AI agent certification levels

How is a composite agent certified?

A composite agent, one assembled from several sub agents, tools or models rather than a single model behind a single endpoint, is certified as one unit of reliance and receives one score. The unit of assessment is the thing a counterparty relies on, not the parts it happens to be built from. In practice that means three additional evidence requirements. The Distribution Control dimension is scored against the widest authority any component holds, not the average, because an attacker or a mistake reaches the whole through the weakest boundary. The Autonomy Envelope is scored against the longest unsupervised chain the composite can execute end to end, including any step where one sub agent invokes another. AI Integration is scored against whether handoffs between components preserve the identity, authority and audit trail of the original request, or quietly launder them. A composite whose components are individually well governed but whose handoffs are not will score below the sum of its parts, which is the intended behaviour.

What should be in an eval suite before an agent goes live?

An evaluation suite that satisfies the Performance and Reliability dimension covers five things, and a suite missing any of them does not score. A held out task set drawn from real production inputs rather than from the examples used to build the agent, with a stated pass threshold agreed before the run. Adversarial cases, including prompt injection attempts against every external data path the agent reads, since prompt injection is ranked LLM01 in the OWASP Top 10 for Large Language Model Applications. Regression coverage, so that the same suite runs against every model or prompt change and results are comparable over time. Failure mode cases that assert what the agent does when a tool is unavailable, a response is malformed or a request falls outside scope, because unhandled failure is where autonomy causes damage. And a recorded run history with dates, versions and results retained, because a suite that exists but has no history proves only that someone wrote it.

Which certification level does an AI agent actually need?

The level follows the exposure, not the ambition. An agent running internal tooling with a human approving anything that leaves the organisation is served by In Progress or Certified, and paying for a higher tier buys nothing a counterparty will read. An agent acting on customers, moving money or producing output a third party relies on should be at Certified as a floor and Advanced where the workflow is regulated, because Advanced sets a minimum of six out of ten in every dimension and so rules out the pattern where a strong governance score conceals a weak oversight design. Elite exists as the top of the scale rather than as a target: it requires eight out of ten in every one of the seven dimensions, which is a description of an unusually mature operation rather than a procurement requirement. The practical question to ask before commissioning an assessment is which tier the counterparty asking for evidence will actually read.