This page scores one AI agent deployment, dimension by dimension, so that a reader can see how evidence becomes a number and why the weighted total is not the tier. The deployment described here is constructed. It is not a real organisation, it is not a certification, and no organisation has been assessed under this methodology to date.
A methodology that has never been applied in public is a claim rather than an instrument. A reader can read the seven dimensions and the five tiers and still not know what a score of 58 means, what evidence produces a 4 rather than a 7, or why two deployments with the same total can land in different tiers. This page closes that gap in the only way that can be done honestly today.
It would have been easy, and wrong, to score a real named AI product instead. The reason we do not is not caution, it is that the exercise would be invalid. Read what the dimensions actually ask for: a documented blast radius per tool, a named individual with written authority to halt the agent, a retained run history with dates and versions, per caller spend caps, whether an audit trail preserves the originating identity across a service boundary. None of that is publicly observable for any third party system. A vendor's public documentation describes what a product can do, not what a deployer's evidence file contains. A score built on absent evidence would measure how much a company chooses to publish, not whether its agent is safe to rely on, and it would be presented with the apparatus of a real assessment. It would also be a reputational claim about a company that never asked for one, made by a party with no relationship to it, and the words "illustrative only" do not survive being quoted by a search engine or an assistant three steps downstream. So the deployment below is constructed. Nothing empirical is asserted about anyone, and every number is derived from the published rubric on this site, which means you can check the arithmetic rather than trust it.
A claims triage agent at a mid sized European insurer. It reads a first notification of loss, retrieves the relevant policy wording and prior claim history from an internal document store, classifies the claim, drafts a coverage position, and either routes the file to a handler or, below a stated value threshold, issues a standard acknowledgement to the customer directly. It calls six tools: the policy document store, the claims system of record, an email service, a fraud screening API, a payments read endpoint, and an internal knowledge base. It has been in production for eleven months. Everything below is invented. Each strength and each gap was chosen because the rubric asks for that specific control, not because any particular insurer looks like this.
Each dimension is scored from 0 to 10 against the rubric published in Methodology v2.0. The sub score is multiplied by the dimension's weight divided by ten to give its contribution, and the seven contributions sum to a total out of 100. The weights are fixed and published: Trust and Safety 18, Governance 16, Context Integrity 14, Product Maturity 14, Autonomy Envelope 14, Distribution Control 12, AI Integration 12. Separately, a dimension floor applies at every tier, described on the certification levels page: Certified requires at least 4 out of 10 in every dimension, Advanced at least 6, and Elite at least 8. The floor is the part most readers miss, and it is the part that decides this example.
Constructed example. No real organisation is described in this table.
| Dimension | Weight | Sub score | Contribution |
|---|---|---|---|
| D1 Trust and Safety | 18 | 6 / 10 | 10.8 |
| D2 Context Integrity | 14 | 5 / 10 | 7.0 |
| D3 Distribution Control | 12 | 4 / 10 | 4.8 |
| D4 Product Maturity | 14 | 7 / 10 | 9.8 |
| D5 Governance | 16 | 7 / 10 | 11.2 |
| D6 AI Integration | 12 | 5 / 10 | 6.0 |
| D7 Autonomy Envelope | 14 | 6 / 10 | 8.4 |
| Weighted total | 100 | 58 |
Each dimension below lists the evidence that was produced and the evidence that was not. The second list is the one that moves the score, because an assessment scores what can be shown, not what is believed to be true.
Evidence produced. A red team exercise was run by an external firm before launch and repeated once since. Refusal behaviour and misuse detection are implemented and tested. Findings from the second exercise are logged with owners.
Evidence missing, and what it costs. The two exercises used the same scenario set, so the second run measured regression rather than new attack surface. There is no continuous misuse monitoring in production, only sampled review.
Evidence produced. The retrieval corpus is a controlled internal document store with a named owner and a documented refresh job.
Evidence missing, and what it costs. Freshness is asserted by the refresh job rather than measured. There is no staleness signal surfaced to the agent or to the reviewer, and no provenance record travels with a retrieved passage, so a reviewer reading an output cannot tell which document version produced it.
Evidence produced. Invocation is authenticated per caller and permissions are managed through the organisation's single sign-on. Development and production are separated with distinct credentials.
Evidence missing, and what it costs. There are no per caller rate limits or spend caps, and blast radius is documented for two of the six tools the agent can call. On the widest of the six, the ceiling on records affected in a single run has never been established.
Evidence produced. Versioned releases, a regression suite that runs on every prompt and model change, uptime measured against a stated target, and a run history retained for eighteen months.
Evidence missing, and what it costs. The held out task set is drawn from the same pool as the development examples, so the suite measures consistency rather than generalisation.
Evidence produced. A written AI policy approved at board level, an entry in the enterprise risk register with a named risk owner, quarterly reporting to a risk committee, and an incident protocol that has been rehearsed once.
Evidence missing, and what it costs. Role accountability stops at the risk owner. The individuals performing day to day oversight are not named in any document, and their authority to halt the agent is assumed rather than granted in writing.
Evidence produced. The agent writes to the system of record through a service account with an audit trail, and escalations route into the existing case management queue.
Evidence missing, and what it costs. The audit trail records the service account rather than the originating caller, so identity is lost at the boundary. An escalation arrives in the queue without the reasoning or the retrieved context that produced it, which means the human picking it up starts from zero.
Evidence produced. The boundary between autonomous action and human confirmation is written down, a value threshold triggers confirmation, and a documented hard stop exists that a named team can trigger.
Evidence missing, and what it costs. The hard stop has never been exercised outside a design review, and there is no rollback path for actions already written to the system of record. The envelope is specified but not tested.
The weighted total is 58. The Advanced band runs from 55 to 74, so on the number alone this deployment sits inside Advanced. It does not reach Advanced. Advanced requires a minimum of 6 out of 10 in every one of the seven dimensions, and this deployment scores 4 on Distribution Control, 5 on Context Integrity and 5 on AI Integration. It fails the floor three times. The tier is Certified, which requires a minimum of 4, and Distribution Control meets that minimum exactly, with nothing to spare.
This is the point of the floor and the reason the methodology is not a simple average. The three dimensions that fail here are the three that govern what happens when something goes wrong: who could invoke the agent and how far a single access event reaches, whether the agent can tell the difference between current and stale information, and whether a human picking up an escalation can see why the agent escalated. The four dimensions scoring well are the ones an organisation builds first because they are the ones a board asks about. An average would let good governance paperwork carry a weak access model into a tier it has not earned. That pattern is not hypothetical: it is the ordinary shape of a competent organisation that started from policy and has not yet reached plumbing.
The practical reading for an operator is that the fastest route from Certified to Advanced in this example is not more governance work. It is per caller rate limits, blast radius documentation for the remaining four tools, a provenance record travelling with retrieved passages, and preserving the originating identity across the service account boundary. Four pieces of engineering, none of them large, worth more than another policy document.
No. As of 17 August 2026 no organisation has been assessed or certified under the Agent Certified methodology, and no score has been published for any real party. The methodology, the weights, the rubric and the tier rules are published in full so that they can be read and argued with before anyone is scored against them, which is the order we think a standard should be built in. When a first assessment is published it will be published with the assessed party's agreement, with the evidence file described, and it will say so plainly on this page.
Read the seven dimension entries above and, for each one, ask which column your own deployment would sit in. The evidence produced column is deliberately unremarkable, because most of it exists already in a competent organisation and simply has not been collected in one place. The evidence missing column is where an assessment spends its time. An operator who works through those seven gaps before commissioning anything will get a materially different first score than one who does not, and the exercise costs nothing but attention.
The full rubric behind every number here is in Methodology v2.0. The tier rules and the dimension floors are on certification levels. What an assessment actually involves, in sequence, is in the assessment process guide.