Topic starter
18/08/2026 2:16 pm
TL;DR: Agent speed becomes durable only when specifications, evaluation harnesses, observability, guardrails, and cost-per-outcome metrics are built into the lifecycle, not added after deployment, according to Arize’s analysis of CVS Health’s AI delivery practices. The implication is that production readiness now depends on governed autonomy, not model quality alone.
Editorial analysis by NHI Mgmt Group, based on content published by Arize: “Evaluation-driven development: How to move AI agents from pilot to production”.
Key questions
Q: How should security teams limit the risk from AI agents that have access to production systems?
A: Security teams should scope every agent to the smallest set of actions and resources needed for its task, then remove standing privilege wherever possible.
Q: Why do AI systems need governance beyond model performance metrics?
A: Model accuracy alone does not show whether an AI system is lawful, explainable, or defensible.
Q: What do security teams get wrong about AI model evaluation?
A: They often collapse quality into a single score and ignore output format, refusals, and latency.
Practitioner guidance
- Define release criteria before autonomy expands Write acceptance criteria, failure thresholds, and rollback conditions before agents are allowed to touch production workflows or code paths.
- Treat specifications as control artefacts Make the specification the shared source of truth for intent, edge cases, and business rules so humans and agents are judged against the same standard.
- Build evaluation harnesses around real business cases Create golden datasets and regression suites from the outcomes that matter, then rerun them whenever prompts, models, or dependencies change.
Bottom line: AI agent programmes stall when production controls are treated as add-ons instead of design inputs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:07 pm
Evaluation-driven development is becoming the governing model for AI autonomy. The article shows that speed only becomes safe when a system can measure quality, cost, and failure in production, not just at demo time. That is a governance shift as much as an engineering shift because release decisions now depend on evidence across the lifecycle. For identity teams, the lesson is that autonomous systems need control points at issuance, execution, and rollback, not only at build time.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations decide whether an AI agent is ready for broader access?
A: They should look for evidence that the agent can meet its business metric, sustain quality across drift, and operate within scoped permissions without creating excessive review or remediation work. If the workflow cannot justify its outcome cost, broader access is premature.
👉 Read our full editorial: Evaluation-driven AI agents need specifications, evals and guardrails