Your agent’s success rate is on the leaderboard. Its consistency is not.

Here are the columns of the SWE-bench Verified leaderboard, read off the rendered page on 6 September 2026:

#  |  MODEL  |  Agent  |  % RESOLVED  |  AVG. $  |  TRAJS  |  ORG  |  DATE  |  RELEASE

One success column. Nothing about consistency, variance, or repeated trials — the words do not appear on the page. This is not a criticism of SWE-bench, which measures what it set out to measure and does it openly. It is an observation about what the industry has decided is worth ranking.

The metric for the other half exists. The τ-bench paper introduced it in June 2024, and named the problem precisely:

That measurement is from 2024 and it evaluates gpt-4o. Quoting it as if it described a 2026 frontier model would be dishonest, and we are not going to. The durable point is the other one: the metric was defined more than two years ago and still is not published alongside the capability numbers everyone quotes. Whatever today’s consistency actually is, you are not being told.

A demo is a single attempt. Production is the same attempt, several hundred times a day, unattended, against inputs nobody previewed. Those are different questions, and a single success rate only answers the first.

It is tempting to reach for arithmetic here — take a success rate, raise it to the power of the number of daily actions, produce an alarming number. We are not going to do that either, because it assumes failures are independent and they are not: agent failures cluster on particular input shapes, particular tools, particular times of day. The honest statement is narrower and harder to argue with:

Which leaves two options. Wait for the number — or design so that you do not need it. The second is what every industry that got here before us chose.

Automation displacing human decisions is not new. It happened in trading, in payments, and in driving, and in all three the regulator had to answer the same question we are asking: once the machine is good enough to act alone, what does the human still do? None of them answered “approve every action”. All three answered with the same four parts.

MiFID II RTS 6 — the envelope and the switch

Commission Delegated Regulation (EU) 2017/589 governs algorithmic trading. Article 15 does not ask a human to look at each order. It requires controls that act on their own:

And Recital 9 names the stop button, tying it in the same sentence to knowing who acted:

The regulation goes further than having a switch: compliance staff must have access to it at all times. A kill switch only the on-call engineer can reach is not a control.

UN Regulation No. 157 — what happens when the human does not answer

R157 governs Automated Lane Keeping Systems. It is the most complete analogue of the three, because it is the only one that specifies the case everybody else skips.

Two of those rows are the ones most agent systems get wrong. A queue that escalates and then waits forever is not oversight; R157 requires defined behaviour when the human is silent. And escalating to a human who is not there is theatre; R157 requires checking first.

PSD2 — autonomy you earn and can lose

Delegated Regulation (EU) 2018/389 decides when a payment can skip strong customer authentication — when, in other words, the human step can be dropped. It requires three things at once:

Read that as an autonomy model and it is unusually modern: the ceiling scales with measured performance, and it is revoked when performance degrades. Autonomy is not declared in a config file. It is earned against a number, bounded by an amount, and conditioned on a real-time check of enumerated signals — not on judgement.

Strip the three regimes of their domain vocabulary and the same architecture falls out:

Notice what the pattern does not say. It does not say the agent should be slower, dumber, or supervised keystroke by keystroke. The agent stays autonomous. What changes is that the moment where money moves, or data leaves, or something becomes irreversible, is decided by something you can read, test, and replay.

“No LLM in the critical decision path” is the kind of sentence that is true on the day it is written and quietly false eight months later, when someone adds a tidy little classifier to handle an edge case. Documentation does not degrade loudly. Builds do.

So we made it a check that runs in CI. It walks the transitive import closure from the modules that actually decide — policy evaluation, autonomy ceilings, approval creation, the tool gateway — and fails on three axes: an import that reaches a model provider, a string literal containing a model API host, and any model SDK declared in the package manifest, even if nothing imports it yet.

44 modules reached from 5 decision roots · 36 declared dependencies reviewed
exit 0

Two design details matter more than the check itself. It fails loudly when it cannot resolve an import, rather than skipping it — a check that silently ignores what it does not understand is worse than no check, because it reports green. And it fails if one of its declared roots stops existing, so a refactor cannot quietly empty it out.

Both of the failures that taught us this were ours, and neither was a hallucination. That is the part worth sitting with: the layer that is supposed to catch the model is written by the same people, in the same week, under the same deadline.

A concatenation. In PostgreSQL, NULL || ' seconds' is not an error — it is NULL. A deadline computed from an optional parameter therefore wrote nothing at all, silently, and the expiry job filtered on expires_at IS NOT NULL. Result: 1,752 approvals created in seventeen minutes that could never expire, never escalate, and never trigger a fallback. Every individual link in that chain was reasonable.

A gap between two thresholds. One rule routed duplicate suspicion > 0.9 to a human. A catch-all rule auto-approved <= 0.9. In between sat the entire band the product was labelling “possible duplicate” on screen — showing the warning and paying the invoice in the same gesture. On a historical corpus of real invoices, 6,125 of 8,698 took that path. A test asserted the behaviour was correct, two lines below a comment that said the opposite.

Neither defect would have been caught by a better model. Both were caught by the boring parts of the pattern: a schema constraint that made the impossible state impossible, and a test that asked the engine instead of reasoning about the rule.

None of this is novel, and we would rather say so than have you find out. Reference architectures for “agents propose, something else authorizes” have been converging across the industry all year, from hyperscaler toolkits to independent projects. The pattern is becoming consensus, which is a good sign for everyone deploying agents and a bad sign for anyone selling it as a secret.

What we can offer is the long version, written down and free to take. The 15 Factor Approval Gates is fifteen principles for approval infrastructure that survives contact with an auditor — including a self-assessment where we mark our own gaps in amber rather than claiming a clean sheet. MIT licensed. Fork it, argue with it, cite it.

And if you disagree with the framing here, the most useful thing you can do is tell us which part. The argument is only as good as the objection it has survived.