In short: to test an AI agent before production, list every action it can take in other systems, write down the correct end state for each critical one, run those tasks end to end against a test copy of the real systems, and read the saved records back. Then repeat the runs with errors and timeouts, with misleading inputs, and several times in a row, because one passing run proves little. Re-run the same set before every release.
Why agents need more than unit tests and evals
Unit tests mock the model and the tools, so they never see the agent choose the wrong tool or retry a write. Evals score answers and steps on a dataset, which is useful for quality but does not by itself check what ended up in the CRM or ERP. The numbers from 2025–2026 studies show the gap:
| Source | What it measured | Result |
|---|---|---|
| LangChain survey, Nov–Dec 2025 (1,340 respondents) | Teams running offline evaluations | 52.4% (89% have observability) |
| EnterpriseOps-Gym, March 2026 | 1,150 enterprise tasks graded on final database state, 14 models | Best model, Claude Opus 4.5: 37.4% |
| τ³-bench banking, August 2026 | Tasks solved on one try vs on all four tries | Claude Opus 5: 48.7% vs 32.0% |
| UndoBench, October 2026 | Duplicate side effects after naive retry | Gemini 3.8 Flash: 65.62% of runs |
Benchmarks are not your agent's error rate. They show that these failures appear across recent models, so the checks have to run on your own tasks. The error types behind these numbers are explained in what errors AI agents make.
The 8 steps at a glance
| Step | What you do | Done when |
|---|---|---|
| 1 | List what the agent can change | Every system, object and action is written down with the cost of a wrong write |
| 2 | Define correct end states | Each critical task has expected IDs, amounts, units, status and side effects |
| 3 | Build a test environment | Sandbox copies of the systems, seed data, a reset between runs |
| 4 | Run the tasks end to end | Saved records are read back and compared with the expected state |
| 5 | Test the failure paths | Errors and timeouts end in one correct write or a clean failure |
| 6 | Test misleading and out-of-scope inputs | Nothing changes that should not |
| 7 | Run each task several times | Results hold on repeated runs, not once |
| 8 | Repeat before every release | Someone owns the result and decides on each failure |
Step 1: List what the agent can change
Write down every system the agent can write to, the objects it touches there (orders, contacts, invoices, filings) and the actions it can take on each: create, update, delete, send. Next to each action, note what a wrong write would cost. That list decides where testing effort goes. An agent with ten harmless read actions and one refund action is a refund agent for testing purposes. Least-privilege checks for this step are in AI agent permission testing.
Step 2: Define what correct looks like
For each critical task, write the end state you expect in the system, not the reply you expect from the agent. For "order 120 meters of cable C-300 from the usual supplier", that is one purchase order, the right supplier ID, item C-300, 120, unit meters, status sent. Also write what must not happen: no second order, no change to the supplier record. Twelve worked examples are in AI agent test cases.
Step 3: Build a test environment
Use sandbox or test instances of the real systems, not mocks. Seed them with data that includes the awkward cases on purpose: two customers with similar names, an item sold by the box and stocked by the piece, a supplier on hold. Reset the data between runs so results are comparable. The setup is covered in AI agent test environment: sandbox, seed data, reset.
Step 4: Run the tasks end to end and read back
Run each critical task the way a user would trigger it. After the run, read the records back through the system's API or UI and compare them with step 2, field by field. Compare the agent's own report with the saved records too. An agent that says "done" when the write failed is a hallucinated success, and EnterpriseOps-Gym names the same pattern "Premature Completion Hallucination". How to check the arguments of each call is in how to test AI agent tool calls.
Step 5: Test the failure paths
Real systems return errors and time out. Make the same tasks run while a dependency fails: a server error after the write commits, a timeout, a rate limit, a rejected record. The expected result is one correct write or a clean, reported failure, never two writes and never a silent one. In UndoBench, deduplication enforced by the receiving system took duplicates to 0.00% of runs. The cases are in duplicate writes and idempotency testing and partial failures and rollback testing.
Step 6: Test misleading and out-of-scope inputs
Give the agent inputs it should not act on: an email that asks to change bank details, a request outside its job, a document with instructions hidden in it. The pass condition is that nothing changed in the system and a person was asked where the process requires it. Approval steps are covered in testing human-in-the-loop AI agents.
Step 7: Run each task several times
Agents vary from run to run. On the τ³-bench banking leaderboard, GPT-5.6-sol solved 46.9% of tasks on one try and 27.8% on all four (evaluated July 2026). Run each critical task several times. When a step fails, rerun it before calling it a regression, and treat a repeat failure as real. Separate failures caused by the test environment, such as an expired test login, from failures of the agent.
Step 8: Repeat before every release
Prompts, models, tools and the connected systems all change. Re-run the same tasks before every release that touches the agent, and on a schedule to catch changes on the provider's side. Name one person who decides what happens when a critical task fails. Each failure should come with a trace and steps to reproduce, so the decision takes minutes. This set of checks is what a release gate for an AI agent is. The full pre-launch list is in the AI agent production readiness checklist, and example gates for procurement, legal, finance and supply chain agents are in release gates for AI agents: examples by domain.
How Agentiqa fits
Agentiqa runs steps 4 to 8 as release gates. You describe each task in plain words; Agentiqa runs it in a real browser with a test account, grades each check and looks at what changed in the connected system. When you rerun the failed tasks, AI Quality Manager reports a step as a regression only if it fails again. Unconfirmed failures are listed separately. AI Quality Manager compares each release with the previous one and proposes new tests, which a person approves. First release gates are live within 7 minutes. For enterprise teams, an Agentiqa engineer sets up the gates on the riskiest tasks over a 3-day rollout. Agentiqa is not designed for agents that only answer questions.
FAQ
How do you test an AI agent before production?
List the actions it can take, define the correct end state for each critical one, run those tasks end to end against test copies of the real systems and read the records back. Repeat with failures, misleading inputs and several runs per task, and re-run the set before every release.
Can I test an AI agent with mocks?
For unit tests of tool code, yes. For the agent itself, mocks hide the failures that matter: they never time out after a write, never reject a field and never return an ambiguous error.
How many times should I run each test?
More than once. On the τ³-bench banking leaderboard, Claude Opus 5 dropped from 48.7% to 32.0% and GPT-5.6-sol from 46.9% to 27.8% between one try and four, so a single green run is weak evidence.
Are benchmark scores enough to choose and ship an agent?
Benchmarks help pick a model. They do not test your prompts, tools and systems. See finance agent benchmarks vs testing your own agent.
What tools can run these tests?
Tracing and eval tools cover development and production; a few tools check what the agent changed in the connected systems. How the categories differ is in AI agent release gates vs observability and evals, and eight tools are compared in AI agent testing tools in 2026.
Sources
- LangChain, State of Agent Engineering. Survey of 1,340 respondents, 18 November to 2 December 2025.
- ServiceNow Research, "EnterpriseOps-Gym: Environments and Evaluations for Stateful Agentic Planning and Tool Use in Enterprise Settings", March 2026. arXiv:2603.13594. 14 models released in 2025.
- Sierra, τ-bench leaderboard (τ²-bench and τ³-bench), taubench.com, with submission files in the tau2-bench repository. τ³-banking pass^1 and pass^4 for Claude Opus 5 (evaluated 3 August 2026) and GPT-5.6-sol (evaluated 22 July 2026), checked 3 November 2026.
- Sah et al., "UndoBench: Separating Task Competence from Recovery Capability in Tool-Using AI Agents", October 2026. arXiv:2610.05622. Commercial-model extension: Gemini 3.8 Flash and GLM-5.2.
Testing your own agent? Start free with the Agentiqa Community Edition: 20 runs a month, no credit card. Plans are on the pricing page.