An IT department asks an AI Agent to modify a program. All tests pass, and the manager is ready to approve it. However, a senior engineer takes another look and discovers that the AI Agent called an application programming interface (API) that the company prohibits. The program runs, but the method it uses violates internal policies. If the team asks only “Is it done?” during acceptance testing, problems like this may not be discovered until after delivery.
Microsoft recently open-sourced Scope, an evaluation platform that assigns tasks to different AI coding tools and checks whether they use software development kits (SDKs), APIs, and other related tools correctly. The platform stores the model, version, tool configurations, activity logs, and test results. However, even with identical settings, results may vary from one run to the next, and automated checks can also produce errors. Microsoft therefore recommends running tests multiple times and having people review the activity logs. The message for enterprises is clear: when validating an AI Agent, they must examine not only the outcome but also whether the AI Agent followed the rules and left a complete, auditable record.
Turn “what counts as compliant” into conditions that can be checked one by one
If a company policy says only “follow the standard process,” employees can ask questions when something is unclear, but an AI Agent lacks sufficiently explicit criteria for making decisions. Consider procurement price comparisons. “Complete the price comparison” describes the required deliverable, but it does not specify which supplier data may be consulted, which fields must be checked individually, or whether processing should stop or continue when data is incomplete. When the rules are unclear, even a properly formatted comparison table does not allow a manager to confirm that the process met all requirements.
Completion criteria should therefore clarify at least three things: which data and tools may be used, which methods are prohibited, and which conditions the system should use to determine that the task is complete. If checks must be performed in a particular sequence, their dependencies should also be stated explicitly. For example, the team should first confirm that the program builds successfully, then check SDK initialization and integration testing. Otherwise, a later test that passes could cause reviewers to overlook an earlier error. These conditions do not need to cover every exception from the outset, but each one must be specific enough for a reviewer to decide whether to approve or return the work rather than relying on personal judgment.
The team can begin by identifying the five most common types of SDK, API, or tool misuse. For each one, document when the rule applies, which practices are allowed or prohibited, and how compliance will be determined. Then select one common task for a trial run. If developers and security staff interpret the same rule differently, clarify the rule before expanding its use by AI Agents.
Apply the same rules consistently, with human approval for ambiguous or high-risk situations
Even when policies are stored in a document repository, differences in phrasing or context may prevent an AI Agent from applying the relevant rules. If an enterprise wants an AI Agent to handle the same situation consistently every time, it should turn the judgment of experienced employees into skills (AI Skills). Each skill should clearly state when it applies, which steps to follow, what must not be done, and which situations require the work to be returned. When rules are updated, the team should retain each version and rerun the same tasks. This makes it possible to determine whether an error was an isolated incident or continues to recur after the update.
In EgentWrX, enterprises can encode the judgment of experienced employees as AI Skills for an AI Agent to use when the relevant conditions are met. Before a skill created by an employee can be made available across the company, it must pass a back-office review. Reviewers should assess more than whether the wording is clear. Development and security personnel must jointly confirm which tools the skill uses, which data it can access, and which practices are explicitly prohibited. The skill can be published for others to use only after it passes this review.
Skills allow an AI Agent to follow a consistent method, but no team can anticipate every exception. When a process requires access to internal network data, changes permissions, or involves unclear rules, a designated person should still review and approve it. EgentWrX can require human approval before a task workflow is handed off. After the AI Agent completes the preceding stage, the workflow pauses and continues only after a person approves it. Approval criteria must also be specific, including which evidence must be reviewed, who is authorized to approve the task, and which circumstances require it to be returned. Otherwise, approval can easily become a formality.
For a pilot, start by mapping an existing process and identifying the data received and the results delivered at each handoff. Then classify each stage into one of three categories: tasks that can run automatically, tasks that require human approval, and tasks that can be reviewed by sampling after completion. Next, assign an owner to each approval point and define the conditions for returning work. Do not remove necessary human judgment simply to achieve end-to-end automation.
Go beyond retaining records: make it possible to reconstruct what happened
When an AI Agent makes an error, recording only “success” or “failure” makes it difficult to determine whether the problem came from the rules, tool selection, automated checks, or human approval. An auditable record should, at minimum, connect the model and version used at the time with the tool configurations, execution steps, test results, and approval actions. When a document or tool changes, rerunning the same task allows the team to compare the results before and after the change.
However, having records does not mean the judgments in those records are necessarily correct. An automated check may mark a noncompliant result as passed, and a human reviewer may overlook a critical step. Enterprises must therefore continue to conduct sample reviews. Add failed runs and cases returned by human reviewers to an exception review list. First examine which actions the AI Agent performed, which version of the rules it referenced, and where it began to deviate from the requirements. The team can then decide whether to revise the skill, workflow, or completion criteria. Without a standard review checklist, retaining more records will only increase the time required to investigate them later.
EgentWrX audit logs cover 55 resource types. A hash chain can verify the integrity of the records, which can also be exported through the export center. Even an administrator’s action to download audit records is logged. These mechanisms give IT, security, and audit teams the information they need for reviews, but the enterprise must still decide who is responsible for reviewing the records, how often sample reviews should occur, and who will correct the rules when discrepancies are found.
The first round of validation can begin with one common task. Ask the team to use the records to answer four questions: Which version of the rules did the AI Agent follow? Which tools did it use? Who approved the task? How was the integrity of the records verified? If the team cannot answer any one of these questions, it should fill the gap in the relevant skill, approval point, or logging configuration before considering a broader rollout.
FAQ
If a program has passed its tests, does that mean the AI Agent complied with company policies?
No. Passing the tests proves only that the result met some of the conditions. It does not prove that the AI Agent used the APIs, SDKs, or tools specified by the company. During acceptance, the team must also compare the applicable rule version, tool configurations, and activity logs to confirm that the execution method complied with company requirements.
Which AI Agent actions should require human approval?
Human approval should be prioritized when a task requires access to internal network data, changes permissions, or reaches a handoff point where the rules are unclear. The team should also specify who can approve the task, which evidence must be reviewed, and which circumstances require the work to be returned. This tells reviewers what to examine while avoiding a process in which every step requires approval or reviewers merely click “approve” as a formality.
How many times should the same configuration be rerun to determine whether a problem is recurring?
There is no fixed number that applies to every task. Start by keeping the task, model version, tool configurations, and completion criteria constant. Run the task multiple times, then compare the results to see whether the same type of failure recurs. Each enterprise can set its own number of test runs and approach to human sampling based on the task’s risk level and the variation between runs.
What information should audit records retain at a minimum?
At a minimum, the records should identify the rule version, model and tool configurations, execution steps, test results, and human approval history. The team should also confirm that the records can be exported and that their integrity can be verified. This allows the execution process to be reconstructed when an exception occurs and helps identify which rules or workflows need to be revised.
References
- Microsoft open-sources Scope evaluation platform to track the task performance of AI coding agents — iThome reports on the purpose, operation, and limitations of Microsoft’s open-source Scope platform.
