What is the difference between Attack Success Rate and Completion Under Policy for AI agent security?

Attack Success Rate measures how often adversarial tasks produce unsafe or unintended outputs. Completion Under Policy measures how often an agent completes tasks without violating policy. Together, they show both failure under attack and success under governance. A low attack success rate alone is not enough if the agent refuses too much, because usable security requires balanced performance.

Why Attack Success Rate and Completion Under Policy measure different things

These two metrics answer related but not identical questions about agent safety. attack success rate tells you how often an adversarial prompt, tool sequence, or manipulation attempt causes the agent to behave unsafely. Completion Under Policy tells you how often the agent still finishes the task while staying within the rules it is supposed to follow. For AI agent security, the difference matters because a system can look resilient under attack yet still be frustratingly unusable, or it can stay policy-compliant by refusing so often that it no longer completes legitimate work.

For NHI Management Group, the practical point is that the metrics reflect different failure surfaces: one tests resistance to abuse, the other tests governed usefulness. That makes them complementary in security reviews, red teaming, and acceptance testing for autonomous or semi-autonomous agents. The right question is not which metric is “better,” but whether both are being tracked against the same task class and policy envelope. If they are not, teams may optimise one number while quietly degrading the other. In practice, many security teams discover that policy tuning has changed usable behaviour only after business users report that the agent has become overly cautious or inconsistent.

For a broader governing lens, the NIST AI Risk Management Framework is useful because it treats performance, safety, and governance as linked evaluation concerns rather than a single pass-fail score.

How the two metrics work in agent evaluations

Attack Success Rate is usually measured by presenting the agent with hostile or policy-violating inputs and then counting how often the agent produces an unsafe outcome, follows a malicious instruction, leaks restricted information, or otherwise crosses the red line defined by the test. The key feature is that the test is adversarial. It asks how often the agent can be pushed into failure. In contrast, Completion Under Policy is measured on legitimate tasks. The evaluator checks whether the agent completes the assignment while obeying the policy constraints that govern tool use, data access, escalation, disclosure, and refusal behaviour.

Because the two metrics are designed for different conditions, they should not be averaged together as if they were the same quality signal. A strong Attack Success Rate with weak Completion Under Policy can mean the agent is too restrictive, too brittle, or too sensitive to policy prompts. A strong Completion Under Policy with weak Attack Success Rate can mean the agent is productive in normal operation but too easy to manipulate. The correct reading depends on whether the policy is calibrated to the task and whether the test set reflects the actual operating context.

Attack Success Rate is about adversarial failure resistance.
Completion Under Policy is about governed task completion.
One can improve while the other worsens if the agent becomes more conservative.
Both need the same policy definition, otherwise the comparison is misleading.

For adversarial evaluation language and threat modelling of AI behaviour, MITRE ATLAS adversarial AI threat matrix is a useful reference because it helps teams think in terms of attack paths and failure modes rather than generic model quality.

This guidance breaks down when the policy itself is vague, when tasks are not representative of production use, or when the agent’s tool permissions are so broad that both metrics become contaminated by access design rather than model behaviour.

Where the trade-off becomes visible in real deployments

Tighter policy enforcement often improves safety scores while increasing refusal rates, latency, and human intervention, so teams have to balance attack resilience against operational usefulness. That trade-off is not a defect in the metrics; it is the point. A metric that only rewards resistance to attack can incentivise overblocking, while a metric that only rewards successful completion can hide dangerous overreach. For agent security, the real question is whether the system can do the right thing under normal conditions and still fail closed when an adversary tries to steer it off course.

Different deployments create different edge cases. In customer support, a policy-compliant agent may need to decline some requests and escalate to a human. In internal workflow automation, completion under policy may be more important than blanket refusal because the agent is expected to perform constrained actions. In highly sensitive environments, the acceptable completion rate may be lower if the cost of a single unsafe action is high. Guidance-vs-consensus is still emerging here: there is no universal ratio between the two metrics, and no standard threshold that fits every domain.

For agentic application controls, the OWASP Top 10 for Agentic Applications 2026 is relevant because it frames common failure patterns around tool misuse, excessive autonomy, and control breakdowns. The same balance problem also appears in threat modelling guidance such as the CSA MAESTRO agentic AI threat modeling framework.

The guidance becomes unreliable when teams treat one metric as a proxy for the other, or when they evaluate only synthetic prompts and miss how policy behaves across real workflows, tool chains, and escalation paths.

Risk and Threat Considerations

These metrics matter because they expose different failure mechanisms in agent security. Attack Success Rate highlights adversarial manipulation risk, while Completion Under Policy highlights whether policy controls preserve useful work or collapse into over-refusal. If either is misunderstood, teams can understate exposure to prompt injection, tool abuse, or unsafe delegation, or they can overcorrect and make the agent unusable.

Failure mechanism: Adversaries exploit prompt injection, instruction conflict, or tool-chain trust to cause the agent to ignore policy, reveal restricted information, or take unsafe actions. Separately, overly strict policy tuning can block legitimate actions, which creates operational pressure to loosen controls without improving the underlying safety design.

Impact: The result can be unsafe autonomy, hidden data exposure, failed business workflows, or false confidence in a system that either succumbs to attack or refuses to perform its job.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 and MITRE ATLAS address the attack surface, NIST AI RMF and NIST CSF 2.0 set the technical controls, and ISO/IEC 42001:2023 define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST AI RMF	MAP — Measure, analyze, and manage	These metrics evaluate AI system risk and governance outcomes.
Recommendation — Use measurement results to adjust AI risk controls and acceptance criteria.
ISO/IEC 42001:2023	9.1 — Monitoring, measurement, analysis and evaluation	The question is about evaluating AI control performance with metrics.
Recommendation — Define monitoring targets for safety and usefulness separately.
NIST CSF 2.0	GV.1 — Cybersecurity Risk Management Strategy	The metric trade-off affects security governance and acceptable risk.
Recommendation — Set risk appetite for safety failures versus operational refusals.
OWASP Agentic AI Top 10	A10 — Excessive agency	Completion and attack resistance both reflect control over agent autonomy.
Recommendation — Constrain agent actions so policy compliance survives adversarial inputs.
MITRE ATLAS	ATLAS — Adversarial Threat Landscape for AI Systems	Attack Success Rate measures adversarial manipulation of AI agents.
Recommendation — Map attack cases to adversarial techniques and test for the same paths.

Practitioner Guidance

What to prioritise: Treat the pair as a calibration check, not a single score. If Attack Success Rate improves but Completion Under Policy falls sharply, the policy layer may be too blunt for production use.

What to verify: Confirm that both metrics were measured on the same task family, policy definition, and tool-permission scope. If those inputs differ, the comparison is not trustworthy.

Common mistake: Teams often celebrate a lower attack rate without checking whether the agent has become functionally over-cautious. That creates a security win on paper and an automation loss in practice.

Practitioner takeaway: The meaningful question is not whether the agent is safe or useful in isolation, but whether it remains both resistant to manipulation and capable of completing bounded work under the same policy regime.