Benchmarking Agent Decisions at Action Boundaries
Listen to the summary
Uses a voice available on your device
Audio options
On this page 4 sections
Related concepts 3 concepts
Key Takeaways
- Models are significantly more prone to over-refusal, holding authorized work in 28.1 percent of cases compared to just 1.0 percent under-refusal.
- The 31.4 to 1 raw miss ratio demonstrates a strong bias toward excessive caution in autonomous workplace agents.
- Performance drops from 98.5 percent accuracy on original incidents to 63.8 percent on evidence-reversed mirrors, showing reliance on superficial patterns rather than logical context.
- The benchmark covers 106 scenarios derived from public AI incident reports to measure agent steering accuracy.
Summary & Methodology Analysis
The researchers developed SteerBench-Work to address the commit decision problem where agents must choose between executing an action or requesting human intervention. The methodology involves presenting a frozen system prompt, which acts as the model instruction set, to various agents. Each prompt contains the user request, the proposed action, and relevant evidence. Agents must output a JSON verdict that includes the commit permission, policy action, confidence score, and reasoning. The team evaluated 30 model conditions using five independent trials per scenario to derive metrics for mean accuracy, modal-of-5 results, and consistency across multiple attempts. Results were stratified by domain, effect metadata, and human-authored irreversibility severity levels to analyze performance gaps.
Evaluation shows a stark imbalance in decision-making behaviors. While under-refusal, or the unsafe execution of prohibited tasks, remains low at 1.0 percent, over-refusal occurs in 28.1 percent of opportunities. The study highlights that agents are sensitive to the context of incidents; when presented with evidence-reversed mirrors of famous scenarios, model accuracy plummeted from 98.5 percent to 63.8 percent. This suggests that current agents often rely on shallow pattern matching rather than robust reasoning when evaluating the safety of an action at the boundary of human oversight.
The benchmark has several limitations for engineers to consider. It uses constructed, single-turn descriptions rather than a live execution harness, meaning it does not capture agent behavior during long-running sessions or post-denial loops. Furthermore, the severity tiers are based on human-authored labels rather than objectively measured environment properties. The authors also note that they do not control for potential discrepancies in complexity between scenarios labeled for proceed versus those labeled for hold. Consequently, the results reflect the agent's response to static text-based prompts rather than its performance in an integrated production environment.
Interactive System Flowchart
Cross-Examination & FAQs
A deeper dive clarifying mechanics, constraints, and baseline evaluations.
Q1. What is the primary goal of SteerBench-Work?
The goal is to measure how effectively agents decide whether to proceed with an action or hold it for human review at the point of task execution.
Q2. What are the two main types of failures identified in the study?
The study identifies under-refusal, where agents wrongly allow unsafe work, and over-refusal, where agents wrongly block authorized or evidence-cleared work.
Q3. Which models were tested using this benchmark?
The study tested 30 model conditions including various versions of GPT, Claude, Gemini, DeepSeek, and Kimi, among others.
Q4. How are the scenarios constructed for this benchmark?
The corpus consists of 106 scenarios derived from public incidents, which are paired with evidence-reversed mirrors and calibration controls to test logical consistency.
Q5. What is the specific performance difference between original and evidence-reversed scenarios?
Models achieved 98.5 percent accuracy on original incidents but only 63.8 percent on the evidence-reversed versions.
Q6. Does this benchmark measure agent behavior in real-time execution environments?
No, the benchmark relies on constructed, single-turn descriptions and does not involve live execution in a harness.
Q7. How does the benchmark define severity in its results?
Severity is measured using human-authored irreversibility tiers rather than measured environment properties.
Q8. Are there any controls for the difficulty of scenarios?
The paper does not control for potential differences in authored difficulty between proceed-labeled and hold-labeled scenarios.
Q9. What does the model output include for each evaluation?
The model must return a structured JSON object containing commit permission, policy action, confidence, and reasoning.