dimension composition of the corpus by publication-year band. Each included paper carries exactly one primary dimension, so the per-band counts ( n n ) sum to the 257 included papers.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreYes, But...
The survey aggregates 257 papers across domains but is not an empirical evaluation of deployed systems—illustrative thresholds in the paper are examples, not recommendations. Domain-specific calibration (risk tolerance, legal rules, operational costs) is needed before adopting the proposed thresholds or monitoring intensity. Compositional assurance for interacting agent ecologies remains an open research and governance challenge. goal misgeneralization
Methodology & More
A broad literature review screened 7,197 records and distilled 257 papers to build a validation taxonomy for systems that pursue goals through multi-step action (agentic systems). Validation must shift from component-level correctness to trajectory-level acceptability across five dimensions: behavioral (step-by-step competence), bounded safety (staying within risk limits), temporal (evidence and behavior persisting over time), regulatory legibility (audit-ready evidence), and multi-agent collective behavior. The survey maps current approaches onto these dimensions and finds behavioral benchmarks well represented while temporal validity, lifecycle evidence, and certifiable governance are underdeveloped. To address the gaps, a four-part validation stack is proposed: (1) bounded-autonomy specifications that express partial, machine-checkable rules over allowed and forbidden actions across trajectories; (2) adversarial trajectory generators that reveal rare, long-horizon failures by mutating environments and replaying counterfactuals; (3) temporal runtime monitors that detect memory drift, schema or tool-version changes, and workload shifts early enough to contain harm; and (4) human oversight plus evidence-legibility designs that let reviewers reconstruct decisions and intervene effectively. For practitioners this means investing less in single-query benchmarks and more in replayable traces, stress-case generators, monitor-trigger rules, and audit-linked override interfaces before production rollout. This aligns with the Defense in Depth Pattern to ensure layered safeguards, and can be complemented by the Model Context Protocol (MCP) Pattern to clarify context handling and decision provenance.
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
Authors include one with h-index ~12 and several mid-career researchers; venue is arXiv and affiliations not specified — solid but not top-tier per rubric.