Standing Eval

A standing eval is a repeatable test that remains active after deployment and is rerun whenever the system changes. In agent governance, it helps teams detect drift in model behaviour, prompt behaviour, or tool usage before the changes expand into production risk.

Expanded Definition

A standing eval is a persistent evaluation harness that stays attached to a deployed AI or agentic system so it can be rerun after prompts, model versions, tool permissions, retrieval sources, or policy logic change. Unlike a one-time benchmark, it is meant to reveal regression over time, especially where behaviour shifts are subtle and only visible under repeated testing. In NHIMG’s view, the term is still evolving in practice because some teams treat it as an offline quality gate, while others use it as a governance control for ongoing assurance.

This matters most in systems where the model can take actions, call tools, or influence downstream decisions. A standing eval is useful for spotting prompt injection susceptibility, tool misuse, unsafe refusals, or unwanted changes in routing behaviour after deployment. It also supports the security discipline of continuous verification, which aligns well with the intent of NIST Cybersecurity Framework 2.0 even though no single standard uses the term exactly this way. The most common misapplication is treating a standing eval as a one-off launch checklist, which occurs when teams stop rerunning it after model updates, prompt edits, or toolchain changes.

Examples and Use Cases

Implementing standing evals rigorously often introduces operational overhead, requiring organisations to balance faster release cycles against the cost of repeated testing and triage.

• Rechecking an agent after a prompt template change to see whether tool calls now trigger in situations that previously stayed read-only.
• Running the same adversarial conversation set after each model upgrade to detect new jailbreak success, especially where NIST Cybersecurity Framework 2.0 style governance expects ongoing risk management.
• Validating that retrieval-augmented answers still cite approved sources after the knowledge base changes, rather than drifting toward stale or unsafe content.
• Testing whether a customer-service agent begins disclosing more data than policy permits after a change to memory, logging, or tool permissions.
• Comparing pre-change and post-change outputs for high-impact tasks such as account actions, credential resets, or policy enforcement to catch unsafe behavioural drift early.

Why It Matters for Security Teams

Standing evals help security teams turn AI assurance from a snapshot into a continuous control. That matters because agentic systems can degrade quietly: a small update to a prompt, connector, or model version can change how an AI agent interprets instructions, selects tools, or handles sensitive content. If that drift is not measured, organisations may believe a control still works when it has already weakened.

For identity and access environments, the connection is especially important when agents are allowed to act on behalf of users, query secrets, or trigger privileged workflows. A standing eval can expose whether an agent now over-requests access, bypasses guardrails, or behaves differently under malformed input. It also supports governance evidence when teams need to show that changes were tested before release. As usage in the industry is still evolving, organisations should define what triggers reruns, what failure thresholds matter, and who owns remediation. Organisations typically encounter the impact only after an unsafe agent action, unexpected data exposure, or customer incident, at which point standing eval becomes operationally unavoidable to prove what changed and when.

Related resources from NHI Mgmt Group

• What is Zero Standing Privilege (ZSP) and how does it apply to NHIs?
• When should organisations prioritise Zero Standing Privilege for non-human identities?
• When is zero standing privilege more useful than broader access models?
• When does AI agent access become too risky to leave standing?