Safe AI agents need layered checks with different blind spots, not one giant judge

No single test can make an AI agent safe to ship. That was the argument of Laurie Voss, head of developer relations at Arize AI and a co-founder of npm, on the AI Engineer show. He said teams should run several small evals, which are automated tests of agent output, each with different blind spots. They should also decide up front which checks can block a release.

What was said

Voss borrowed the Swiss cheese model from the security world. Every layer of defense has holes. What matters is that the holes sit in different places. In his words: "Every eval you have is going to have a blind spot."

He named three kinds of check. Code evals catch formatting problems but miss problems of meaning. LLM judges, which are models grading another model's work, catch reasoning gaps but miss some subtle made-up facts. Humans catch the subtle cases but cannot read every trace.

He warned against cramming everything into one big judge. "It is called the God evaluator because it is such a common pattern." When that judge fails, he said, nobody knows whether accuracy, tone or something else went wrong. His fix was one evaluator per dimension, such as faithfulness, correctness and actionability.

Why it matters

Our reading: agents produce polished, confident output at volume, so a hole in your only check lets the same error through every time. Voss's demo agent wrote a stock report claiming 116% of analysts agreed, and nothing in the existing checks caught it.

For teams that build agents, narrow evals also tell you what broke. For people who buy them, the useful questions are plain. Which checks run? What does each one miss? Which failures stop a release, and which are only tracked? An answer like "it looks fine to us" does not cover those.

The other side

Voss gave no number for how many layers are enough. He said only that you need enough different kinds of check. Layering lowers the odds of a miss but does not remove them, and he said plainly that every layer has holes.

The judges also need checking. He treats a judge as a classifier whose predictions must be compared with a human expert's labels. In his demo he was that expert, and he admitted he was not necessarily the one you would want. Human review is the scarce resource here, and he noted that humans cannot look at every trace.