The agent cannot be its own auditor

An agent performs the task, explains what it did, runs its tests, interprets the results and declares that the work is ready. The flow seems efficient: a single intelligence preserves all context and solves the complete cycle.

It also concentrates production, evidence selection, interpretation and acceptance in the same actor. When there is an error in premise, incentive, context or authority, the same failure can cross all stages of a coherent narrative.

Separating audit execution does not mean removing AI from verification. It means preventing the final declaration from depending solely on the executor being evaluated.

Executive summary

A second model can provide useful critique, and patterns evaluator–optimizer They work when there are clear criteria and measurable improvement. However, separating calls does not create independence in and of itself. The assessment needs to be linked to the same subject, use different criteria and authorities and preserve evidence that another actor can inspect.

PaperBench, for example, uses hierarchical rubrics and created a separate benchmark to evaluate its judge by model. This framework recognizes that the evaluator also needs to be measured. In the reported cutoff, the best agent tested achieved a 21% average score and did not surpass the human baseline; the result belongs to the task, scaffold, and models examined, not to all agents.

In FORGE, the rule is: the executor can test and self-evaluate; it cannot grant itself final authority over critical properties.

Four roles that are often confused

A person or system can accumulate roles at low risk. At high risk, separation increases. The point is not an organizational chart; is to prevent authority from circulating.

Why self-assessment fails

Shared error

The agent creates an implementation based on a wrong interpretation and then writes tests that reproduce the same interpretation. Everything turns green and the need remains unmet.

Favorable selection

The executor chooses examples, logs, or metrics that show success. Even without intent to deceive, it tends to explore the path it knows best.

fragile judge

A model evaluator may prefer style, length, or convincing explanations. If the grader has not been calibrated against humans or deterministic checks, the grade adds apparent accuracy.

Subject divergent

The test passes in a different commit, environment, or configuration than the one that will be published.

Undue authority

The system interprets your own score as permission to publish, send or promote. Measurement and decision become the same mechanism.

Independence has dimensions

It is not enough to use “another agent”. Rate:

• identity — is it another session, role, person or organization?
• context — received the response from the executor or reconstructed it from the subject?
• method — uses independent criteria or repeats the same justification?
• tool — observe your own logs and tests or external sources?
• incentive — Does your success depend on approving quickly?
• authority — can you block or just advise?

Independence is graduated. A deterministic test written before implementation may be more independent than a second model instructed to agree with the first.

A minimal assurance architecture

1. Spec outside the executor

The property and acceptance criteria exist before the solution. The executor can propose corrections, but does not silently rewrite what will be considered success.

2. Deterministic checks first

Schema, types, properties, security, diff and invariants reduce interpretation space. Result by model complements, not erases, a deterministic red.

3. Versioned Evals

Bank, graders, thresholds, environment and aggregation belong to one version. Negative cases and risk classes remain visible, not just the average.

4. Reviewer rebuilds the claim

Receives subject and evidence, identifies limits and checks whether the claim follows the method. For material change, you must be able to disagree and block.

5. Approver accepts residual risk

The acceptance records person or authority, date, subject and exceptions. The executor never assumes approval due to lack of response.

Where AI can evaluate AI

AI is valuable for expanding coverage:

• generate adversarial cases;
• group failure patterns;
• compare answer with rubric;
• review extensive traces;
• look for inconsistencies between spec, code and test;
• propose explanations and next experiments.

The problem is not that the evaluator is a model. It is the result of having no calibration, no limits and no possibility of contestation.

Use combination of graders:

Evaluate the evaluator

PaperBench didn't just use judge by model; built a benchmark for the judge. This principle is generalizable: before trusting the grader, measure how it behaves on known examples, ambiguous cases, and critical failures.

Ask:

• Do you agree with experts on what rate and class?
• false positives and negatives cost what?
• Is it sensitive to the position, style or identity of the model?
• Can you explain the criterion with evidence?
• Which change invalidates your calibration?
• Is there a human resources path?

A judge without evaluation is another executor with a different name.

A human + AI PR protocol

1. Human author or PO sets ownership and criteria.
2. The executor agent implements and records decisions.
3. Deterministic suite checks invariants and negative cases.
4. Reviewer agent inspects diff, spec, tests and evidence in a separate context.
5. Specialized Security/QA check applicable properties.
6. Human authority accepts or rejects residual risk.
7. Merge and deploy preserve subjects and receipts.
8. Production feeds back regressions, without erasing history.

Not every PR requires eight people. The roles can be mechanisms and the steps proportional to the risk. The contract matters more than the number of participants.

What this article proves — and what it doesn't prove

Research and public practice show that evaluator–optimizer can improve results when there are clear criteria; PaperBench demonstrates an architecture that also evaluates the judge. The FORGE bundle delimits that test/eval sources do not define universal thresholds and that controls need to be linked to the context. [R3-C1]

This evidence does not prove that every multi-agent system is superior, nor that human review is infallible. People share biases and organizations also create circular authority. Independence needs to be designed, measured and declared.

Conclusion

The agent can explain, test and criticize their own work. This capability reduces cost and accelerates feedback. It should not automatically become authority to declare that a critical property has been proven.

Assurance begins when the subject is fixed, the criteria outlive the executor, the verifier can fail the work and the approver nominally accepts the residual risk. The goal is not to distrust AI on principle. It’s about building trust that doesn’t depend on a single voice — even when that voice is bright and compelling.

Previous reading: Evidence before adjective. Next suggested reading: Accountable human, executing AI.