For a while, every agent action that passed through our system got a trust score. One number, between zero and one, meant to capture how safe the action was. It looked scientific. It fit neatly in a dashboard. Customers understood it instantly, or thought they did.

We deleted it.

Not softened it, not tuned it, deleted it. In its place is something that looks less tidy and works far better: a signed, structured verdict that keeps distinct kinds of risk separate instead of blending them into a single figure. This is the story of why the single number had to go, and what we learned building the thing that governs whether an agent action is allowed to execute. We are not going to lay out the full model here, for reasons that will become obvious, but the principle behind it is worth sharing, because the mistake it corrects is one almost everyone is currently making.

The Seduction of a Single Number

A scalar trust score is the obvious first design. You take everything you know about an action, the intent, the context, the risk, the history, and you compress it into one value. High is safe, low is dangerous, set a threshold, and you are done. It demos beautifully. A dial that goes from red to green is the most intuitive object in security.

It is also, we came to believe, close to useless, and in some ways worse than useless because it hides its own failure behind a veneer of precision.

The trouble starts the moment anyone asks what the number means. An action scores 0.72. Is that good? Compared to what? A trust score has no units and no anchor. It is not 0.72 dollars or 0.72 probability of anything measurable. It is a feeling, rendered as a decimal to make it look like a measurement. Nobody, including the people who built the scorer, can tell you what distinguishes a 0.72 from a 0.68 in a way that would survive scrutiny.

Which leads directly to the second problem. Where do you put the threshold? Every line you draw is arbitrary. Block below 0.7 and you have decided, with no principled reason, that 0.69 is a crisis and 0.71 is fine. The threshold is not derived from anything. It is a knob someone turned until the false positive rate felt tolerable, and it will be wrong for half the actions it judges, because a single cutoff on a meaningless axis cannot be right.

The Number Throws Away the Why

The deepest problem is not that the score is uninterpretable. It is that it destroys information, and specifically it destroys the information you most need at the moment of a decision.

Consider two agent actions that both score 0.6.

The first is a routine, low stakes action, the agent doing exactly what it was asked to do, with a consequence that is trivial and easily reversed if it turns out to be wrong. The only thing dragging the score down is something mildly unfamiliar about it.

The second is a high consequence action, only loosely connected to what the agent was actually asked to do, set in motion by something that should not have been trusted, and effectively irreversible once it executes.

Both score 0.6. The scalar has flattened a harmless action and a potential catastrophe into the same number, because it averaged away everything that made them different. A single value cannot say that one of these is safe in the ways that matter and dangerous in none, while the other is the opposite. It can only say 0.6, and 0.6 tells you nothing about which of these two actions is about to happen. The one piece of output the system produces is the one piece that cannot distinguish a routine task from a disaster.

And because the number cannot explain itself, it cannot be defended. "We blocked it because the score was 0.68" is not an answer that satisfies an engineer debugging a false positive, a customer asking why their agent stalled, or a regulator asking what control governed a decision. An unexplained number is not governance. It is a verdict with the reasoning deleted.

What We Replaced It With

The fix was to stop compressing. Instead of collapsing everything into one value, we evaluate each action across several distinct dimensions of risk and keep them separate. Different kinds of danger are genuinely different, and the whole failure of the scalar is that it treats them as interchangeable quantities of a single substance called risk. They are not. An action can be safe in one respect and alarming in another, and the only way to see that is to keep the respects apart.

The specifics of what we measure and how we combine it are our own, and deliberately so. What matters for anyone thinking about this problem is the shape of the answer, not our particular recipe: a structured, multi part judgment rather than a scalar, so the system can say precisely what kind of risk an action carries, not merely how much. That shift, from a quantity to a description, is the entire point. A quantity can be averaged, thresholded, and misread. A description can be reasoned about.

The output is not a number, it is a readable judgment. A person can look at it and understand not just that an action was risky but in what way, which is exactly the thing averaging destroys and exactly the thing you need when you are deciding whether to allow, block, or escalate.

Structure Lets You Write Real Policy

The scalar gave you exactly one lever: the threshold. Keeping the dimensions separate gives you policy that reads like how people actually think about risk, rules that respond to specific kinds of danger and specific combinations of them, rather than a single cutoff applied to a blended figure.

This matters because risk is not one dimensional in the real world, and the decisions that matter almost always turn on a combination. An action that is consequential but entirely expected and legitimate is not the same as one that is consequential and arrived through a channel you do not trust, even if a scalar would score them identically. The first is exactly what the agent was deployed to do. The second is the shape of a problem. A blended number cannot tell them apart, because blending is precisely the operation that erases the difference. A structured verdict can, because it never threw the difference away in the first place.

We are not going to enumerate our policy surface here, but the underlying move is simple: because the kinds of risk stay separate, policy can reason over them the way a good human reviewer reasons, not "how bad is this out of ten" but "what kind of action is this, and does that kind need a second look."

"Isn't That Just a Score With Extra Steps?"

The obvious objection, and one we put to ourselves, is that a structured verdict is still made of components, and surely you could average those components back into a scalar and be where you started.

Because the average is exactly the operation that loses the decision. The components do not mean "safe by some percentage." Taken together they describe a specific, recognisable situation, and the correct response follows from the situation, not from a number that lands just above or below an arbitrary line. The moment you average, you are back to a scalar and you have thrown away the pattern that told you what to do.

The dimensions are kept separate not because more numbers are inherently better than one, but because the decision lives in the relationships between them. Two situations can share one troubling ingredient and be completely different in every other respect, one benign and one an attack, and a policy that treats them differently can only exist if the ingredients are never merged. Keeping them apart is the whole point. Averaging is not a simplification of the verdict. It is the deletion of it.

The Verdict Is Signed

There is one more difference that matters as much as the structure. The verdict is not just a richer input to a decision that then disappears. It is signed and kept as the record of why the action was allowed, blocked, or escalated.

This closes a loop that the scalar left open. With a trust score, even if you logged the number, the number explained nothing, so the log was a column of meaningless decimals. With a verdict, the record contains the reasoning, the resulting decision, and a signature that makes it tamper evident. When someone asks months later why a particular action was permitted, the answer is not a number nobody can interpret. It is a structured judgment they can read, tied to the action, provable as unaltered. The thing that governs the action and the thing that explains it afterward are the same artifact.

What We Learned

The lesson generalises beyond our own system, and it is the reason this is worth writing down.

A governance decision has to be explainable to be trusted, and explanation requires structure. The instinct to compress risk into a single score is the instinct to make governance look simple, and it works right up until the moment someone needs to know why a decision was made, which is exactly the moment governance is for. At that moment the single number has nothing to say. It was optimised for the demo, not for the incident.

A structured verdict feels less elegant. There is no single dial, no clean red to green gradient, no one figure to put on a slide. What you get instead is a decision you can read, defend, and write real policy against, and a record that still means something when you come back to it after the fact. We will take the less elegant object that works over the beautiful one that does not, every time.

We deleted the trust score because a single number was the wrong shape for the job. Governing an agent action is not a question of how safe it feels on a scale of one to ten. It is a question of what kind of action it is, and the only honest way to answer that is to describe it rather than score it. The verdict is what that honesty looks like in production.

Xybern is the authorisation layer for enterprise AI agents. Every agent action is enforced, audited, and governed before it executes. Learn more at xybern.com or read the technical documentation at docs.xybern.com.