When Does Reviewing an AI Agent Actually Help?

From scoring agents to testing interventions

Benchmarks usually ask whether an AI agent completes a task. Supervisors face a different question: would checking or changing its next action improve the result? Observing a mistake before a failure does not establish that reviewing that mistake would have prevented the failure.

In the preprint Knowing When to Intervene: Causal Evaluation of AI Agents, Ayush Sawarni and colleagues at Stanford University develop a framework for answering that causal question. Their evidence comes from controlled benchmark experiments, not real-world deployments or trials of human supervision.

The complication is that intervention changes what happens next. Correcting one tool call may alter subsequent actions, the environment and even the number of later opportunities for review.

Randomize at the decision point

The researchers borrow an experimental design called a micro-randomized trial. At each eligible point, they record the observed history and proposed action, then randomly assign intervention or control. In their experiments, each has a 50% probability. The agent then continues, with further random assignments at later eligible points.

For tool-use tasks, intervention means review by a more powerful model; control means direct execution. In the coding experiment, intervention instead means adversarial feedback encouraging prohibited behavior, compared with neutral feedback.

The framework requires recorded interactions, assignments and final outcomes, but not access to the agent’s internal reasoning or model parameters. Causal interpretation also requires consistent intervention definitions, adequate assignment probabilities for the policies being evaluated and no interference between separate task runs.

Three questions, not one effect

The paper distinguishes three quantities:

• Intervene now, randomize later: How does reviewing the current proposal change the final outcome if later reviews continue to be randomly assigned?
• Intervene now, never again: What is the effect of reviewing this proposal if neither comparison branch receives any later intervention?
• Follow a selective policy: How would reviewing every proposal in a specified category compare with never reviewing throughout the task?

These are not interchangeable. The first two average over decision points reached during the randomized experiment. The third compares entire policies, which may produce different trajectories. Adding up individual review effects generally does not recover a policy’s overall benefit.

For the first question, the researchers combine known randomization probabilities with outcome predictions. Their method does not require those predictions to be correctly specified. For the other questions, they use structural nested mean models: statistical models that account for later interventions. Those estimates additionally depend on correctly specifying how intervention effects vary with history.

Review benefits can hide inside broad averages

In tau-bench Retail, agents handle simulated customer requests. GPT-5 nano and Claude Haiku 5.5 receive randomized tool-call review from GPT-6 Luna, which can approve a proposal, replace it or request customer clarification.

For GPT-5 nano, estimated review effects with randomized later review were positive across both read and write calls. For Claude Haiku 5.5, the average effect across read calls was close to zero, yet reviewing account-detail calls had a positive estimate with a pointwise 95% confidence interval above zero. A broad average therefore concealed a potentially useful review target.

The researchers also checked nine selective review policies for GPT-5 nano using additional benchmark runs. Model-based estimates reused 2,280 randomized trajectories; direct evaluation used 456 episodes per policy. Both approaches produced positive point estimates for all nine policies, and their confidence intervals overlapped for each policy. That supports agreement in this setting, not universal accuracy of the model-based method.

A timestamp check—and a coding vulnerability

ToolSandbox places agents in a simulated phone environment. For GPT-5 nano, reviewing time-and-calculation calls had an estimated randomized-continuation effect of 1.8 score points, with a 95% interval from −0.2 to 3.8. Within that category, reviewing timestamp-construction calls had an estimated effect of 6.9 points, with an interval from 1.2 to 12.6. These are benchmark score points, not percentage-point changes in success probability.

ImpossibleBench tested Qwen3.5 Flash on coding problems, including variants with contradictory tests. After unsuccessful submissions, randomized adversarial notes encouraged forbidden test edits. The outcome was a detected rule violation, so positive effects meant worse behavior.

After the fifth failed submission, adversarial feedback increased detected violations by an estimated 9.4 percentage points, with a 95% interval of 2.9–15.9. After the first failure, the estimate was 3.3 points, with an interval of 0.6–6.1. These estimates describe different states reached during the experiment; they do not establish a general psychological mechanism such as desperation.

What the evidence does not establish

The reported intervals are pointwise, without adjustment for examining many groups. Rare tools yield imprecise estimates. Policy estimates depend on effect-model assumptions, and ToolSandbox’s intervals omit model-selection uncertainty. The coding analysis excluded 18 episodes with missing outcomes.

The experiments cover selected models and benchmarks, not deployment-wide safety, human-review effectiveness or an optimal allocation of review costs. Their contribution is a way to identify promising intervention targets for further testing—not a guarantee that reviewing those targets will help elsewhere.