Trajectory Evaluation

Expanded Definition

Trajectory evaluation examines whether an agent reaches a result through a safe, coherent sequence of actions, not simply whether the final output looks correct. For agentic AI, that means reviewing planning quality, tool selection, memory use, intermediate decisions, and stop conditions across the whole run. This is especially important where an agent can call tools, retrieve context, or trigger downstream actions with real-world impact.

Definitions vary across vendors, but the core idea is consistent: a single correct answer does not prove safe behaviour if the path to that answer relied on hallucinated state, unnecessary tool calls, or unauthorized actions. NHIMG treats trajectory evaluation as a governance and assurance discipline, not just a model-testing exercise. It helps teams detect failures that are invisible in output-only scoring, especially when an agent must behave predictably across multiple steps. For a broader control lens, NIST Cybersecurity Framework 2.0 is useful because it frames repeatable governance, risk management, and monitoring expectations that map well to agent oversight.

The most common misapplication is treating a final-answer benchmark as proof of trajectory safety, which occurs when teams ignore the intermediate decisions that produced the result.

Examples and Use Cases

Implementing trajectory evaluation rigorously often introduces test complexity and review overhead, requiring organisations to weigh deeper assurance against slower release cycles.

• An AI service desk agent gathers account details, checks policy, and performs a reset only after confirming the request path is valid.
• A procurement agent compares vendors, requests approvals, and stops before contract submission when a policy threshold is reached.
• A coding agent opens files, edits code, and runs tests, but evaluation confirms it did not call restricted deployment tools without authorization.
• A security analyst agent investigates an alert by querying logs and enrichment sources, with trajectory checks verifying it did not invent evidence or skip required verification steps.
• A workflow agent using retrieval and tool access follows a bounded plan; evaluation confirms it does not loop indefinitely or continue after task completion.

Trajectory evaluation is closely related to the operational guidance in OWASP Top 10 for Large Language Model Applications, especially where prompt injection, tool abuse, or excessive agency can distort the action path. It is also useful alongside NIST AI Risk Management Framework practices for measurement and ongoing monitoring.

Why It Matters for Security Teams

Security teams care about trajectory evaluation because agentic failure is often procedural before it is visible in the final output. An agent may return a correct answer while still exposing secrets, violating approval rules, or taking an unsafe detour through an untrusted tool. That makes trajectory analysis essential for detecting policy drift, brittle termination logic, and hidden dependence on unverified context.

The identity connection is direct when an agent operates with delegated permissions, NHI credentials, or privileged tool access. In those cases, the question is not only whether the agent was useful, but whether every step stayed within the intended trust boundary. This is where trajectory evaluation complements controls in NIST Digital Identity Guidelines and agent-oriented oversight practices. It also supports evidence-based review under EU AI Act obligations where applicable, especially for systems that can materially affect people or business processes. Organisations typically encounter the need for trajectory evaluation only after an agent has already taken an unsafe action path, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do AI agents require continuous access evaluation?
• What is the difference between static access control and continuous access evaluation?
• How should security teams implement AI evaluation in production workflows?
• What breaks when AI prompts are changed without evaluation?