ARTIFICIAL INTELLIGENCE · CYBER-MED
AI agents: useful tests also cover when to stop.
Correct answers, missing information and out-of-scope requests: defining expected behaviour first makes a business assistant easier to evaluate.
From the task to expected behaviour
A successful demonstration is a starting point. Evaluating an AI agent also means describing how it should behave when a source is missing, a question is ambiguous or a request exceeds its assigned permissions.
The NIST AI RMF Playbook’s Measure function suggests documenting test sets, metrics and evaluation tools. This provides a reference for comparing the system’s purpose with its observed behaviour.
Three fictional cases to test
Imagine an assistant searching authorised documents for internal procedures. The example materials are fictional and contain no client information or health data. Before testing, the team agrees on adequate behaviour for each case.
- Source available: find the relevant procedure and identify the document used.
- Insufficient information: flag a missing source or ask for clarification, without filling the gap with invented details.
- Request beyond permissions: respect the defined scope and follow the next step specified by the organisation’s procedure.
Compare expected and observed behaviour
For each test, record the question, available sources, system version, expected behaviour and observed outcome. Asking for clarification at the right moment can also be useful: what matters is consistency with the agreed process, not merely producing an answer.
An unexpected outcome should be examined before expanding use: does it concern a source, a permission, the wording of a request or a system limitation? Corrections and subsequent tests should remain documented.
Evaluation continues over time
A limited test does not guarantee reliability in every situation. Changes to documents, roles or the system may require further checks. An initial discussion with Cyber-Med can start with the process and outcomes the team wants to observe, using fictional examples first.
Sources and further reading
NIST AI RMF Playbook — Measure, particularly 1.1 and 2.1
NIST — AI Risk Management Framework
Sources checked on 19/10/2026. AI RMF is a voluntary reference; NIST states that AI RMF 1.0 is being updated. The three cases and practical questions are Cyber-Med educational suggestions, not an official NIST checklist, a certification or results from actual product testing.
Scopri il servizio Cyber-Med ↗
The topic in 35 seconds
Silent educational video with Italian on-screen text. Italian and English subtitles and transcript are available.
Read the transcript
- 00:00–00:07 Can it also stop? Useful tests check answers, clarification requests and respect for the defined scope.
- 00:07–00:14 What do we expect? Fictional example: find an internal procedure and identify the source used.
- 00:14–00:21 What if information is missing? Define when to flag an absent source or ask for clarification, without making things up.
- 00:21–00:28 Expected and observed. Record the case, sources, result and issue encountered. Check access limits too.
- 00:28–00:35 Correct and retest. One test does not guarantee every outcome. Let’s choose the first process: info@cyber-med.it
View the carousel: 5 cards
