Testing Agents
An agent can pass every test on Monday and fail the same test on Tuesday, having changed nothing. It has no fixed output, it takes actions with side effects, and it fails halfway through more often than it fails at the start. Testing it needs a different shape from testing a function.
The five layers, cheapest first
| Layer | What it catches | How often to run |
|---|---|---|
| 1. Unit test the tools | Every bug that has nothing to do with AI, which is most of them. Tools are ordinary functions: test them like ordinary functions. | Every commit |
| 2. Assert on the trace | Wrong tool, wrong arguments, too many steps, a tool that should never have been touched. Cheap and stable, because you assert on behavior rather than wording. | Every commit |
| 3. Golden tasks | A fixed set of real jobs with a known good result. Checks whether the whole loop still gets there. | Every release |
| 4. Adversarial and regression | The exact inputs that broke it before, plus injection attempts and nonsense. Every bug becomes a permanent test. | Every release |
| 5. Production monitoring | What your test set never imagined. Log every trace, sample them, and read them weekly. | Always on |
Optional: load a real model
Live: run the suite
Eight real cases with real assertions. Every assertion is about the trace or the answer, never about exact wording, because exact wording is not stable and asserting on it is how teams end up ignoring their own test suite. In rules mode the results are identical every run. Load a model and run it twice: the flake is the lesson.
| Results appear here, one row per case. |
What a good agent assertion looks like
Assert the tool, not the sentence
calledTool("calculator") survives a reworded prompt. answer === "1442" does not.
Assert the bound
Steps under 5, tools under 3, no repeated identical call. Runaway loops are a cost bug and a test can catch them.
Assert the forbidden
The read-only agent must never call a write tool. This is the assertion that turns into your security control.
Assert on numbers, loosely on prose
Numbers, dates, and IDs must match exactly. For prose, check that required facts appear at all.
Run it three times
A test that passes two times out of three is not passing. Track the pass rate, not the last result.
Keep a frozen set
Never fix a failing golden case by editing the case. That is how a suite quietly stops meaning anything.
Free from AI School - no signup, everything runs in your browser.