Certify the Conversation, Not Just the Agent

Last week we argued that you didn't deploy the agent you evaluated. The fix we proposed was a chain of identity: one behavioral revision that follows an agent from evaluation, through certification and authorization, into execution and audit.

This month we shipped the next layer of that chain. Reading the release list back, every item does one of two things. It makes the evidence behind a decision more specific, or it makes the thing being certified bigger than a single agent. Here is what changed, and why we think both directions matter more than any individual feature.

A run can now explain itself

Observability tells you what an agent did. A system of record should tell you why it was allowed to, and what would have stopped it.

Every run in Multisynapse now carries a diagnosis: a short list of findings drawn from the platform's own records rather than from a log stream. If a tool was refused, the diagnosis names the policy decision and its reason. If the model was offered no tools, it says so and says why. If a knowledge lookup came back empty, if a conversation was trimmed to fit the context budget, if the run executed a revision that is no longer the promoted one, if a judge failed the answer and what its rationale was: each of these is a finding, and each finding points at the exact record it came from.

The findings are deterministic and free. When you want prose, ask for it, and the narrative is written only from those findings. It cannot invent a cause the record does not support, and if the record grows after the narrative was written, the narrative says it is stale.

We built this because the most common question we hear from operators is not "what happened" but "why did it do that." The answer should come from evidence, not from a screenshot of a trace and a guess.

Conversations are the unit now

Most agent failures we have watched in production did not happen in a single turn. They happened in the third turn, because of something the second turn set up.

Online evaluation can now score a whole conversation as one unit. Once a session has been quiet for a while, the judge sees the earlier turns as history, the final turn as the thing being graded, and the tool results from every turn, so it can tell a grounded answer from an invented one across the whole exchange. Any conversation can also be promoted into a golden example with all of its turns intact, so your regression suite grows to include the exact multi-turn shapes that failed in production.

Single-turn evaluation has not gone anywhere. But the unit of certification is moving toward the conversation, because that is the unit users actually experience.

Coding agents inside the trust boundary

Engineering teams are handing real capability to coding agents. Those agents call tools, open pull requests, query systems and read data, and they do it from a developer's laptop.

Multisynapse has always been able to serve as the MCP server those agents talk to. What changed this month is attribution. Every tool call a coding agent makes through the platform is now recorded against the specific client that made it, checked against policy, subject to the same kill switches and budgets as any other agent, and visible in a feed you can filter by client. Tokens minted for coding agents now expire by default, because configuration files outlive the laptops they were written on.

The distinction we care about: tracing a coding agent tells you what it did. Putting it behind a governed server decides what it may do. We think the second one is where enterprise adoption of coding agents will actually be won.

Smaller changes that make evaluation trustworthy

A few things shipped because our own evaluation practice hit them.

• Candidate provenance. When production traffic is nominated for review, the queue now records which scorer, at which version, made the call. A verdict from an untuned scorer looks different from a verdict from your aligned judge, and now you can see the difference.
• No accidental backfills. A new scoring job grades traffic from the moment it is created. Re-judging history is a deliberate choice, not a side effect of clicking save.
• Judges aligned as they run. Alignment runs can now measure a judge at the same settings it uses in production, so the error rates you sign off on describe the judge you actually deployed.
• Model allowlists. A provider credential can name the models it may be used for, and every path through the platform honors it: agents, judges, the playground, the gateway. A refused call is recorded as evidence, not lost.
• Version notes. Agents, scorers and datasets now carry a note with each saved version, so a reviewer reads intent instead of reconstructing it from diffs.

None of these are headline features. All of them are the difference between an evaluation program people trust and one they route around.

The swarm, seen honestly

Agents delegate to agents. Every platform draws that as a diagram. The question a system of record has to answer is different: does the diagram match what actually happens?

The swarm view in Multisynapse now reconciles the handoffs you declared against the handoffs that were actually observed. Declared and in use. Declared but never exercised. Observed but never declared. That last state is the one that matters: an agent handed off along a path nothing certified. Today we show it and count it. Where it goes next is the part we are most excited about.

Where this is going

Put the pieces together and the direction is clear. Certification is moving from the node to the composition. You certified the agent; did you certify the swarm? The conversation, not the turn, is becoming the unit of evaluation. And the evidence behind every decision is becoming specific enough to cite.

The next steps follow from that. A delegation path should be a promise both sides made, not a wire one side drew. A composition of agents should carry a behavioral identity of its own, so that when any member changes, the whole is re-certified. Trust in a path should be earned by kept promises and should decay when the evidence stops arriving. And containment should be a judgment aggregated from the agents that actually depend on one another, not a single monitor's threshold.

We have written about why we think swarm theory and promise theory are the right lens for this. This month's release is the first slice of that argument turning into product. The rest is on the roadmap, and we will keep doing it the same way: build the thing that checks, then show the evidence.

If you are running agents that act, and you cannot yet answer "is this the agent we approved" for the whole chain, talk to us.