Checks keep AI agents safe. Trust is what makes them fast.

Checks and balances are brakes

Most teams approach AI agent safety in the same way they make any new process safe. They add controls:

• Automatic checks before anything goes out. A rule that stops an agent quoting a price, promising a time or issuing a refund before a person signs off. We've written about these before in Prompt less, check more.
• Only the tools the job needs. An agent answering “where's my order?” doesn't need access to refunds. In our tests this alone cut wrong or unnecessary tool use by 73%.
• Some work never goes unsupervised. Depending on the industry, some tasks are too risky to automate, such as moving money, deleting records, handling disputes. The AI agent generates the action, but a person always signs off.
• A pause and rollback button. One click stops an agent or takes it back to its last good version.
• A person reviewing the work. Things like style, tone and preference become hit and miss when we add controls. So we tend to rely on a person to review and refine behaviour for these “feeling” based assessments. This is the slowest of all.

Controls matter, and we use them all.

Every control is a brake. Each adds a step or requires extra generation. Then these steps never go away. An action that has passed the same checks a thousand times still goes through them, and still waits for the same review, the thousand-and-first time. Passing never adds up to anything, so checks can't earn an agent the right to go faster.

A check also only knows about the mistakes someone thought to write it for. Pass every check and you've learned the agent didn't make those mistakes. You've learned nothing about the ones nobody anticipated.

Trust is the accelerator

We build trust with people, this speeds work up. We budget more time when bringing on a new staff member, and check their work closely. As they prove themselves, we check less and they get on with it.

AI agents can work the same way. Every review adds to the agent's track record. Once the record is good enough, a person stops needing to see every piece of that kind of work. The agent gets faster because it has earned it, and the human effort left in the workflow falls. That is what we mean by net work removed.

It's safer, not just faster.

We gave real AI agents 6,000 generated tasks and let the same share of their work through without a person checking it. When relying on checks only, these agents let through three times as many serious mistakes as AI agents that also had to earn trust.¹ In a statistical simulation of the same rules, the agents using checks alone let through about twice as many serious mistakes.

Checks still run on everything, at every level, and anything that fails is held for a person. Trust decides how much of the rest a person still needs to see.

But trust has to be earned

When a new person joins the team, you check their work for a while. After a good week, you start to let go. Most teams treat an AI agent the same way: twenty passing actions in a row feels like a successful test and the agent can be deployed to production.

The trouble is that twenty successful actions doesn't promise the next twenty are also successful. Two things can go wrong.

The agent may have been lucky. If all actions pass, this tells us much less than it feels like. We don't know what the agent will fail on. Additionally a small run of good work can't tell a reliable agent from a lucky one. Statistically, an agent that passes 20 tests could still be getting about one in six wrong. Our data set just isn't big enough to show the failures.

Or the next action may be one it has never met: an unusual request, a new kind of task, a customer who doesn't fit the pattern. This is where people and agents differ most. A new starter notices when they're out of their depth. They slow down, ask someone, and adapt on the spot. An AI agent can do some of that, but far less reliably. It's just as likely to handle the unfamiliar task with the same confidence as the familiar ones.

So an agent needs more oversight than a person, and its record only counts for the kind of work it has actually been seen doing.

The more good work you see, the smaller that hidden risk gets:

These are cautious estimates: the worst case we can't yet rule out, with the odds of being wrong kept to 1 in 20.²

So before an agent speeds up on a specific task, the business sets its appetite for risk, how many mistakes it can live with for that task. Routine actions might tolerate 1 in 20. Anything touching money, almost none. The agent earns the right to go faster only when its record proves it's at least that good. For 1 in 20, that's 73 good actions in a row. Try it below.

The lower the risk appetite, the longer before you speed up

To show an agent gets fewer than 1 in 10 wrong takes 35 good actions. Fewer than 1 in 50 takes 189.

And it counts separately for each kind of work. An agent that's proven on “where's my order?” questions hasn't proven anything about handling refunds. Like a person, it earns trust one responsibility at a time. (We tested pooling similar tasks and sharing trust between them. However, it held back the agent's good work because of its weaker work.⁵)

The acceleration is real, but gradual at first. At a risk appetite of 1 in 20, review work fell by about a quarter to a third in our tests, and by as little as 14% for a poorly built agent. A looser appetite of 1 in 10 took it to about 40%. Every new kind of work has to serve its own probation first. Anyone promising to cut 90% of oversight from day one is skipping the arithmetic.

This means that the cost of earning trust needs to be built into the business case of rolling out new agents. We have many more ways to improve this process which we plan to detail in upcoming research notes.

The rule also knows when to say no. On τ²-bench, a public customer-service benchmark where the agents failed about one conversation in five, it granted no trust at all, so a person kept reviewing everything.³ Earning trust only works if the agent is actually good. When it isn't, the rule keeps a person in the loop.

Staying fast means checking a sample forever

Trust can be lost as well as earned. An agent can get worse after a software update, a change to its instructions, or slowly over time. The fact is the world around the agent is changing. So the agent needs to be continually monitored and trust validated.

We expected the main risk to be agents getting trusted by luck, so we tested much stricter rules for promotion. They didn't help. Nearly every agent that was trusted when it shouldn't have been had been fine when it earned it, and changed afterwards.

This is the same pattern for people, keep checking a small sample of the work forever. If mistakes start creeping back, the agent automatically slows down to more review until it earns its trust back. Knowing trust can be taken back quickly is what makes it safe to give.

Updates need care too. Our first rule wiped an agent's record every time it was updated, which meant an agent that was improving quickly never earned trust at all. We now carry the record over when the updated agent passes tests it has never seen, and start again when it doesn't.

What we've found so far

We tested all of this in a simulated workplace we built: AI agents doing realistic tasks where we already knew the right answers, plus a public benchmark. No customer data was used. We wrote down what would count as success before each test.

• With real AI agents on generated tasks, earning trust let through about two-thirds fewer serious mistakes than checks alone, at the same share of unsupervised work.
• At a risk appetite of 1 in 20, review work fell by 14% to about a third, depending on how good the agent was.
• Of our first 22 tests, 8 passed, 8 failed, 5 were mixed and 1 was inconclusive. We've dropped or changed the ideas that failed.

What this doesn't show yet

This is early work, and there's a lot it can't tell you yet.

• The reviewers were simulated. In our tests the “person” checking the work followed a model of how real reviewers behave, including getting sloppier as mistakes become rare. Real people may do better or worse.
• What counts as a mistake was judged by software. An automatic grader decided whether each action was a serious mistake. We corrected it after hand-checking a sample, because it was counting some harmless actions as mistakes, and that changed the measured error rates.⁴
• One AI model, generated work. The agents all ran on one model, doing six kinds of generated work with fixed patterns. Real work has a longer tail of odd cases.
• The maths assumes the future looks like the past. The 73 counts only cover the kind of work the agent has already been seen doing. It can't warn you about a genuinely new situation, which is exactly why spot-checks never stop.
• Rates, not severity. “1 in 20 wrong” treats every mistake alike. One expensive mistake can matter more than many small ones, which is why some work is never left unsupervised.
• Gaming and misfiling are only partly tested. We've started testing agents that behave better when they know they're being watched, and actions filed under the wrong kind of work. The early results are mixed.

Coming next

This is the maths underneath a larger framework for how AI agents earn the right to go faster, the way people do: start supervised, learn from corrections, take on more as the record supports it, and step back when it doesn't. Next we will:

• publish the full framework, with the pre-registered tests, the results (including the failures) and the code to re-run them;
• test it with real people reviewing the work, and with more than one AI model;
• weigh mistakes by how much they cost, not just how often they happen;
• report how agents that game being watched, or work filed in the wrong place, are caught;
• share more ways to cut the cost of earning trust.

Notes

1. Real agents: 6,000 generated tasks across six kinds of work (customer service, workshop bookings, IT service desk, accounts payable, outbound follow-up and data operations), run by two agents of different quality on deepseek-v4-flash. Escapes with earned trust were 0.31 to 0.34 times those of checks alone. Simulation: 200 simulated workplaces, each with two agents, four kinds of work and 4,000 actions, where the ratio was about 0.55. ↩
2. The worst case is the upper end of a 95% Wilson score interval for the error rate, given a run of actions with no mistakes. It's a standard, slightly conservative way to put a ceiling on a rate from a small sample. With zero mistakes, it reaches 1 in 20 at 73 actions, 1 in 10 at 35 and 1 in 50 at 189. ↩
3. τ²-bench retail, 240 conversations from two models, with and without checks. ↩
4. Before the correction, the measured serious-error rates were 5.4% for the better agent and 18.0% for the sloppier one. After it, they were 2.0% and 14.4%. We kept both versions of the results. ↩
5. Pooling: the share of work done without review fell from 56% to 46% for the better agent and from 17% to 9% for the sloppier one, in our tests with real AI agents. ↩

Further reading

• John D. Lee and Katrina A. See, “Trust in automation: designing for appropriate reliance”, Human Factors, 2004.
• Raja Parasuraman and Dietrich H. Manzey, “Complacency and bias in human use of automation”, Human Factors, 2010.
• Anthropic, “Measuring agent autonomy in practice”, February 2026.
• Cloud Security Alliance, Agentic Trust Framework (draft).

Written by Jake Spillane with the Hivemind Labs team. Published 23 October 2026.

AI disclosure. This note was researched and written with help from AI, including Claude (Anthropic).