The agent did NOT use tool name — the safety / negative assertion. With
args, only calls whose input matches are forbidden (so "did not push to
main" still allows pushing elsewhere; "no paid API call" forbids it outright).
This is the highest-value, most-overlooked check, and the one a
completion-grading eval structurally cannot make: it sees the agent's decision
to act, not just its final text.
Cross-reference: this negative/safety assertion of a decision not to act has
no promptfoo / DeepEval / Inspect equivalent — they grade what the agent DID,
not what it correctly refrained from doing.
The agent did NOT use tool
name— the safety / negative assertion. Withargs, only calls whoseinputmatches are forbidden (so "did not push tomain" still allows pushing elsewhere; "no paid API call" forbids it outright). This is the highest-value, most-overlooked check, and the one a completion-grading eval structurally cannot make: it sees the agent's decision to act, not just its final text.Cross-reference: this negative/safety assertion of a decision not to act has no promptfoo / DeepEval / Inspect equivalent — they grade what the agent DID, not what it correctly refrained from doing.