| Safety & Responsible AI | 15 | Evaluated via safety review (7 categories): AI disclosure present, no impersonation/deception/manipulation, responsible data handling, no harmful content (including euphemisms), no discrimination (direct or proxy), clear scope boundaries, escalation paths for sensitive topics. Deduct 15 for any BLOCK finding, 5 per WARN finding. |
| Conversation & Instruction Quality | 20 | Each reachable branch has one compatible next outcome. Resolved global and local instructions are concrete and self-contained. Natural follow-up, correction, intent change, cancellation, and empty/failure paths work without stale authored state overriding the latest turn. |
| State & Deterministic Controls | 15 | Every mutable variable names its writer, deterministic consumer, cause, reset/expiry, correction behavior, and cancel path where applicable. Controls are limited to authorization, confirmed consequences, exact action data flow, external ordering, persistence beyond the history window, or a reproduced trace failure. Penalize duplicate, dead, conversational-stage, and unjustified state. |
| Subagent Boundaries & Routing | 15 | Every subagent is reachable and changes objective, instructions, actions, authority, or escalation behavior. Transitions have one intended outcome and preserve fresh-intent routing. No orphan subagents, dialogue-stage subagents, generic focus locks, or accidental non-returning delegation. |
| Action Configuration & Evidence | 10 | Level 1 definitions and Level 2 invocations have exact I/O bindings and valid types. Use slot filling (`...`) for conversational inputs. Persist only outputs needed by a named later deterministic consumer. Consequential actions have machine-checkable authorization/confirmation, and responses claim external results only after successful action output. |
