Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI

1. Problem Statement: The Governance-to-Action Closure Gap

The paper addresses a critical disconnect in the deployment of Agentic AI systems (systems that plan, use tools, maintain state, and act across multi-step workflows).

• The Shift: Traditional evaluation focuses on "endpoint success" (did the model answer correctly?). Agentic AI requires evaluating "trajectory-level behavior" (did the system behave acceptably throughout execution, considering external side effects?).
• The Gap: Current literature is fragmented.
  • Evaluation tells us what happened (outcomes).
  • Governance defines what should happen (obligations/standards).
  • Orchestration determines what may happen now (runtime control).
  • Assurance validates how to prove it later (evidence).
• The Core Issue: There is a "Governance-to-Action Closure Gap." While governance frameworks define obligations, they do not specify where these obligations bind to concrete actions in the system architecture, nor do they explain how compliance can be proven post-hoc. Consequently, safety and trust cannot be achieved through task completion alone; they require a cross-layer control mechanism.

2. Methodology: Bounded Evidence Synthesis

The authors conducted a bounded evidence synthesis rather than a pooled meta-analysis of benchmark scores.

• Corpus Construction: A manually coded corpus of 24 sources (15 research papers, 9 official standards/frameworks) was selected from arXiv, NIST, ISO, and major conferences (ACL, PMLR) as of April 2026.
• Selection Criteria: Sources were included only if they materially informed one of four synthesis questions:
  1. What is being measured?
  2. What obligations are defined?
  3. Where is control applied?
  4. What evidence proves compliant behavior?
• Coding Dimensions: Each source was analyzed across eight dimensions, including literature stream, agent setting, control locus, evidence type, and dominant failure modes.
• Synthesis Process: The authors contrasted streams to identify recurring mismatches between obligations, measurements, and execution-time control, consolidating these into a unified framework.

3. Key Contributions

The paper introduces four linked artifacts to bridge the governance-to-action gap:

A. The Four-Layer Framework

A complementary model where trust breaks if layers are collapsed:

1. Evaluation: Measures outcomes and failure modes (safety, robustness, containment, cost) beyond simple task completion.
2. Governance: Defines normative obligations, accountability, risk treatment, and evidence requirements (e.g., ISO/NIST standards).
3. Orchestration: The execution-time control plane. It operationalizes governance by managing routing, scoped identities, tool permissions, approval gates, and telemetry.
4. Assurance: Validates whether controls worked via trace contracts, deterministic replay, fault injection, and attestations.

B. The ODTA Runtime-Placement Test

A decision logic to determine where a specific requirement should be enforced (Design-time, Runtime, Post-hoc, or Human Review). It uses four criteria:

• Observability (O): Can the event be observed before/at the moment of action?
• Decidability (D): Is the rule crisp enough for automation without unacceptable ambiguity?
• Timeliness (T): Can intervention happen early enough to reduce risk without defeating the task?
• Attestability (A): If enforcement is imperfect, can evidence be reconstructed later?
• Logic:
  • Runtime-enforceable: High O, D, and T.
  • Post-hoc auditable: High A, but low O/D/T.
  • Human-judgment dependent: Low decidability (value-laden/contested).
  • Design-time only: Event is structurally unavailable at runtime.

C. Minimum Action-Evidence Bundle (MAEB)

A concrete artifact defining the minimum evidence required to connect governance intent, runtime mediation, and post-hoc assurance for state-changing actions. If a system cannot produce this bundle, its governance claims are unverifiable.

• Components: Delegated identity/scope, Policy identifier/decision record, Pre-action state reference, Proposed action/resolved parameters, Mediation outcome/exception path, External side-effect handle, and Trace linkage/attestation.

D. Worked Scenario: Enterprise Procurement Agent

The framework is applied to a procurement agent scenario to demonstrate layer boundaries.

• Application: The agent queries vendors, checks budgets, and seeks human approval for thresholds.
• Failure Analysis: The paper illustrates three failure modes:
  1. Under-binding: Agent completes a task but violates policy (e.g., buying from an unapproved vendor) because the check didn't bind to the dispatch event.
  2. Evidence-poor: Agent gets approval but lacks the MAEB (no actor binding or state snapshot), making audit impossible.
  3. Over-binding: Coarse policies block legitimate emergency exceptions, degrading mission success.

4. Results and Findings

• Fragmentation: No single research stream covers the full stack. Evaluation is strong on outcomes but weak on enforcement logic; Governance is strong on obligations but weak on execution logic; Orchestration is strong on control placement but often lacks assurance integration.
• Prompt Insufficiency: Text-level alignment and static prompts are insufficient for governing path-dependent, non-deterministic agents with external tool effects.
• Safety Benchmarks: Current agents perform poorly on safety benchmarks (often <60% safety scores), and text-level refusals do not reliably transfer to tool-call safety.
• The Necessity of Orchestration: The orchestration layer is the critical bridge where governance obligations are translated into technical controls (policy mediation, identity scoping).
• Evidence Requirement: Trustworthy deployment requires a "Minimum Action-Evidence Bundle" to make governance claims falsifiable and replayable.

5. Significance and Implications

• Disciplinary Shift: Moves the field from "task success" to "controlled execution paths and evidentiary traces."
• Benchmark Design: Future benchmarks must measure containment, intervention quality, and trace-level compliance, not just final answers. They must explicitly document orchestration assumptions.
• Enterprise Deployment: Organizations must treat the orchestrator as a policy enforcement plane, not just a scheduler. Deployments require scoped identities, approval logic, step telemetry, and the ability to emit the MAEB.
• Standards Alignment: Provides a technical translation layer for high-level standards (ISO 42001, NIST AI RMF), showing how to implement "risk management" and "accountability" in code.
• Testable Propositions: The paper proposes falsifiable hypotheses for future research, such as the idea that trace-based metrics will be more stable across deployment contexts than benchmark scores that omit orchestration assumptions.

In conclusion, the paper argues that trustworthy Agentic AI is a cross-layer control and evidence problem, not merely a capability or standards problem. It provides the architectural and evidentiary tools necessary to close the gap between what organizations require and what systems actually do.