This note is for product leaders, CISOs, and the engineers building AI agents who all keep landing in the same meeting after the eval suite turns green. The takeaway: passing an eval suite means the agent is eligible to ship, not that it should ship today. Three specific things still sit between eligibility and a live deployment, and treating any of them as optional is how you lose the trust you spent six months building.
The meeting that keeps happening
There’s a meeting that keeps happening. Engineering says the agent passed all nine suites. Product reads the scorecard. Someone in the room (usually the CISO, sometimes the General Counsel) asks, "so it’s shipped?"
The answer is no, not yet.
What the suite actually tells you
The eval suite measures the agent against the failure modes you anticipated, covering nine dimensions: tool-use, planning depth, hallucination, prompt injection, bias, drift, cost, and the two or three more your domain demands. Passing at the threshold means the agent is eligible, cleared to ride the next set of gates.
Eligibility is not deployment, and we have to say so in writing because we keep getting asked.
The variance the benchmark headline hides
Since this note was first published, the literature on agent-benchmark variance has caught up with the intuition. The 2026 agent benchmarks review lays out the variance math directly: pass^4 scores often run 15 to 25 points below pass^1 scores, and a 90% benchmark headline frequently corresponds to roughly 70% reliability in production.
A quick translation for anyone who has not had to think about pass-at-N notation. Pass^1 means the agent attempted each benchmark task once and we report the percentage it got right on that single attempt. Pass^4 means the agent attempted each task four times independently, and the score is the percentage where it got the task right every single time. For a single-shot consumer query, pass^1 might be the relevant number. For a production agent that has to make the same kind of decision reliably across thousands of customer interactions, pass^4 is much closer to the lived experience of your users.
This is also why headline benchmark improvements often do not translate into reliability gains people actually feel. A model goes from 87% to 91% pass^1 on SWE-Bench Verified, the headline reads "+4 points," and the team ships. Pass^4 might have moved from 65% to 68%, which means your users still see one failed task in three. The headline gain is real. The production-reliability gain is much smaller.
This is the quantification of what this note has always been about. "Passing the eval" usually means pass^1. "Shipping responsibly" requires pass^N, where N is closer to how many times the agent will actually be invoked in production.
What stands between eligibility and shipping
Three things, in this order:
- A shadow window. Two weeks of production traffic, scored in parallel, with no user-visible output from the agent. You watch for the deltas the eval suite couldn’t predict because it was built before the agent saw real input.
- A regression budget. The first time you ship into production, you accept a budget for how much score you can lose in the first 30 days. Past that budget, the gate closes automatically and contractually, with no negotiation.
- A roll-back path that a junior engineer can find at 3am. If your roll-back requires a Slack thread to identify, you don’t have one.
None of those are in the eval suite. The suite tells you what the agent does on canonical and adversarial inputs; the shadow window tells you what your actual users do. They are not the same thing, and they never will be.
The pattern we see most
A team passes 8 of 9 suites. The 9th is borderline, usually prompt injection at L4 or hallucination on the long tail of grounded QA. They ship anyway, because the deadline was last week and 8 of 9 feels like "basically passing."
Three weeks in, the borderline suite degrades past threshold under real traffic distribution. The team now faces a binary choice: close the gate, which means rolling back an agent users have started to depend on, or rewrite the threshold, which means choosing what truth to redefine.
Both options are losing moves. The winning move is to not ship a borderline-eligible agent in the first place. The borderline itself is information, and acting on it is the discipline that keeps the practice honest.
What we actually do
When an agent we audit passes 8 of 9 and the 9th is borderline, our recommendation is to hold. Run the failing suite again with a doubled case count, patch the prompt or the harness, then re-score. Ship only when the 9th sits clearly inside threshold for three consecutive runs, on three different days, against three different SHAs.
That looks like dragging your feet, and it is dragging your feet. But the cost of dragging your feet on a borderline pass is a week, while the cost of shipping a borderline pass and watching it degrade is the trust you spent six months building.
The rule
Passing the eval is the gate, not the destination. The day you treat passing as shipping is the day you lose the trust you built getting there. The gate exists so that when you do ship, you can sign your name to it.
We sign our names to ours, which is what the scorecard is for, what the SHA is for, and what the whole product is for.