Five evaluation areas
Robustness covers adversarial inputs, distribution shift, output consistency, and poisoning. Fairness covers demographic parity, calibration consistency, representation bias, and counterfactual fairness. Transparency covers explainability, confidence calibration, audit trails, and lineage. Privacy covers leakage, inference attacks, minimization, and re-identification. Containment covers scope, escalation, output filtering, side channels, agent identity, action reversibility, and resource or execution-loop boundaries.
Methods must produce admissible evidence
Useful methods include adversarial test suites, counterfactual probes, calibration error measurement, lineage verification, membership and model-inversion testing, cross-tenant retrieval tests, identity-spoofing trials, chain-composition tests, resource-budget violation tests, and repeated boundary attestations. A claimed control earns no credit until the assessed deployment demonstrates its effectiveness.
Match depth to risk
Full, Standard, and Lite pathways change assessment depth, not the meaning of the rubrics. Deployment tiers set minimum thresholds and reassessment cadence. Agentic systems require additional accumulated-state, identity, action, containment, and behavioral evidence because a one-turn model test cannot establish multi-session safety.
A practical next step
Choose one system boundary, document the architecture and deployment tier, and test the evidence required by the applicable sub-metrics. Record unknown evidence explicitly instead of treating it as a passing control.