Seven levels, from prompted to adaptive. Every level above the floor carries criteria you can pass or fail, because a level described in adjectives places nobody. It is cumulative: you hold a level only when every criterion at it and below passes.
Version 1.0 · Updated 2026-08-27 · 7 levels · 18 criteria
Cumulative, not a menu. A harness holds level 4 when everything at levels 1, 2, 3 and 4 passes — not when it has an evaluation suite. Without that rule everyone picks the rungs they already have, and the model stops placing anyone.
Every criterion is an action with an outcome. If you cannot run it and get an answer, it does not belong here. The wording is deliberately the same shape as the control matrix's tests, because they are the same kind of thing.
Every level also says what stays broken if you stop there. That half is the honest one: levels are not virtues, they are trade-offs somebody made on purpose.
This is self-assessed, which is the weakest form of assessment there is. The model is published so the criteria can be argued with, and the claim behind it states what would falsify the ordering.
cumulativetheoreticallow
The claim this rests on: HE-CLAIM-006 — retrievable over MCP with get_claim.
A person drives every run. The model is called by hand, the prompts live in chat windows and in somebody's notes, and nothing about a run survives it.
The floor. It has no criteria of its own: this is where a harness is when level 1 fails.
What stays broken if you stop here
Nothing is repeatable, so nothing can be improved. Two people asking for the same thing build two different systems, and neither can say why theirs works.
The calls are in code and the prompts are versioned artefacts. A run can be reproduced from the repository instead of from someone's memory.
Criteria
Take a run from last month and reproduce it. The prompt, the model and the parameters all come from version control.
Read offACM-15
Change a prompt. The change appears as a diff with an author and a date, and the previous version is still retrievable.
Read offACM-15
Ask which model version served a given run. The answer comes from a record, not from an assumption about what was current that week.
What stays broken if you stop here
The agent still cannot act on anything, so its cost is bounded by its uselessness. Stopping here is a defensible choice; calling what you have an agent is not.
The agent acts on real systems through a declared tool surface: every tool listed, scoped, owned, and refused server-side when pointed somewhere it should not go.
Criteria
Produce the tool catalogue. Every tool the agent can call is in it, with a written scope, whether it writes, and a named owner.
Read offACM-01
For each tool, show its credential and that credential's server-side scope. No two tools share one whose reach exceeds either of them.
Read offACM-02
Call a write-capable tool with an out-of-scope target. It is refused by the tool's own boundary, not by the model declining.
What stays broken if you stop here
The agent can now cause damage and nothing yet bounds how much. Every incident from here on is an incident in a system that matters.
The harness enforces limits it does not ask the model to respect: egress is default-deny, consumption is capped by the host, and untrusted content is data rather than instruction.
Criteria
From inside the agent's environment, request a host that is not on the list. It fails at the network or proxy layer and the refusal arrives as security signal, not as a timeout.
Run a task designed not to terminate. A quota stops it, the stop is recorded, and the cost of the attempt was bounded and known before it started.
Read offACM-07
Plant an instruction inside a document the agent retrieves. It may read it; it must not act on it, and the attempt is visible afterwards.
What stays broken if you stop here
The blast radius is bounded and the quality is not. The system fails safely and nobody can say whether it works.
Change is gated by a suite somebody has watched fail. Regressions block release, repeatability is a number, and the gap between what the agent claims and what a verifier finds is measured.
Criteria
Introduce a known regression. The suite catches it and the change does not ship. A suite never seen failing has an unknown catch rate, not a perfect one.
Run the evaluation set five times with nothing changed and say how many cases reached the same verdict every time. The number exists and somebody knows it.
Compare what the agent claimed for a set of runs against what an independent verifier found. The difference is a number, and it is not assumed to be zero.
What stays broken if you stop here
Quality is measured and accountability is not. When something goes wrong you can prove that it regressed and not who allowed it through.
Authority, evidence and escalation have owners. A run can be reconstructed by somebody who was not there, gates exist because a risk criterion put them there, and the threat model is younger than the tool catalogue.
Criteria
Pick a past run at random and reconstruct it end to end from the log alone, without the original operator present. Then confirm the log holds no secret it did not need.
List the gated actions and the risk criterion that put them there. Force an escalation; it reaches a named person within the stated time, carrying the context needed to act.
Show the current threat model and the date of the last change to the tool catalogue. If the catalogue is newer, this criterion fails and the level is not held.
Read offACM-18
What stays broken if you stop here
Everything is in place and nothing expires. The harness will still be enforcing, next year, the compensations a model needed last year.
The harness changes on evidence, including by removing itself. Components carry the model they were validated against and the condition that would retire them, and something has actually been retired.
Criteria
Name a control, a prompt rule or a context block removed in the last two quarters, and show the measurement that justified removing it. "We tried it without and it seemed fine" is not a measurement.
Measured bycvo
For a component still in place, state the model it was validated against and the condition under which it would be retired. Both are written down, not remembered.
Read offACM-15
Show the cost per correctly verified outcome for the same task set across two model generations, each with the harness that generation actually needed.
What stays broken if you stop here
Nothing here is stable, and that is the point. A harness that changes on evidence needs the evidence to be good, and every metric on the scorecard can be gamed by whoever is being measured by it.