Why is exact tool-call sequence matching a poor way to evaluate agents?

Agents can reach the goal through several valid paths, so valid runs fail, while a run that follows the expected path but produces the wrong result can pass.

What should an agent eval check instead?

The final state of the environment, constraints such as forbidden actions and required approvals, efficiency against budgets, and, where relevant, the quality of the final message.

Why run each agent task several times in an eval?

Agent behaviour is non-deterministic; success rates over several runs show reliability, which a single pass or fail cannot.

Evaluating Agents: Outcomes, Not Exact Paths — LLM Evals and Guardrails

Scenario

Example company: a team evaluates its IT-helpdesk agent by comparing each run's tool calls with a recorded "golden" sequence: lookup_user, check_license, assign_license, notify_user.

What you see in production

Evals fail constantly: the agent sometimes checks the licence before looking up the user, or skips the lookup because the user ID was in the ticket. These runs are fine. Meanwhile, a run that followed the golden sequence exactly but assigned the wrong licence type passed.

The naive code

def grade(run, golden):
    return [c.name for c in run.tool_calls] == golden          # exact path match

Reproduce it

Grade three runs by exact path and by outcome (final state plus constraints):

Path matching versus outcome gradingTry it yourself

golden_path = ["lookup_user", "check_license", "assign_license", "notify_user"]
runs = {
    "reordered but correct": {"path": ["check_license", "lookup_user", "assign_license", "notify_user"],
                              "state": {"license": "design-pro", "notified": True}, "deleted_anything": False},
    "golden path, wrong licence": {"path": golden_path,
                                   "state": {"license": "design-basic", "notified": True}, "deleted_anything": False},
    "shortcut, correct": {"path": ["check_license", "assign_license", "notify_user"],
                          "state": {"license": "design-pro", "notified": True}, "deleted_anything": False},
}

def path_grade(run):
    return run["path"] == golden_path

def outcome_grade(run):
    s = run["state"]
    return s["license"] == "design-pro" and s["notified"] and not run["deleted_anything"] and len(run["path"]) <= 6

for name, run in runs.items():
    print(f"{name:27} path match: {path_grade(run)!s:5}  outcome: {outcome_grade(run)}")

golden_path = ["lookup_user", "check_license", "assign_license", "notify_user"]
runs = {
    "reordered but correct": {"path": ["check_license", "lookup_user", "assign_license", "notify_user"],
                              "state": {"license": "design-pro", "notified": True}, "deleted_anything": False},
    "golden path, wrong licence": {"path": golden_path,
                                   "state": {"license": "design-basic", "notified": True}, "deleted_anything": False},
    "shortcut, correct": {"path": ["check_license", "assign_license", "notify_user"],
                          "state": {"license": "design-pro", "notified": True}, "deleted_anything": False},
}

def path_grade(run):
    return run["path"] == golden_path

def outcome_grade(run):
    s = run["state"]
    return s["license"] == "design-pro" and s["notified"] and not run["deleted_anything"] and len(run["path"]) <= 6

for name, run in runs.items():
    print(f"{name:27} path match: {path_grade(run)!s:5}  outcome: {outcome_grade(run)}")

Output

reordered but correct       path match: False  outcome: True
golden path, wrong licence  path match: True   outcome: False
shortcut, correct           path match: False  outcome: True

Root cause

Agents choose their own steps, and there are usually several valid paths to a goal. Exact path matching penalises valid variation and rewards runs that look right while producing the wrong result. What matters is whether the environment ended up in the right state, without violating constraints, at acceptable cost.

The fix

Grade the outcome: check the final state of the environment (licence assigned, ticket closed, file contents) in code.
Check constraints: forbidden actions not taken (no deletions, no emails to customers), required approvals obtained.
Measure efficiency separately: steps, tokens and time, with budgets rather than exact counts.
Grade the final message with a rubric where it matters (did the agent explain what it did?).
Run each task several times: agents are non-deterministic, so report success rates (for example, 9 of 10 runs succeed) rather than a single pass/fail.
Use sandboxed environments that reset between runs, so tasks are repeatable.

Trade-offs

Building environments with checkable final states is real work; start with the most common tasks.
Outcome-only grading can miss a lucky success via a dangerous path; constraints and trace review cover that.
Repeated runs multiply cost; use more repetitions for critical tasks.

Detect it in production

Task success rate by task type, from production outcomes (tickets reopened, actions reverted).
Constraint violations caught by guardrails, per agent version.
Steps and cost per successful task over time.

Key points

Grade agents on outcomes and constraints, not exact paths.
Measure efficiency against budgets, and run tasks several times.
Use resettable sandbox environments for repeatable agent evals.

Further reading: Demystifying evals for AI agents · AI Agents and MCP in Production