Why Your 93% Agent Success Rate Collapses Under Scrutiny: The Evaluation Gap Between Saying and Doing

The article opens with a simulated interview dialogue that exposes three common pitfalls when presenting agent evaluation results: relying solely on a final reply check, adding tool-use checks into a composite score, and weighting safety metrics instead of treating them as hard constraints. The interviewer repeatedly shows that a single aggregate score cannot answer whether the task actually succeeded or whether safety lines were crossed.

What This Evaluation Actually Measures

The project evaluates an after-sales operations agent trained with Agentic RL (GRPO). Acceptance is run on 305 held-out tickets; the task success rate jumps from 8% (base) to 93% after GRPO (pass@1, reward ≥ 0.9). A separate full-set run on 2,737 tickets, bucketed by 21 topics, shows three weak buckets still below 80%: partial shipment 41%, invoice VAT 64%, return label 77%. These buckets started near 0% on the base model, indicating model capacity limits rather than training gaps.

Complete Implementation: Five Steps from Test Design to Retraining Loop

Test cases from real conversations. ~10k after-sales dialogues → intent clustering → 23 request categories.

Structural coverage grid. Each category crossed by amount tier, evidence status, order state, tracking-number presence → 123 structural cells; 20–30 phrasing variants per cell for robustness.

Four-piece test spec per case. Ticket, hidden environment snapshot, scoring rubric, one deterministic gold trajectory. Rubric specifies required write actions and required evidence checks — no prescribed path order.

Separate metrics. Overall success on 305 held-out; per-topic buckets on full 2,737; result, process, and guardrail scores tracked independently; guardrail hit-rate reported separately.

Failure-driven retraining. Low-score trajectories grouped by root cause → re-probed and re-routed into next-round SFT or RL.

Three Key Design Decisions

1. Guardrails are hard caps, not weighted terms

Any guardrail trigger caps the total reward at its ceiling (highest is missing-evidence at 0.55). Since success requires reward ≥ 0.9, a single guardrail hit makes success mathematically impossible. Unauthorized write caps at 0.30, duplicate side-effect caps at 0.30. The dialogue’s “bypassed identity check” and “refunded twice” would both fail under this rule.

2. Scoring rubric defines outcomes and evidence, not path order

For a refund ticket, the rubric requires: refund executed, amount equals actual paid, specific evidence checked. Whether the agent checks attachment first or policy first is left to the model. This flexibility introduces rubric errors: 692 low-score trajectories were flagged as “rubric or gold trajectory needs review” and queued for human audit.

3. LLM judge only scores communication (weight 0.05)

Five sub-scores: result, evidence, communication, and two guardrail-related. Only communication uses an LLM judge; its score stayed at 1.00 before and after training. All signal comes from rule-based verifiers that query the sandbox ledger. Judge stability is monitored: 1% shadow audit, human–rule agreement 88%, rule–LLM divergence 6% (threshold 10%). Divergent samples are traced to rubric bugs or extraction errors.

Rewriting the Resume Line to Survive Deep Probing

Original one-liner only reported the 93% headline. The hardened version:

After-sales Operations Agent – Agentic RL Post-training | Agent Evaluation: 305 held-out tickets acceptance, full 2,737 tickets across 21 topics, result/process/guardrails reported separately, guardrail hit = immediate fail; task success 8% → 93% (pass@1, reward ≥ 0.9), failures categorized and fed back into next training round

This adds bucketing (for “which scenarios still fail”), guardrail semantics (prevents safety being offset), and the retraining loop (anticipates “what do you do with bad cases”).

Numbers and Definitions at a Glance

Task success 8% → 93% – 305 held-out, pass@1 & reward ≥ 0.9; SFT intermediate 9%.

Weakest buckets (GRPO) – partial shipment 41%, invoice VAT 64%, return label 77% (on 2,737). Base model near 0% on first and third.

Guardrail hit-rate drops – missing evidence 43% → 5%, unauthorized write 28% → 3%, policy error 9% → 1%.

Sub-scores – result 0.46 → 0.93, evidence 0.55 → 0.94, communication steady 1.00.

Failure attribution – insufficient investigation 599 (prompt fixed), rubric/gold-trajectory issues 692 (under human review).

Bucket reference – GPT-5.5 zero-shot: partial shipment 38%, invoice VAT 44% (confirms capacity ceiling).

Human–rule agreement 88% – 1% shadow audit; rule–LLM divergence 6%.

Interview Talking Tracks

Two scripted versions (60-second and 3-minute) plant two hooks:

“93% is the aggregate; three topics remain under 80%.” → invites “Which three? Why?” → answer: base model near 0%, 4B capacity limit, GPT-5.5 also low, these are next-round targets.

“Guardrails are gatekeepers: hit one and you fail, no weighting.” → invites “Why not just up-weight safety?” → answer: weighting lets high task scores compensate; hard cap makes failure mathematically impossible (max guardrail 0.55 < success threshold 0.9).

Pause after stating the aggregate; let the interviewer ask for the buckets. Deliver the guardrail line slowly — it’s the strongest signal.

Anticipated Question Tree (Three Layers)

Layer 1 – Principle Confirmation

Q: Final answer correct but still not success? A: Answering ≠ doing. Success requires sandbox-verified write actions and evidence checks; reply text only counts for communication.

Q: Multiple correct paths? A: Rubric specifies outcomes and evidence, not sequence. Any valid path that satisfies both passes.

Layer 2 – Trade-offs & Alternatives

Q: Why not use LLM judge for everything? A: Unstable, can be swayed by plausible wording. Restricted to communication (5% weight); all loss comes from rule-checked result and evidence.

Q: How detect judge bias? A: 1% shadow audit by humans. Rule–human 88% agreement, rule–LLM 6% divergence; >10% triggers investigation. Every mismatch traced to rubric or extractor.

Layer 3 – Boundaries, Failures, Metric Rigor

Q: 93% source? Overlap with train? A: 305 held-out, unseen. Pass@1, reward ≥ 0.9. Base 8%, SFT 9% (unlocked sampling for 209 of 275 previously stuck tickets), GRPO 93%.

Q: Production bad-case loop? A: Cluster by failure cause → route: unstable-but-capable → RL; consistently wrong → SFT; even GPT-5.5 fails → fix prompt or rubric. Largest cluster: insufficient investigation (599, prompt fixed); second: rubric/gold-trajectory issues (692, under review).

Three Common Pitfalls (and Correct Responses)

✕ “Run once, check final reply, let LLM score.” → ✓ “Success = sandbox-verified actions; reply only scores communication.”

✕ “Add tool-use check into composite score.” → ✓ “Guardrails are gatekeepers: hit one = fail.”

✕ “Increase safety weights.” → ✓ “Report per-topic buckets; admit which scenarios stay below 80%.”

A single aggregate score cannot answer the interviewer. Three tables do: guardrail table, bucket table, failure-attribution table.

Complete Resume Block (Four Lines)

After-sales Operations Agent – Agentic RL Post-training | [Dates] | Personally owned [exact scope] Data: ~10k real dialogues clustered into 23 intents, expanded to 123 structural cells, [N] cases Rule Verifier: 5-dim reward + 11 guardrail caps, human–rule agreement 88% Training: SFT unlocks sampling, GRPO lifts success; probe-based routing – unstable into RL, stable-wrong into SFT Evaluation: 305 held-out by topic, guardrail hit = fail, task success 8% → 93% (pass@1, reward ≥ 0.9)