Define the task before choosing the metric
Write down what the AI feature is supposed to help a person do. Is it answering policy questions, extracting fields from documents, drafting a response, classifying an enquiry or operating a business workflow? Each task has a different definition of success. A generic “answer quality” score is not enough to decide whether a system is safe and useful for its intended context.
Map user intent to the expected behaviour. Include cases where the system should answer, ask a clarifying question, refuse, show evidence or hand off to a person. Record unacceptable outcomes such as invented facts, disclosure of another user's data, unauthorised tool use or a confident answer when the source is missing.
Build a representative evaluation dataset
Start with real, permissioned examples and carefully written scenarios. Include common questions, rare but important edge cases, misspellings, short prompts, long inputs, conflicting documents and out-of-scope requests. For a retrieval system, include queries whose answer exists in the corpus, queries with partial evidence and queries for which no answer is available.
For each item, record the expected action or key facts, relevant source material and the reason the case matters. Ask a domain expert to review reference answers where business accuracy is important. Keep a held-out set so that prompt adjustments are not tuned only to the examples used during development. Remove or anonymise sensitive information before using examples in evaluation systems.
Measure several dimensions of quality
Task success asks whether the user can complete the intended job. Factuality checks whether claims are supported. Groundedness asks whether the response follows the approved sources. Retrieval quality examines whether the right documents were found. For classification, use appropriate measures such as precision, recall and confusion matrices rather than a single percentage.
Evaluate the response format too. An extraction task may require valid JSON, a workflow assistant may need the correct tool and arguments, and a public chatbot may need an understandable fallback. Score clarity, completeness and tone only where they affect the intended user experience. Keep each evaluation criterion specific enough that two reviewers can apply it consistently.
Test safety, privacy and permission boundaries
Include prompt injection attempts, misleading instructions embedded in documents, requests for secrets and attempts to access another user's records. Test whether the system can distinguish user-provided text from trusted policy or operational instructions. Check that retrieval filters are enforced before content reaches the model, and that tools independently verify permissions.
Do not rely on the model to authorise transactions or determine whether a user may read a record. The application should perform access checks at trusted boundaries. For high-impact actions, use confirmation steps, clear summaries and human approval. Record what the system proposed, what the user approved and what action was executed, while minimising sensitive logging.
Track latency and cost as product metrics
Measure end-to-end response time, not only model generation time. Retrieval, reranking, document parsing, tool execution, network calls and user-interface rendering can all affect perceived speed. Track median and tail latency, timeout rates and the proportion of requests that require retries or human handoff. A good average can hide slow experiences for a meaningful set of users.
Estimate cost per successful task rather than only cost per model call. Include token usage, embedding or retrieval services, hosted infrastructure, retries, failed attempts and human review where applicable. Compare different models and prompts using the same dataset and quality gates. A cheaper configuration is not better when it creates additional support work or increases the risk of a wrong answer.
Use human review as part of the system
Human evaluation is essential when the answer depends on specialist judgement or when automated graders are not reliable enough. Provide reviewers with a rubric, source context and clear criteria. Sample live interactions to discover failure modes that the offline dataset missed. Make it easy for users and employees to flag incorrect answers, and route those reports to an owner.
Automated graders can help scale repeated checks, but they should be calibrated against human judgement. A model grader can share the same blind spots as the model being evaluated. Use deterministic checks for format and policy constraints, expert review for domain facts and carefully calibrated model-based scoring for qualities that are difficult to express as exact rules.
Make evaluation part of every meaningful release
Version the model, prompt, retrieval configuration, corpus and application code. Run regression tests when any of those change. Compare results against release thresholds, investigate regressions and document accepted trade-offs. Monitor real requests for changes in topic, data quality, latency and failure rates. Retire old evaluation cases only when the reason is understood.
A product team should publish an internal evaluation report that explains the tested scope, dataset composition, limitations and results. Avoid broad claims such as “the AI is 99% accurate” without defining the task, population and measurement. Clear evidence helps product owners decide where automation is appropriate and where human review remains necessary.
GrapeCrux can help plan AI workflows, design evaluation datasets, test retrieval and tool behaviour, and define release checks for quality, privacy and cost. The right approach begins with a measurable user task rather than a model demonstration.
Further reading
- OpenAI — Evaluate agent workflows for trace-based assessment of tools, handoffs and guardrails.
- OpenAI — Graders for examples of automated output assessment; check the linked documentation for current platform availability.
- NIST — AI Risk Management Framework for a broader risk-management reference.
Published by GrapeCrux Editorial Team · 31 October 2026. This article is educational and should be adapted to the specific context, risk and requirements of each project.
← Back to selected articles