What is the AgentAz standard?

AgentAz is an open standard for grading AI agent prompts. It defines ten production components (role, context, constraints, tool boundaries, memory policy, output schema, validation, safety, approval gates, examples) and five trust levels (ADV, A0, A3, A4, A5). A prompt earns a level only when every component that level requires is present.

How is a CE Score calculated?

A prompt is evaluated against the ten AgentAz components; each is scored as present-and-sound or not. The CE Score is the percentage of components passed plus the trust level the passing set earns. The evaluation method — structural or semantic — is always stated alongside the grade.

Open standard · Specification

The AgentAz Specification

Q: What is AgentAz A4?

A4 is gated execution: the prompt declares role, constraints, and tool boundaries (A3), and additionally requires a genuine human approval gate before high-consequence actions plus explicit safety boundaries. A mistake cannot become permanent without a human seeing it first.

An open standard for grading how production-ready an AI agent prompt is — ten components, five trust levels.

Version 1.0 · canonical specification at agent-kits.com/agentaz-specification · applied by the CE Score

1 · Why a standard 2 · Trust levels 3 · The ten components 4 · How grading works 5 · Referencing AgentAz

1 · Why a standard

An AI agent prompt that reads well in a chat window can fail badly once the agent can act — call tools, write files, spend a budget, take irreversible steps. The failures that matter in production are rarely about wording; they are about missing structure: no declared limit on a tool, no rule for when a human must approve, no guardrail on destructive actions.

AgentAz exists to make that structure measurable. Instead of subjective opinions about whether a prompt is "good," it defines a fixed set of components a production agent needs and a fixed ladder of trust levels a prompt can earn. The result is a grade that is repeatable, comparable, and defensible — the same prompt gets the same result, and two prompts can be compared on the same axis.

2 · Trust levels

A prompt is assigned exactly one trust level. A level is earned, not estimated: a prompt reaches a level only when every component that level requires is present. Length or fluency cannot buy a higher level.

ADV

Advisory onlySuggests, never acts. The prompt lacks the boundaries required to be trusted with tools. Safe for recommendation and analysis, not for autonomous action.

Requires: none of the execution guarantees below.

Unbounded execution (not recommended)The prompt directs action but without declared limits — a role and instructions, but no tool boundaries, safety, or gates. Capable of acting, but not safely. Treated as below A3.

Requires: acts, but fails one or more A3 components.

Bounded executionThe agent can act within known limits. Its role, hard constraints, and tool boundaries are all declared. It does not yet require human approval for high-consequence actions.

Requires: role · constraints · tool boundaries.

Gated executionEverything in A3, plus a genuine human approval gate before high-consequence actions and explicit safety boundaries. A mistake cannot become permanent without a human seeing it first.

Requires: A3 · approval gate · safety boundaries.

Governed executionThe full component set. In addition to A4, the agent validates its own output and manages memory/state explicitly. Suitable for running with reduced oversight.

Requires: A4 · validation · memory policy.

3 · The ten components

Grading is based on ten components. Each is scored as present-and-sound or not. A component only passes if it would actually function when the agent runs — a mention without a mechanism does not count.

Role01

The agent's role, scope, and the limit of its authority are stated explicitly.

Context02

The operating background the task depends on is supplied, not assumed.

Constraints03

Hard rules and refusals: what the agent must and must not do.

Tool boundaries04

Tools are declared with their limits. A tool named without a boundary is treated as unbounded and does not pass.

Memory policy05

A rule for what persists across turns and what is discarded.

Output schema06

The shape of the output that downstream steps can rely on.

Validation07

Checks the agent runs on its own output before returning it.

Safety08

Guardrails for destructive, irreversible, or sensitive actions. "Be careful" is not a guardrail.

Approval gate09

A human approves before high-consequence actions execute — the action is prepared, presented, and execution waits. Required above A3.

Examples10

Worked examples that anchor behaviour on edge cases.

4 · How grading works

A prompt is evaluated against the ten components. The set of passing components determines the trust level, per the requirements listed above. Two evaluation methods exist:

Structural — checks whether each component is declared. Fast, runs client-side, free. Good for a first pass.
Semantic — evaluates whether each component is genuinely sound rather than merely mentioned (for example, whether an approval gate actually pauses execution). More rigorous.

The CE Score is the concrete grade an evaluation produces: a percentage of components passed, plus the resulting trust level. A CE Score is only as meaningful as the method behind it, so the method is always stated alongside the grade.

5 · Referencing AgentAz

AgentAz is open to reference. If your project, prompt, or agent meets a trust level, you can state it — for example, "system prompt meets AgentAz A4." To keep the claim meaningful, it should reflect an actual evaluation against the components above.

Suggested reference

Graded against the AgentAz standard (v1.0).
Trust level: A4 — gated execution.
Spec: https://www.agent-kits.com/agentaz-specification

Grade a prompt against this standard

Paste an agent prompt and get its CE Score — the passing and failing components, the trust level, and the fixes.

Run a free audit →

AgentAz v1.0 · maintained by CEPrompts