A trust score is only worth something if it is expensive to fake. Assay's is computed from outcomes other parties confirmed, shrunk toward neutral when evidence is thin, and actively discounted when the pattern looks manufactured.
Source: 2025 industry surveys of enterprise AI agent adoption.
Star ratings measure opinion. Uptime measures the host. Benchmark scores measure a test set. None of them measures whether this agent completed real work that a real counterparty confirmed — which is the only thing a dispatch decision actually needs.
Worse, most naive scoring is trivially gameable. If an agent can write its own record, or if a handful of successes drives the score to the ceiling, then the number tells you about someone's willingness to post rather than their ability to deliver.
A score you cannot defend to an auditor is a score you should not automate against.
Each attestation is an outcome — success, partial or failure — with an optional counterparty and evidence hash. Scores are weighted by recency on a 30-day half-life and shrunk toward a neutral 0.5 prior, so a two-job record stays near neutral and only sustained evidence moves the number.
Two guards sit on the overall score. A verification ceiling caps any agent whose work was not independently witnessed. A velocity discount penalises attestation cadence too fast to be real work. Both are transparent, and both fire on ordinary traffic rather than only on constructed attacks.
Per-capability scores are reported separately from the guarded overall score, so you can see raw skill signal and the gating number side by side.
Work nobody else confirmed is capped by the verification ceiling. The cheapest way to a high score is to do real work with real counterparties.
Shrinkage toward 0.5 with k=8 means two flawless counterparty-verified jobs score about 0.64, not 0.99 — and it takes roughly eight to reach 0.80. The number reports confidence as well as outcome.
If the median gap between attestations is implausibly short, the overall score takes a 0.8 multiplier. Bulk-imported history is flagged and excluded from cadence, but still bound by the ceiling.
Six presets ship today. Manufacturing sets the failure penalty 25% higher than default — a difference that shows up in the score the moment a job fails, not just in a label on the response.
No key required. Every preset and every tunable parameter is inspectable before you commit to anything.
verified reflects the trust
threshold and account status. It does not fall to false because a claimed capability
is unproven — an unproven capability simply does not appear in
capabilities_confirmed. Gate on both fields.Attested outcomes only. Success raises, failure lowers by a preset-controlled penalty, partial sits between. Naming a counterparty adds a bonus and lifts the verification ceiling. Nothing else — no self-description, no profile completeness, no payment.
Most often the velocity guard. Several attestations landing within minutes of each other read as a burst and take the 0.8 multiplier. Work recorded at the pace real work happens does not trip it.
Yes. min_trust_threshold is per verify call, so different task classes can demand different bars. Separately, an org can adopt an industry preset or override individual parameters within published safe ranges.
The trust breakdown exposes per-capability scores, counts, counterparty verification count, first-fix rate and trend. Full attestation detail stays with the agent's owner — a verifier gets the decision inputs, not the counterparty's book of work.