Agentic systems fail in ways that individual-action checks do not catch. This article describes a method that scores the trajectory of an agent conversation in real time and, in a controlled experiment, predicts its outcome — using a model built with no domain expert and no hand-written rules.
Verification of agentic systems has to operate on trajectories, not on individual actions.
I. PROBLEMFailure is a property of the sequence
Consider an AI agent that reads a calendar, reads an OAuth token, and enumerates a mailbox. Each action is a permitted capability and passes any per-action check. The unsafe behavior is in the sequence, not in any single step.
Most safety mechanisms operate on individual actions. Output filters inspect responses; permission systems inspect calls. Neither evaluates the trajectory — the ordered sequence of turns, reasoning steps, and tool calls that constitutes an interaction. A conversation can be locally reasonable at every step and still converge on a harmful outcome.
Approaches that do work at the trajectory level share a practical limitation: they require a domain expert to specify the structure in advance. Rule-based systems need an enumerated set of allowed and disallowed sequences. Intent- and flow-based monitors need a defined taxonomy of intents and the permitted transitions between them. Symbolic abstractions need a hand-designed mapping from raw traces to categories. In every case, a person who understands the domain must encode its expected behavior — and re-encode it for each new domain and each change within one. This does not scale.
The requirement is a trajectory-level model that is learned from data rather than specified by an expert.
II. INTUITIONConversations have a characteristic shape
A conversation is not an unstructured stream of text. It moves through a sequence of situations: a support interaction typically proceeds from a request, to diagnosis, to resolution. Conversations that succeed tend to move through these situations in regular ways. Conversations that fail tend to depart from them — stalling, repeating, or entering situations that rarely occur in successful cases.
Much of this signal is in the flow between situations, not only in the wording of a single turn. An experienced reviewer can often tell that a conversation is going wrong from how it is progressing, before the specific error becomes explicit. The hypothesis of this work is that this progression is measurable and predicts outcome — and, critically, that the situations and the flow between them can be discovered from data rather than specified by hand.
III. REPRESENTATIONFrom conversation to path
To measure the progression, each turn must be represented by the kind of situation it belongs to. This is done with a vector embedding: a turn is mapped to a point in a high-dimensional space such that turns with similar meaning map to nearby points and dissimilar turns to distant ones. “Retrieve the customer’s schedule” and “look up their calendar” fall close together; “retrieve the schedule” and “export the account credentials” fall far apart.
Across many conversations, turns concentrate in certain areas of this space. Clustering partitions the space into regions, each corresponding to a recurring situation in the domain. The regions are not defined in advance; they emerge wherever turns concentrate. A conversation then reduces to the sequence of regions its turns fall into — a path, for example region 7 → region 12 → region 3 → region 31.
Each turn is embedded and assigned to its nearest region. The conversation becomes an ordered sequence of regions — a path — that can be compared against the paths of other conversations.
The regions are domain-specific: they capture the actual situations that arise in this domain, from the data. But they are derived automatically rather than specified by a designer, so no taxonomy of intents is required, and a conversation is now a discrete path that can be compared quantitatively against others.
IV. CONSTRUCTIONLearning which paths fail
The representation yields a path; a model is required to score it. Construction uses a corpus of past conversations, each labeled by outcome — success or failure.
Turns from all conversations are embedded and clustered into regions, fixing the set of situations. Each conversation is converted to its region path. From these paths, two transition models are estimated: one over the successful conversations and one over the failed ones. Each is a first-order Markov chain, recording for every region the probability of moving to each other region next. The successful model captures how successful conversations move between situations; the failed model captures how failing ones move.
Construction runs once and offline. The regions, the two transition models, and the decision thresholds are all fixed at this stage — the only stage that uses labels or any dataset-specific information.
This is the only part of the method that uses labels, and it runs once. No rules, annotated transcripts, or hand-specified intents enter the system: both the regions and the flow between them are estimated directly from labeled outcomes. This is the central property of the method — the domain structure it relies on is learned, not supplied by an expert.
V. SCORINGScoring a live conversation
At runtime, the two fixed models score a live conversation turn by turn. When a new turn arrives, it is embedded and assigned to its nearest region. The transition from the previous region to the current one is evaluated under both models: its probability among successful conversations, and its probability among failing ones. The log-ratio of the two is the turn’s contribution. Contributions accumulate over the conversation and are mapped to a value between 0 and 1. Per turn this is a region lookup and an arithmetic update; the embedding is the only non-trivial cost, and many agent stacks already compute it.
The resulting value is a probability, not a magnitude. It estimates how consistent the conversation’s path is with the failing population relative to the successful one — how failure-like the trajectory is — not the severity of any harm. A high value does not describe what is wrong; it indicates that the conversation is moving the way failing conversations move. It is also a relative signal rather than a calibrated probability of failure; what the value corresponds to in absolute terms is an empirical question, addressed next.
VI. EXPERIMENTTesting the signal on a benchmark
The method was evaluated on tau-bench, a public benchmark of AI-agent customer-service conversations. Each conversation carries a task reward; conversations with reward at or above a threshold are labeled success, the rest failure. After balancing the two classes, the evaluation uses 1,908 conversations, split at the conversation level into a training portion and a sealed validation set of 635 conversations held out entirely from construction.
The procedure is applied without domain-specific input. Turns are embedded with a general-purpose sentence model; the number of regions is selected by grid search on the training portion (40 in this run); the two Markov models and the thresholds are fit on that portion. No customer-service knowledge, hand-written rules, or manual features are introduced. The validation set is then scored once, and outcome is predicted from the region path alone.
VII. FINDINGSThe path predicts outcome
On the sealed validation set, the trajectory score attains an AUROC of 0.81 for predicting conversation outcome, computed entirely from the sequence of regions the conversation passes through.
Each of the 635 held-out conversations plotted at its assigned risk score, sorted from safest to riskiest. Successful conversations concentrate at low risk and failures at high risk, with substantial overlap in between. AUROC = 0.81.
Successful conversations concentrate at low scores and failures at high scores, with a real overlap between them. The overlap reflects the limits of the signal, not a threshold artifact: the ordering is informative but the classes are not linearly separable.
A second measurement concerns early prediction. Among conversations whose score has already crossed a given threshold by a given turn, the majority end in failure:
| Score crosses | By turn | End in failure | Recover | Coverage |
|---|---|---|---|---|
| > 0.60 | ≥ 3 | 92% | 8% | 6% |
| > 0.55 | ≥ 7 | 87% | 13% | 12% |
| > 0.55 | ≥ 9 | 93% | 7% | 13% |
| > 0.50 | ≥ 12 | 81% | 19% | 27% |
These bands cover a minority of conversations, but within each the empirical probability of failure is high — 87–93% for the earliest, highest thresholds. This is where the score’s probabilistic reading becomes concrete: crossing a threshold early corresponds to a measured failure rate, not only to a high relative score. The signal functions as a high-precision, low-coverage early-warning indicator rather than a comprehensive detector.
Because the score accumulates along the path, it is defined at every turn. In the failing example, the score crosses the high-risk threshold at turn 4, before the conversation completes.
Because the score accumulates along the path, it is defined at every turn rather than only at the end. A failing conversation typically crosses the high-risk threshold several turns before it terminates — within the interval where intervention remains possible.
VIII. CONCLUSIONA primitive for runtime governance
The sequence of situations a conversation moves through carries a measurable signal about its outcome, and that signal can be extracted automatically — from outcome labels, a general-purpose embedding, and clustering — with no domain expert specifying intents or flows. It runs at negligible per-turn cost. Its natural use is as an input to a policy engine: a continuous per-turn score that a governing layer maps to an action such as increased monitoring, human approval, or interruption. It is a signal for that decision, not a decision in itself, and a low score is evidence rather than a guarantee.
The result is a single-domain proof of concept and should be read as such. It uses one dataset; cross-domain generalization has not been tested. The thresholds are calibrated to one benchmark’s base rate and conversation-length distribution and would require recalibration elsewhere. The method detects atypical trajectories, not incorrect content: a failure that follows a normal path while stating something incorrect will not register. And discrimination is bounded by the embedding model’s ability to separate situations.
Within those bounds the finding is specific: semantic region paths are a practical primitive for agentic runtime governance, and one that requires no domain expertise to construct. Establishing generalization across domains, calibration under distribution shift, and robustness to adversarial paths that remain within familiar regions are the next steps.
This is early work. If you build or operate agent systems and would consider evaluating a trajectory monitor on your own traces, get in touch.