Evaluation and monitoring must produce both internal and public documents enabling independent review.

Audit Trail

High-stakes deployments should produce evidence that allow independent reviewers (internal and external) to assess what was tested, what failed, what was fixed, and what remains uncertain. This evidence should include the following:

• Evaluation plan and success thresholds: The purpose, context, outcome measures, evidence tier and target population as detailed in principle 1.
• Rubrics and scoring guidance, versioned: The prompts or scenarios used to evaluate the agentic AI system, along with how evaluators judge correctness, groundedness, completeness, explainability and clarity, fairness across groups, and reliability under variation.
• Regular testing: Evaluation activities required under principle 1 are repeatable processes that are run regularly and can detect any major changes from the initial testing. Testing and rubrics are updated as necessary. In addition, these tests are run before every meaningful change (i.e., prompts, tools, data sources, models).
• Red team findings: Vulnerabilities discovered and their severity.
• Mitigation records: What changed to address each security finding (guardrails, tool limits, prompt revisions).
• Release artifact: A consistent record summarizing the relevant information specified throughout principle 4 for every deployment event, for both internal and public audiences. For example, what changed and by how much, what passed or failed, what was mitigated vs. accepted as a risk, etc. This document should be prepared and made available to all users, redacting any confidential or sensitive information.

Humans in the Loop

When an AI tool supports decisions about individuals, builders should include meaningful explanations and safeguards against unfair or opaque decisionmaking, and evaluators should ensure that the system regularly measures and reports on human rubber-stamping.

• Include meaningful explanation and contestability: Systems affecting individuals should support explanations that help people understand outcomes and the basis for decisions, and they should allow people to challenge them where appropriate.
• Avoid human rubber-stamping: If human oversight is called for at certain stages in the process, such oversight must be meaningful; “oversight” that merely approves the agent output without review is insufficient. Systems should be designed to collect data on and regularly report a measure of how meaningful the human review is. One option for accountable owners is to regularly (i.e., quarterly or annually) audit the system to ensure human oversight is being properly applied and is truly adding value to the process.

Next section: Deploying Agentic AI