Skip to content
8BraidCreators of
8DB

Idea · Open proposal · Four metric families · Fixtures and scoring public before any score

The Benchmark Nobody Runs: Does Your Agent's Data Tell the Truth?

Models are scored for accuracy and stores for throughput. The layer that actually decides whether an agent's answer can be acted on, whether its data knows where each fact came from, how sure to be, and when to say it does not know, has no score at all. We are proposing an open, vendor-neutral benchmark for that layer, and we want the people who would score badly on it in the room.

Published
Reading time5 minutes
AI agent benchmarkRAG evaluation benchmarkEpistemic integrityKnowledge base evaluation for LLM agentsProvenance benchmarkConfidence calibration retrievalOpen AI benchmark proposalPost-quantum database

Every serious effort to make AI trustworthy has produced a benchmark. Models are scored on accuracy, robustness, safety and bias. Vector stores are scored on recall and queries per second. Retrieval pipelines are scored on whether the right passage came back. Between those two layers sits the question that decides whether an agent's answer can be acted on, and nobody scores it: does the store the agent reasons over know where its facts came from, how strongly each is supported, whether two sources disagree, and the difference between a fact that is absent and one that is unknown?

Call it epistemic integrity, and notice that it is a property of the data layer rather than of the model. A perfectly calibrated model reading from a store that flattens confidence and hides provenance will be confidently wrong at exactly the rate the store misleads it. The industry needs a benchmark for that layer, it has to be neutral to be worth anything, and we are proposing one. This article is the outline and the invitation.

What the benchmark would measure

Four families of metric, each scorable on any database, vector store or retrieval stack, with fixtures anyone can run.

  1. Provenance completeness. For a set of retrieved facts, what fraction can be traced to a source record, with the derivation steps between, and can that trace be verified by a party who does not operate the store? Scored from zero (a passage with no origin) to full (content-addressed source, derivation chain, independently checkable integrity proof).
  2. Confidence calibration. When the store attaches a confidence to a fact, does the confidence predict correctness on a held-out truth set? A store that reports no confidence scores as if every fact were certain, which is what it is telling the model.
  3. Typed-absence handling. Given queries whose true answer is missing, redacted, stale, or outside the querier's authorisation, does the store return the right kind of nothing, or does it return null and let the model guess? Scored on how many distinct absence states the store can express and how often it uses them correctly.
  4. Retrieval honesty. Under conflicting sources, does the store surface the conflict or silently resolve it? Under weak evidence, does it lower confidence or drop the record? Under an out-of-scope question, does it abstain? Scored against fixtures where the honest behaviour is known.

None of these measures speed. Throughput benchmarks exist and are good at what they do. This one measures whether the answer deserves to be believed.

Why it has to be neutral

A benchmark a vendor cannot lose is marketing. The value of this one depends on three design rules we are committing to before any score exists. The metrics must be definable in terms any store can implement, so a relational database, a vector index and a graph store can each be scored, and each can improve. The fixtures and scoring code must be public, so a result can be reproduced by the party who most wants it to be wrong. And the first published scores must include systems that are not ours, chosen because they are what the industry actually runs.

We are aware of the obvious objection: 8DB carries confidence, provenance and typed absence as storage columns, so we would expect to score well on a benchmark that measures them. That is why the design has to be public before the scores, and why we want competitors and sceptics designing the fixtures. If the metrics are right, a store that scores well on them is a store an agent should be built on, whoever makes it. We expect to be scored first, and to learn things we would rather not.1 That is the point.

Where it would live

The right home for a benchmark like this is a community body, not a company. We are preparing a proposal to the working groups that already maintain AI benchmarks.2 The metric definitions, fixture designs and scoring methodology will be published under an open licence as they stabilise, and this page will link to them.

What to bring us

  • Your evaluation team. If you evaluate retrieval or agent systems and have wanted a data-layer metric, help define these four before they are fixed.
  • Your store. If you build a database, vector store or retrieval stack and want to be scored on a level field, tell us what fixtures would be fair to you.
  • Your failure cases. The confidently wrong answers your agents have produced are the fixtures this benchmark needs.

Write to hello@8braid.com with the subject "Epistemic-integrity benchmark: participate". You will hear back from an engineer.

Sources and further reading

Footnotes

  1. The confidence, provenance and typed-absence mechanisms in 8DB are exercised in our independent evaluation package as supporting demonstrations, not formal acceptance claims, and their calibration against held-out truth has not been measured in a form we would publish. A benchmark like this would measure it.

  2. We are surveying the existing suites to state precisely where the gap is rather than assert it. If the gap turns out to be smaller than we think, the proposal shrinks to fit.

Continue the technical conversation

Where could this help your work?

Bring a research question, a database workload or an application you want to build. Let’s connect the ideas in this article to an evaluation that matters to your team.

Discuss this work

Continue reading

The next layer of the argument.

Engineering note

Trustworthy AI Data

An Agent Can Only Leak What Its Process Can Decrypt

Every defence against prompt injection you have read about lives in the prompt, the orchestrator or a filter in front of the data. All of them are software an attacker can talk past. There is one boundary a clever prompt cannot argue with: the agent's process never had the key. 8DB puts clearance and policy inside key derivation, so a request outside policy comes back as ciphertext no matter how persuasive it was. Here is how to build agents on that boundary.

6 min readTested claim · Holds with the network disabled · Evaluator bundle availableRead article
Engineering note

Trustworthy AI Data

Agent Memory You Can Actually Deploy: Remembers With Provenance, Forgets on Command, Proves Every Deletion

Long-running agents are being given memory: a store of what they saw, decided and learned, carried across sessions and users. That store is now the most sensitive database in the building, and it is being built on vector indexes with no notion of who may recall a memory, where it came from, or how to make it gone. 8DB makes recall a cryptographic fact rather than a filter, gives every memory its pedigree, and turns forgetting into something a third party can check.

5 min readEngine mechanisms · Recall boundary tested with the network disabled · Erasure certificates for isolated recordsRead article
Engineering note

Trustworthy AI Data

Show Your Work: Provenance as a Query, Not a Forensic Reconstruction

When an AI system makes a consequential call, someone will ask why. Today the answer is assembled after the fact from logs, traces and the memory of whoever was on shift. In 8DB the answer is a query: the source records, their confidence, the governance state at the time, and a proof a third party can check without trusting anyone who ran the system. A two-week reconstruction becomes a session.

5 min readTested integrity claim · Engine mechanisms · Public-corpus runRead article