An agent can produce the correct final answer through an unsafe or wasteful path. That run should not pass.
Evaluate the complete trace. Check whether the agent chose the right tool, formed valid arguments, respected permissions, interpreted results correctly, and stopped when the task was complete. Add failure cases for unavailable tools, empty results, timeouts, and partial success.
Deterministic assertions work well for forbidden tools, approval requirements, maximum call counts, and argument schemas. Rubrics can judge whether the plan and recovery were reasonable. Measure latency and cost at the trace level, not only for the last generation.
Include adversarial requests that try to bypass confirmation or inject instructions through tool output. A polished response does not excuse a security violation.
The unit the user experiences is the run. Agent evaluation should reward successful outcomes reached through an efficient, authorized, and reproducible sequence.