🤖 AI

Copy-on-Write Scoring: Application-Specific Agent Evaluations

This paper introduces Copy-on-Write (CoW) Scoring, a framework that leverages PostgreSQL-level isolation to evaluate LLM-based agents directly within application environments, enabling granular, cost-effective identification of database write failures and iterative improvements to agent tool surfaces.

Original authors: Joanna Roy, Sven Hoelzel

Published 2026-07-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Joanna Roy, Sven Hoelzel

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you've just built a super-smart robot assistant that can talk to your favorite apps, like a project management tool or a calendar. You want it to help you organize your life, but you're terrified it might accidentally delete your entire to-do list or change your boss's status to "on vacation" when they're actually in a meeting. This is the world of AI agents: computer programs that don't just chat, but actually do things in software systems. The big problem right now is figuring out how to test these robots safely. Usually, scientists test them in fake, made-up worlds (like a video game simulation), but those simulations often drift away from reality, or they are so expensive to build that nobody can afford to update them every time the real app changes. We need a way to watch the robot work in the real app without it ever actually breaking anything, so we can see exactly where it gets confused and fix it.

Enter a new idea called Copy-on-Write (CoW) Scoring, proposed by researchers Joanna Roy and Sven Hölzel. Think of their method like a "magic glass wall" built right inside a database (the digital filing cabinet where apps store their data). Normally, if you tell a robot to "change this file," it goes straight to the real file and scribbles over it. With CoW, the robot is told to write on a special, invisible sheet of glass that sits on top of the real file. The robot thinks it's writing to the real thing, but it's actually just writing on the glass. The original file underneath stays perfectly safe and untouched.

Here's the clever part: the system keeps a "ground truth" version of what should happen (like a perfect human doing the task) and compares it to what the robot did on the glass. Because the robot is writing on a separate layer, the researchers can instantly see: "Oh, the robot tried to delete the wrong row," or "It added a comment to the wrong task." They can score the robot's performance based on how close its glass-writing was to the perfect human version. If the robot fails, the researchers just wipe the glass clean and try again, without ever having to restore a backup or worry about corrupting the real data.

In their study, the team tested this on Plane, an open-source project management platform. They set up 20 different real-world tasks, like "move all unfinished bugs to the 'In Progress' list" or "assign new tasks to specific team members." They let five different AI models try to do these jobs while the CoW system watched. The results were eye-opening. The researchers found that many robots failed not because they were "dumb," but because of vocabulary mismatches. For example, the app called things "work items," but the robots were looking for "issues." The robots got stuck, gave up, or started hallucinating (making up fake commands) because they couldn't find the right words.

By using CoW Scoring, the team could pinpoint these exact failures. They realized, "Ah, the robot is failing here because it doesn't know 'issue' means 'work item'." So, they updated the tools the robot uses to include both words. When they ran the tests again, the robots got much better. For instance, one model called Gemini-2.5-Pro improved its score by 54%, and another called GPT-4.1 jumped by 47%. The study suggests that this "glass wall" method is a powerful, low-cost way to debug AI agents in real applications, helping developers fix the specific tools and prompts that confuse the robots, rather than just guessing what went wrong. It's a way to let the robots practice in the real world without the risk of a real-world disaster.

Technical Summary: Copy-on-Write Scoring for Application-Specific Agent Evaluations

Problem Statement

The deployment of Large Language Model (LLM)-based agents in production software systems faces a critical evaluation gap. While agents are increasingly integrated into enterprise tools and consumer applications, existing evaluation mechanisms are insufficient for ensuring reliability in specific application contexts.

Low Construct Validity: Standard benchmarks often fail to reflect the complexity of real-world application environments, tooling, and workflows.
Replica Limitations: Creating replica or simulated environments to bridge this gap is resource-intensive, expensive, and prone to "drift" from the live application state.
Risk of Unreliability: Agents operating directly in production risk catastrophic errors, such as accidental data deletion, overwriting critical records, or misusing tools, which are difficult to isolate and prevent without granular evaluation.

Current methods lack the ability to evaluate agents directly within their target application environments with enough granularity to localize specific points of failure.

Methodology: Copy-on-Write (CoW) Scoring

The authors propose Copy-on-Write (CoW) Scoring, a framework designed to evaluate agent operations directly within application environments using a PostgreSQL-level isolation mechanism. This approach avoids the cost and drift of replicas while maintaining session isolation.

1. The CoW Mechanism

The framework leverages a database-level Copy-on-Write pattern to intercept and isolate agent writes without modifying production data. The implementation involves four components:

Base Tables: Contain the underlying production data.
Changes Tables: Structurally identical to base tables but include additional metadata columns (session_id, operation_id, cow_updated_at, cow_deleted). These tables store only the rows written during a specific agent session.
Views: SQL views merge the base and changes tables. Reads query the view (which returns the latest state), while writes are redirected.
Triggers: INSTEAD OF triggers on the views intercept write operations. Instead of modifying the base table, the trigger creates a copy of the affected row, applies the write, appends CoW metadata, and inserts the result into the changes table.

This setup allows agents to operate as if they are writing to production, while all modifications remain isolated to the changes table for that specific session.

2. The Scoring Framework

CoW Scoring compares a Ground-Truth (GT) session (recorded by a human performing an ideal workflow) against an Agent session (executed by an LLM agent with the same prompt). The comparison occurs at two levels of granularity:

Session-Level Scores: Evaluate the final database state.
- Structural Score ( $s_{struct}$ ): The fraction of matched rows (rows present in both GT and agent sessions) relative to the total changed rows. It accounts for missing rows (GT rows not produced) and extra rows (agent rows with no GT counterpart).
- Content Score ( $s_{content}$ ): The mean per-field similarity over all matched rows, calculated using default comparators based on SQL data types (e.g., exact match for numbers, deep equality for JSON, sequence matching for text).
Operation-Level Scores: Quantify the utility of individual actions.
- Structural Utility ( $u_{struct}$ ): The change in the session-level structural score before and after an operation is applied.
- Content Utility ( $u_{content}$ ): The mean content similarity of the rows written by a specific operation.

Crucially, the framework compares final database states rather than action sequences, making session-level scores invariant to the specific path the agent took to reach the result.

Key Contributions

A Novel Evaluation Framework: The introduction of CoW Scoring, which enables low-cost, high-fidelity evaluation of agents directly within application environments, bypassing the need for expensive replicas.
Open-Source Implementation: The release of the agent-cow Python library, which handles database setup (creating base/changes tables, views, and triggers) and provides the scoring pipeline.
Granular Diagnostics: The ability to surface specific failure modes at the operation level, distinguishing between structural errors (missing/extra rows) and content errors (incorrect values).
Empirical Validation: A preliminary study on Plane, an open-source project-management platform, demonstrating the framework's ability to identify specific tool-surface issues and measure improvements after fixes.

Results: The Plane Case Study

The authors evaluated five language models (GPT-5, GPT-4.1, Gemini-3.1-Pro, Gemini-3.1-Flash-Lite, and Gemini-2.5-Pro) across 20 workflows in the Plane application.

Initial Findings: The scoring revealed distinct failure modes:
- Vocabulary Mismatch: Agents struggled when the prompt used terms (e.g., "issue") that differed from the application's internal terminology (e.g., "work item"). For instance, Gemini-2.5-Pro repeatedly gave up when searching for "issues," while GPT-4.1 made incorrect assumptions about search strings.
- Hallucination and Extra Writes: GPT-4.1 occasionally hallucinated operation names or parameters, and Gemini-3.1-Flash-Lite produced extra writes (e.g., updating labels or assignees not requested), which would be difficult to detect without CoW isolation.
Iterative Improvement: Based on the diagnostic scores, the tool surface was updated to align terminology (ensuring "issues" was recognized as "work items").
- Measurable Gains: Models heavily affected by the vocabulary mismatch saw significant score improvements: Gemini-2.5-Pro improved by 54%, and GPT-4.1 by 47%.
- Stability: Models with high initial scores (e.g., GPT-5, Gemini-3.1-Pro) showed minimal variance, confirming the stability of the scoring mechanism.

Significance and Claims

The paper positions CoW Scoring as a practical tool for safer agent deployment. Its primary significance lies in enabling teams to:

Localize Failures: Identify exactly where agents succeed or fail in database write operations within a specific application context.
Iterate Efficiently: Facilitate low-cost iteration on model prompts, tool surfaces, and retrieval mechanisms without the overhead of building and maintaining replica environments.
Bridge the Construct Validity Gap: Provide evaluation data that is directly relevant to the specific application being deployed, rather than relying on generic benchmarks.

The authors modestly note that the framework relies on manually created Ground-Truth sessions, which requires an initial investment of effort comparable to building application-specific datasets. They also acknowledge that the current implementation focuses on write operations, though read patterns could offer additional diagnostic signals. The framework is presented not as a universal benchmark, but as a complementary method for application-specific validation.