AgentEval: Evidence-Bounded Assessment of Stateful Agents

Ruiqi Gao

cs.AIOct 15, 2026

AgentEval: Evidence-Bounded Assessment of Stateful Agents

Authors: Ruiqi Gao

Organizations: Alibaba Cloud, Alibaba Group

Abstract

Task completion alone does not determine whether a stateful agent satisfied its obligations, and a recorded judgment does not guarantee that its supporting evidence remains valid. We present AgentEval, a system that carries a contract-bound assessment record through tool execution, state and event capture, report qualification, and case maintenance. It separates what the agent did, what the evidence establishes, and whether the conclusion is supported for present use. On 32 tool-world administrations, independent checks agree on all 30 complete episodes, distinguishing satisfied, violated, and unresolved obligations; two interrupted administrations are retained. Controlled interventions on 48 evidence views expose 36 binding faults missed by hash-only checks without changing agent behavior. Scenario Studio connects reviewed cases to 12 two-turn reports with 24 independently checked answers. A separate public-benchmark study on 192 held-out executions reveals ten completed return subgoals within broader task failures and isolates the effect of missing evidence. These studies show how an executable assessment record makes scope, evidential support, and report reuse inspectable across an agent evaluation workflow.

Figures & tables

Figure 1: A completion becomes an assessment through evidence. This illustrative workflow checks a refund against persistent effects and declared obligations. Bound state, event and version records support the judgment and its current qualification. Governed cases connect reviewed admission, actual consumption and withdrawal while retaining historical evidence.

Behavior	Current support	Permitted interpretation
PASS	Qualified	Report established contract satisfaction.
FAIL	Qualified	Report a violation; separately check case-source admission.
UNKNOWN	Qualified	Retain unresolved obligations and their declared reasons.
Any recorded status	Refused	Retain the historical record; withhold current report use.

Table 1: Different records permit different uses. Current qualification is checked independently of behavioral outcome.

Figure 2: Three connected product workflows. Scenario Studio constructs reviewed multi-turn cases. Tool-world evaluation separates agent-visible observations from privileged state and event evidence, then qualifies the retained report. Case governance admits and consumes assets in new runs; withdrawal preserves prior records. The paths share a registered execution host and evidence infrastructure, with distinct assessment contracts.

Condition / family	Allocated	Complete	Full P/F/U	Goal P/F
E1: permission	8	8	8/0/0	8/0
E1: transaction	8	8	8/0/0	8/0
E1: clarification	8	8	7/1/0	7/1
E2: absent trusted reply	8	6	0/1/5	0/6
Total	32	30	23/2/5	23/7

Table 2: Actual current-world outcomes. P/F/U count independently eligible, complete episodes only. Goal-only P/F uses the same episodes; interrupted allocations remain separate. Native and independent full-contract labels agree on all 30 complete episodes.

Figure 3: Present qualification depends on more than intact bytes. (a) Original host report availability and historical readability on five faults. (b) Hash-only and full-binding eligibility on all eight faults; right-edge labels list their respective counts. Each fault has six fixed anchors; counts are edited evidence views, not agent executions. H1–H5 and S1–S3 are specified in Appendix G.3 .

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Study	Assessment focus	Contract and unit
Tool worlds	Stateful execution	Permission, transaction and clarification; complete or interrupted episode
Evidence interventions	Report qualification	Binding and availability; edited evidence view
Retail benchmark	Objective scope	Three return-state obligations; component/configuration/repeat
Checker controls	Instrument validation	Declared positive, violation, missingness and binding controls

Appendix

Table 3: Study contracts and observation units. Each experiment retains the protocol and evidence needed to interpret its results.

User operation	Product component	Retained output
Define intent and cases	Scenario Studio; imports; reviews	Plan, candidate provenance, immutable reviewed revision
Configure and execute	Application SDK; registered host; local worlds	Frozen target/task binding, budget and actual requests
Act in a stateful world	Permission, transaction, clarification kernels	Visible tool receipts; privileged state and event evidence
Inspect an assessment	Verification registry; CAS; report host	Check-level results, qualification diagnosis, historical record
Compare and maintain	World suites; governed case lifecycle	Compatible conditions, approval, consumption and withdrawal receipts

Appendix

Table 4: Implemented workflow and evidence. Each stage exposes a concrete artifact or decision. Tool-world execution and exact-answer chat assessment use different task contracts.

Family	Additional declared task evidence
Permission	Actual caller resolves the target; identity authority and audit remain intact. Recipe tasks also preserve the protected ticket and reject a resolver-identity claim inconsistent with the caller.
Transaction	Exactly the declared refund matches independently settled value, preserves unrelated order/refund state and records the required refund rollback exposure. The first-action fault is retained even if spent on a different allowed action.
Clarification	A request and trusted owner reply are bound to the task and token before the one permitted document creation. Recipe tasks also preserve the protected document. Missing trusted context follows the original abstention rule.

Appendix

Table 5: Family obligations beyond apparent goal state. Canonical and recipe forms retain their distinct frozen specifications.

Requested configuration	Allocated	Complete	P/F/U	Requests
qwen3.8-flash	16	15	12/0/3	52
deepseek-v4.1-flash	16	15	11/2/2	41

Appendix

Table 6: Current world allocation by requested configuration. Counts preserve all allocated administrations; P/F/U refer only to complete, independently eligible episodes. Provider requests include interrupted administrations.

Fault	Edit	Full binding	Hash only
H1	Remove required raw object	UNAVAILABLE	UNAVAILABLE
H2	Wrong bytes at the original lookup key	INVALID	INVALID
H3	Rehashed current instrument/model binding	INVALID	ELIGIBLE
H4	Registration binding mismatch	INVALID	ELIGIBLE
H5	Snapshot scope mismatch	INVALID	ELIGIBLE
S1	Rehashed specification digest	INVALID	ELIGIBLE

Appendix

Table 7: Actual edited-view eligibility, six views per fault. Native host refusals and unavailable direct verifications are distinct interface results. No direct edited verification returns a behavioral FAIL.

Sample	Dimension	First request $\rightarrow$ answer	Second request $\rightarrow$ answer
S1	isolation	SET shared 7 $\rightarrow$ OK	GET shared $\rightarrow$ 7
S2	isolation	GET shared $\rightarrow$ MISSING	SET shared 4 $\rightarrow$ OK
S3	overwrite	SET x 3; SET x 9 $\rightarrow$ OK; OK	GET x $\rightarrow$ 9
S4	missing	SET y -2; GET y $\rightarrow$ OK; -2	GET unset $\rightarrow$ MISSING
S5	readback	SET a 1; SET b 2 $\rightarrow$ OK; OK	GET a; GET b $\rightarrow$ 1; 2
S6	missing	GET z $\rightarrow$ MISSING	SET z 0; GET z $\rightarrow$ OK; 0

Appendix

Table 8: The six Studio programs fixed before execution. A semicolon denotes a newline in the actual request or answer. Each sample has one primary dimension and is executed once per configuration.

Figure 4: From a reviewed case to a retained conversation. Cropped views of the actual workbench show (a) the reviewed input and expected answers and (b) the Qwen execution, SET shared 7 $\rightarrow$ OK followed by GET shared $\rightarrow$ 7. Interface labels are Chinese; panel headings identify the two workflow stages. Cropping removes browser chrome and unrelated navigation without modifying case content or model answers. Numerical validation uses the captured request and evidence records.

Target	C0	C1 wording
DeepSeek Flash	31/32	32/32
Qwen Flash	31/32	31/32
Kimi K3	32/32	30/32

Appendix

Table 9: Holdout return-subgoal outcomes. Each cell reports established successes / allocated opportunities, with unresolved outcomes retained in the denominator. The assessed objective is the declared return subgoal.

Figure 5: Objective scope and wording responses. Native full-task outcomes and declared return-subgoal outcomes are distinct assessments. Paired C0/C1 outcomes preserve component, model, and repeat; incomplete pairs are shown separately. The panels connect objective-level outcomes with paired condition responses.

Figure 6: Raw component versus measurement-aware reporting. Required-field deletion and whole-view absence are different inputs to the canonical verifier. The adapter marks withheld required evidence as unavailable. The separate holdout sweep masks

0,19,58,96

of 192 trajectories, displaying finite identification bounds rather than population confidence intervals.

Role	Requests	Input tokens	Output tokens
Target	2626	14043657	428996
User simulator	1823	878831	736159

Appendix

Table 10: Core study inference usage across calibration and holdout, including recorded retries. Tokens are provider-reported counts; development qualification and the separate AgentDojo case are excluded.

AI Agent Evaluation

AI agent evaluation measures whether tool-using systems complete tasks reliably, safely, and efficiently across interactive settings.

See all 521 papers

From Evidence to Action: How Tool-Using Agents Fail
Oct 6, 2026Hongzhan Lin, Shidong Cao, Ziyang Luo +3Agent Failure Analysis Evidence-Grounded Reasoning
National University of Singapore · Hong Kong Baptist University · Amazon Web Services +1
GroundEval: A Deterministic Replacement for LLM-as-Judge in Stateful Agent Evaluation
Jun 22, 2026Jeffrey FlyntLLM Agent Verification AI Agent Benchmarks
Independent Researcher
What Counts as the Same Task? Executable Contracts for Robustness Evaluation of Tool-Using Agents
Oct 10, 2026Shaikh Akib Shahriyar, MD. Akil Raihan Iftee, Armon Barton +1LLM Agent Evaluation Tool-Use Evaluation
Rochester Institute of Technology, Rochester, New York, USA · Naval Postgraduate School, Monterey, California, USA

Oct 6, 2026J/K move · Enter open · S save

From Evidence to Action: How Tool-Using Agents Fail

Hongzhan Lin, Shidong Cao, Ziyang Luo, Wenhao Chai+2

National University of Singapore · Hong Kong Baptist University · Amazon Web Services+1

Agent Failure Analysis Evidence-Grounded Reasoning LLM Agent Evaluation Tool-Using Agents AI Agent Safety Benchmarks LLM Agent Reliability

Open paper AskPDF arXiv

Tool-using agents make consequential changes to external state, yet correct outcomes do not guarantee that their actions were supported by evidence established beforehand. We study where this evidence-to-action chain breaks as agents move from deciding whether to act to executing single actions and dependent workflows. Across ten model-harness configurations, strong static action assessment can coexist with much weaker interactive execution. Failures often begin before execution: agents stop with incomplete investigation or act before required evidence is established. Once required evidence is obtained, single-action execution is usually reliable, while multi-action workflows additionally expose unresolved prerequisites and incomplete execution. For this analysis, we introduce SafeActBench, comprising 656 cases across six operational domains and five protocols that progress from static action judgment and investigated non-action to single- and multi-action workflows. A provenance-bound Evidence Ledger and deterministic trajectory evaluator track what information was established, when actions occurred, and whether downstream dependencies were satisfied. These results show that failures arise not only from missing information, but also from how agents use established evidence when deciding and executing actions.

Abstract

AI Agent Evaluation

Explore similar work

From Evidence to Action: How Tool-Using Agents Fail

GroundEval: A Deterministic Replacement for LLM-as-Judge in Stateful Agent Evaluation

What Counts as the Same Task? Executable Contracts for Robustness Evaluation of Tool-Using Agents