Questions

Does AAA mean the agent is good at its job?

No. A rating says how well it is proven that the agent is under control: who answers for it, what it may do, what it can reach, that it is the version that was approved, and that it can be stopped. Whether its answers are any good is one input among many, through the check that grades its work over time against a standard set beforehand. A brilliant agent nobody has checked is NR. A modest one that is checked thoroughly can be AAA.

Is this a credit rating?

No. It borrows the scale because people already read it: AAA is strongest, BBB is the lowest investment grade, and D means something has failed. A credit rating is an opinion about whether a borrower will pay. An Agent Rating is the result of a published method applied to signed evidence.

Who issues ratings?

Nobody, in the sense of an agency. The method is published, and the attestations a rating rests on are signed and readable. A catalog, a network, a buyer or the agent's own operator can work out the grade, and if they use the same attestations and the same method version, they get the same grade.

Can an operator pay for a better rating?

Not for the rating itself, because nobody sells one. What an operator can do is earn a higher grade: ask independent parties to check more areas, keep evidence of the agent's conduct over a longer period, and fix what failed. Paying an attester for a check is normal, as it is for an audit. That is why every attestation names who signed it and who produced the evidence, and why the method gives an operator's own word less weight than anyone else's.

What happens when the agent changes?

A rating covers one version. When a new version runs, the old grade goes on watch for up to 14 days while the new version is attested. After that, the new version is NR until an attestation covers it. An agent that ships every week keeps its grade by being attested every week, which is exactly the kind of agent you want a current grade on.

What if an attester got it wrong?

It withdraws the attestation, and every rating that rested on it is worked out again without it. If the attester finds a failure, it says so in a new attestation, and one failure in a core area makes the grade D, whoever else passed it.

How is this different from reviews?

Reviews, such as those in Agent Reputations, record what people thought of working with an agent. A rating records what was checked and proven about it. Both are useful, and neither stands in for the other.

How does a company use it?

• At the door. Set a minimum, such as BBB, for agents from other organizations. The network checks the grade before it delivers a message.
• In procurement. Ask that any agent a supplier provides, or that touches your systems, be rated BBB or better and stay there.
• In a catalog. Show the grade beside every agent, and let buyers filter by it.
• With its own providers. Ask the scanner, monitoring platform and identity provider it already uses to attest the checks they hold evidence for. That is how its own agents move up the scale.

Why these five core areas?

Identity, Authority, Reach, Provenance and Stopping are what an organization needs to know before it lets an agent in at all: who it is and who answers for it, what it may do, what it can touch, whether it is what was approved, and whether someone can halt it. The other six areas matter just as much once the agent is working, and they separate A from BBB.

Where are the checks themselves?

In the published list at commonagent.net, sixty checks in eleven areas, each with when it passes and where its evidence comes from. They are set out, area by area, in the agent attestation standard.