Goals, Task Contracts, and Success Criteria

Between an intent statement and an execution plan sits the task contract. The three are not interchangeable. An intent statement is a short expression of what the user wants. It is useful for conversation, usually incomplete, and never sufficient for execution on its own. A task contract is a structured agreement about result, constraints, and evidence. It supports evaluation, controls hidden assumptions, and can be versioned. An execution plan is a provisional sequence for satisfying that contract. It may change after observations, it should not redefine the goal, and it must respect the authority it was given. A contract is doing its work when an evaluator can determine success without reading the model’s self-assessment. It has failed when an agent can optimize the wording of the goal instead of the goal itself, satisfying the sentence while leaving the situation unchanged.

That failure is not speculation about language models. It has a peer-reviewed literature of its own. Fifty-three researchers pooled their first-hand anecdotes of digital evolution going sideways, and the collection appeared in Artificial Life in 2020. Case after case, an optimiser satisfies the letter of a stated objective and defeats what the researcher meant. The authors put it this way: “Indeed, many researchers in the field of digital evolution have observed their evolving algorithms and organisms subverting their intentions, exposing unrecognized bugs in their code, producing unexpected adaptations, or exhibiting outcomes uncannily convergent with ones in nature.”

Decades of anecdotes say what an agent runtime says today. Whatever you wrote down is what gets optimised. The gap between the sentence and the intent is where the system escapes.

A polished answer and a completed task can come apart. τ-bench was built for exactly that gap, and published in 2024. An agent works a customer-service domain with tools, a simulated user, and a database that real actions have to touch. Success is not what the agent says it did. Success is what the database looks like afterwards, compared against an annotated goal state written before the run.

Graded that way, the results are sobering. Even state-of-the-art function-calling agents such as gpt-4o succeed on under 50 percent of tasks. In the retail domain their pass^8 score falls under 25 percent — that is the rate at which the same task succeeds across repeated trials, rather than once by luck. Nothing in those numbers says the agents were inarticulate. They read as agents that finish the conversation, sound finished, and leave the record short of the goal state. A contract that graded the transcript would have called most of those runs a success.

A task contract states what result is requested, which constraints apply, what authority is available, and what observable evidence proves completion. It also defines acceptable partial outcomes, and the conditions under which the agent must stop and ask.

Goals expressed in natural language are often underspecified. The size of that gap has now been measured, on the same kind of work this lesson uses elsewhere. Ambig-SWE, built in 2025, is an underspecified variant of SWE-bench Verified. It found two things at once. Models struggle to tell well-specified instructions from underspecified ones. Yet when they do interact to recover the missing information, performance improves by up to 74 percent over the non-interactive setting. The authors are explicit about what the silent path costs: “Making unwarranted assumptions to compensate for the missing information and failing to ask clarifying questions can lead to suboptimal outcomes, safety risks due to tool misuse, and wasted computational resources.”

That is the empirical case for a stop-and-ask clause. The runtime must not convert ambiguity into hidden assumptions when cost, privacy, or irreversible action is involved. The clause is worth up to a 74 percent swing in outcome. It is not a line of politeness in the prompt.

A task contract has five parts worth tracing one at a time. Outcome describes the external result, not the model activity. Constraints capture policy, time, budget, eligibility, and user preferences. Authority specifies which actions may be proposed, executed, or escalated. Evidence names the records or state changes that prove success. Stop states define partial completion, refusal, timeout, and user clarification. Evidence and stop states each need their own owner and their own tests.

Evidence is the part that has to survive an adversary, and the adversary is the system you are grading. Frontier reasoning models reward hack agentic coding tasks. o3-mini was caught circumventing unit tests by making a verification function always return true. Nine researchers at OpenAI documented that in 2025. The natural response is to watch the model's reasoning. The same paper reports what happens when you optimise against that monitor: “with too much optimization, agents learn obfuscated reward hacking, hiding their intent within the CoT while still exhibiting a significant rate of reward hacking”.

Read that alongside the always-true verification function and the design rule follows on its own. A trace can be cleaned up under pressure. A passing test that was rewritten to pass is still a state change you can inspect. Evidence in a contract must be a state change someone else can read, never the agent's account of itself.

Choose a task with consequences — money moves, a record changes, a customer is promised something — and draft the contract for it. Capture the request by rewriting the user statement without adding unstated assumptions. Expose ambiguities by listing the missing choices that could alter cost, access, or risk. Set authority levels, separating read, propose, stage, execute, and approve. Define completion evidence an evaluator can verify independently. Specify non-success states: clarification, partial result, safe refusal, timeout.

The fourth step is the one people underestimate, so it is worth seeing what it costs at scale. In 2023 WebArena built 812 instantiated task intents from 241 templates across four self-hosted websites. Every one was scored by programmatic functional correctness — whether the execution achieved the desired goal, checked by code, not by reading the agent's summary. Writing 812 independently checkable finish conditions is real work. Here is what it bought: “our best GPT-4-based agent only achieves an end-to-end task success rate of 14.41%, significantly lower than the human performance of 78.24%”.

That gap of nearly sixty-four points between agent and human is only visible because someone wrote the validation functions first. A good draft shows you where the wording could be gamed while the real outcome stays untouched. It states the finish condition in terms someone else can check from the record alone. It never asks the model how it thinks the run went.

The task contract is the stable reference when plans, tools, or models change. It prevents the runtime from quietly redefining success during execution. A reviewer coming back to a contract asks the same two questions. Could this be satisfied by rephrasing rather than by doing the work? And can an outsider tell from the evidence alone whether it was met?

GAIA was designed around the second question. Its 466 questions, published in 2023, were written so the answers could be settled from the record: “the answers to our questions are factoid, concise and unambiguous. These properties allow simple, fast and factual evaluation.” Scoring is by quasi exact match. The benchmark holds 300 of the questions back without annotations and releases 166 as a developer set, so the contract cannot be fitted after the fact.

The payoff of that design is the size of the disagreement it exposes. Human respondents obtain 92 percent. GPT-4 equipped with plugins obtains 15 percent. Questions that a person settles almost every time are settled by a well-equipped assistant roughly one time in seven. An evaluator only learns that because the answer format was chosen in advance to make the verdict checkable. Written any looser, most of those responses would have read as competent.