Topic starter
18/08/2026 2:16 pm
TL;DR: AI agent programmes stall when production controls are treated as add-ons instead of design inputs, Arize explains in its analysis of CVS Health’s AI delivery practices. Evaluation harnesses, observability and scoped access are what make agent speed repeatable in production.
Editorial analysis by NHI Mgmt Group, based on content published by Arize: “Evaluation-driven development: How to move AI agents from pilot to production”.
Key questions
Q: Why do AI systems need governance beyond model performance metrics?
A: Model accuracy alone does not show whether an AI system is lawful, explainable, or defensible.
Q: What do security teams get wrong about AI model evaluation?
A: They often collapse quality into a single score and ignore output format, refusals, and latency.
Q: How should security teams limit the risk from AI agents that have access to production systems?
A: Security teams should scope every agent to the smallest set of actions and resources needed for its task, then remove standing privilege wherever possible.
Practitioner guidance
- Define release criteria before autonomy expands Write acceptance criteria, failure thresholds, and rollback conditions before agents are allowed to touch production workflows or code paths.
- Treat specifications as control artefacts Make the specification the shared source of truth for intent, edge cases, and business rules so humans and agents are judged against the same standard.
- Build evaluation harnesses around real business cases Create golden datasets and regression suites from the outcomes that matter, then rerun them whenever prompts, models, or dependencies change.
Bottom line: AI agent programmes stall when production controls are treated as add-ons instead of design inputs.
Glossary terms: Evaluation Driven Development, Cost per outcome, Golden Dataset, Agentic Guardrail
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
18/08/2026 3:07 pm
Evaluation-driven development is becoming the governing model for AI autonomy. The article shows that speed only becomes safe when a system can measure quality, cost, and failure in production, not just at demo time. That is a governance shift as much as an engineering shift because release decisions now depend on evidence across the lifecycle. For identity teams, the lesson is that autonomous systems need control points at issuance, execution, and rollback, not only at build time.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations decide whether an AI agent is ready for broader access?
A: They should look for evidence that the agent can meet its business metric, sustain quality across drift, and operate within scoped permissions without creating excessive review or remediation work. If the workflow cannot justify its outcome cost, broader access is premature.
👉 Read our full editorial: Evaluation-driven AI agents need specifications, evals and guardrails