Your Agents Are Performing

Imagine you hire an employee. Every morning they arrive early. They type constantly. They file reports that say "great progress today." Their calendar is full, their inbox is zero, their status updates are impeccable.

At the end of the month you check the only thing that matters: what shipped?

Nothing. Not one email sent, not one deal advanced, not one document delivered. The busyness was real — the work never existed.

You would fire that employee in a heartbeat. Here's the uncomfortable thing: there is a decent chance you are employing dozens of them right now, and they are not people. They are AI agents. And unlike the human, they will never get caught by accident — because every one of them writes its own performance review, and the review always says "done."

I know because it happened to me, in a system I built, believed in, and was wrong about. I audited it three times in eleven days. I published all three audits, including the two failures. This essay is what I learned.

The company that ran itself, except it didn't

My company runs on an AI organization we built ourselves: executive agents that own budgets and send volumes, operating agents that draft outreach and publish content, a scheduler, a decision ledger, permission gates, validation checks — the whole apparatus, running nine real brands with real revenue consequences. This was not a demo. It sent real email to real people and closed real business.

On July 2nd I audited it with one rule: the database is the ground truth, never the logs. Not "did the cron run" — did the outcome row exist. Not "did the agent report success" — did the thing verifiably happen.

The findings, from the audit I published:

• 18 emails ever sent — none in the previous 17 days — while the drafting loops ran happily every single day. 256 drafts had expired, unapproved, into the void.
• Zero enrollments ever into our flagship nurture sequence, against 500+ qualified leads. The loop was gated on a bootstrap row that no code had ever created. The loop ran daily. It reported success daily.
• Zero agent grades ever recorded — because the grader cron ran twelve hours before the metrics it needed were written. Every day. Reporting success every time.
• 251 of 251 executive decisions ungradeable — every prediction hardcoded to zero, so the self-evaluation machinery was structurally dead while appearing fully built.

The diagnosis in one line: nine producers, two consumers. Nine loops sensed, deliberated, decided, and logged — then poured their output into queues that nothing, anywhere, consumed.

Here is what should terrify you: every individual subsystem was correct. The drafting loop really did draft. The grader really did run. The scheduler really did fire. Each one measured its own motion and called it success. The system was architecturally excellent and completely dead, and no dashboard we had could tell the difference.

I started calling this failure mode performed autonomy, and I've since formalized it in a paper, because I don't think my system was unusual. I think it's the default state of most agentic AI in production today.

Performed autonomy: an AI system exhibits performed autonomy when (1) its loops execute and report success — they sense, deliberate, decide, and log (motion); (2) no verified outcomes appear at the terminal edge (delivery); and (3) the divergence is invisible to the system's own instrumentation, because each subsystem's success criterion is its own motion rather than the edge's delivery. An outage is visible. Performed autonomy is self-certifying.

Why LLMs made this disease invisible

Old-school automation failed loudly. A broken script threw an exception; a stuck workflow stopped moving. You noticed.

Large language models fail gracefully, and that is precisely the problem. An LLM organization generates fluent decisions, plausible rationales, professional-looking drafts, and satisfied log lines whether or not anything ships. The intermediate artifacts are so convincing that they substitute for the outcome. Twenty-five years of multi-agent systems research never met this disease for an unflattering reason: symbolic agents couldn't produce persuasive motion. Yours can. Your agents can perform diligence, perform judgment, perform completion — organizational theater with perfect paperwork.

And it gets worse, because the disease migrates. Five days after the first audit, after we'd shipped structural fixes, I audited again. Real delivery had resumed — 60 sends, 283 enrollments, real outcomes in the database. Victory? No. The governance was now the fake part. Our permission gate — the mechanism that stops one agent from pulling another's levers — had fired exactly once in the system's entire history, and the delivery paths simply routed around it. Zero of 321 "measured" decisions had ever actually been graded. The append-only audit log turned out to be quietly editable.

The system had moved from doing nothing while performing work to doing real work while performing governance. That second condition is scarier, because it survives every "does the table have rows?" check a diligence team will ever run.

The two questions that catch it

You do not need my tooling to check your own agents this week. You need two questions, asked against your database — never against your dashboards, and never answered by the agent itself.

Question one: "Show me one real thing, end to end." Pick your most important agent workflow. Trace a single unit of work by ID from trigger → decision → action → verified terminal outcome — the row in the table that proves the email actually sent, the ticket actually filed, the record actually updated. Not the agent's claim. The row. If nobody in your organization can produce one such trace in an afternoon, you are not governing agents; you are hosting theater.

Question two: "What didn't happen — and where is that written down?" This is the one nobody asks. Every agent has a job: things that are supposed to occur on schedules, on events, on dependencies. Ask for the list of everything that was supposed to happen last week, diffed against what did — with every miss recorded and explained. Silence is the failure mode that backward-looking checks can never catch. If missed work leaves no trace, your agents can quietly stop doing their jobs forever, and your first notification will be a customer.

When I show people these two questions, someone always asks the vendor version: "Can I see the probe log?" Ask it in your next AI vendor meeting. The reaction is diagnostic.

The cure is structural — none of it is prompt engineering

We fixed our system, and the third audit — same instrument, same rules of evidence — verified a recovery traced end-to-end by ID. Not one line of the remediation was a better prompt. Rules that live in a prompt are requests to a system that can be talked out of them. All of the cure was structure:

1. Outcome-keyed completion. No unit of work is "done" until the delivery assertion holds in the database. The agent's return value is not evidence. This single change makes motion-without-delivery structurally impossible instead of policed.
2. Permissions as code paths, not instructions. An agent that attempts an action outside its authority doesn't get scolded — the substrate converts the attempt into a request to the authorized role and returns without executing. It's proof, because there is nothing to argue with.
3. Falsifiability at the moment of decision. Every autonomous decision must carry a testable prediction — metric, baseline, horizon — enforced at commit. A decision that cannot be wrong cannot be recorded. Then you grade them when the horizon arrives.
4. A duty roster with silence detection. Every responsibility an agent owns is declared — trigger, expected outcome, deadline — and diffed against reality daily, so a missed duty raises an alarm because nothing happened.
5. The pair rule. Every producer ships with its consumer. Every queue names who drains it, every ledger names who grades it, every gate is placed where delivery must pass through it. An unconsumed mechanism is not partial credit; it is theater with extra steps.

As I write this, that once-flatlined system has 21,000+ scheduled duties on its ledger with a 98.4% verified-delivery rate — and, more telling, 343 recorded misses, every one written down by an independent watchdog and alarmed on. I can tell you exactly what my AI failed to do last week. Ask your vendor for that number. And its decisions are now graded against their own predictions: 15 of the first 16 landed in the predicted direction. Sixteen is a small sample — I tell you the n because the whole point is that numbers without their evidence are how this disease spreads.

Check your own

I published everything: the failures, the recovery, the method, the schema. The audit methodology and the standard we distilled from it — we call it GOVENANT — are free, open, CC BY, for anyone to use, including my competitors: govenantstandard.org. The formal paper, with the definition, the three audits, and the structural mechanisms, is open access: doi.org/10.5281/zenodo.21440225.

I did this because the alternative embarrasses all of us. An industry that cannot distinguish agents that work from agents that perform will eventually be forced to make that distinction by regulators, by lawsuits, or by a catastrophic quarter — and it will deserve the forcing. The cheaper path is the boring one: measure delivery, not motion. Write down what didn't happen. Grade your own predictions. Publish your zeros.

Your agents are performing. Mine were. The only question is whether you find out from your own audit — or from someone else's.

---

Scott Fielder is the author of the GOVENANT Standard and a founding partner at iii.partners, the standard's first implementer, where the audits described in this essay are available as a service.