What an Independent AI Agent Assessment Should Disclose

An independent review is most useful when we can tell exactly what it examined. A statement that an agent was reviewed tells us little unless we also know the claim, conditions and evidence behind that review.

Imagine a catalog entry for an agent that prepares a report but is not allowed to send it. A reviewer examines its generated reports and finds them accurate. That review could support a claim about the sampled outputs. It would not establish that the deployed agent cannot send a report through another available tool.

What OpenAI proposes

In Priorities and principles for effective third party assessments, Lama Ahmad outlines OpenAI's proposed priorities and principles for independent technical safety assessments.

The principles call for agreed, preregistered claims; access proportionate to those claims; transparent methods and uncertainties; and disclosed conflicts of interest. They also address confidentiality and the effect of substantive redactions on reports. The article describes the proposed assessment work as generally longer-term and launch-agnostic, rather than simply a release checklist.

This is a policy proposal. We are not treating it as evidence that these arrangements have been shown to prevent unsafe behavior, or that any particular system has passed them.

What this adds to our existing question

Our earlier note, An Independent Reviewer Still Needs the Evidence, examines the tension between reviewer independence and access to underlying observations. The added question here is what a reader should be able to learn from the assessment's stated scope.

For WTK, we think that description should connect the reviewed claim to the particular agent or team package and execution environment. It should identify what the reviewer inspected, what was unavailable, and which conclusions those limits leave unresolved. This is our interpretation for catalog review, not an implementation described by OpenAI.

The hypothetical reporting agent makes the distinction concrete. A review of report accuracy and a review of whether sending is prevented answer different questions. Neither should silently stand in for the other. Likewise, a restriction on evidence access should remain visible in the conclusion rather than disappearing behind an overall approval label.

Independence and permission remain separate

A reviewer may be organizationally independent while still lacking relevant access. A reviewer with broad access may still have a conflict of interest. Those are separate considerations; neither can be reduced to whether a second person or model looked at the work.

WTK's note on authority for automated approvals addresses another boundary: assessing evidence does not automatically confer permission to authorize deployment. An assessment can inform that decision without owning it.

The question we would carry forward

Before proposing implementation, we would ask whether a reader can distinguish the claim assessed, the evidence inspected and the unassessed parts of the deployment from the review record alone.

We have not established that WTK consistently provides that information or that a particular record format improves decisions. We also do not yet know how much detail can be exposed without revealing protected information. These are design questions for future review, not a new qualification claim or an authorized experiment.

Source

Lama Ahmad, Priorities and principles for effective third party assessments, OpenAI, September 22, 2026. The catalog example and WTK interpretation are ours.