If you can inspect only a fraction of your AI agents' work, do not hand the human audit budget to their confidence scores.
A low-confidence queue feels objective, but it can spend human attention on agents that already know when they are struggling while missing confident errors, under-reviewed task families, shared failure modes, and risky work after a system change.
My recommendation is to treat the queue as a risk portfolio: use observed calibration to decide how much influence confidence has, rank known risks across several factors, and reserve some audits for exploration.
Confidence and reliability are different things
An agent reports confidence. An operator observes calibration.
I use calibration to mean the relationship between reported confidence and actual outcomes over time. It has to be measured for the agent and the kind of work being done. An agent can be well calibrated on code explanation and poorly calibrated on dependency changes. A fleet-wide average can hide both.
This is why a confidence score should not automatically control the queue. A reported value is not a guarantee. Until outcomes show what that value means for this agent and task family, it is an unverified input.
Consequence is separate again. A high-confidence output that can trigger an irreversible external action may deserve review even when the confidence is historically well calibrated. Calibration tells you how much to trust the signal. Consequence tells you what an error could do.
Once those concepts are collapsed into one confidence column, the queue becomes easy to sort and hard to defend.
A preprint makes the allocation problem explicit
A July 2026 preprint by Cesare Zavattari, Alessandro Tommasi, and Giuseppe Prencipe models one human allocating at most a limited number of audits per round across a larger set of persistent LLM agents. The agents are treated as honest but potentially miscalibrated, and their errors may be correlated.[^1]
The paper's objective is residual risk: expected errors that remain undetected after the available audits.[^1] This moves the question away from “Which output looks least certain?” and toward “Which allocation policy leaves the least risk behind under these assumptions?”
In the authors' synthetic phase diagram, confidence-ranked auditing becomes worse than random sampling past a modeled miscalibration threshold. The threshold changes with the fraction of outputs the human can audit.[^1] This is a result inside their synthetic model, not a general production benchmark or proof that random auditing is always better.
The synthetic result did not carry unchanged into a separate preliminary replay over benchmark traces and a constructed 15-agent fleet. There, confidence-ranked auditing was approximately equal to random rather than worse. A correlation-aware heuristic had lower residual risk in that replay, but the authors do not claim it is optimal.[^1] The useful finding is bounded: confidence ordering can lose its advantage when the signal is sufficiently miscalibrated, so operators should not grant it authority by default.
The paper also makes correlation visible. In its synthetic model, stronger correlation clustered more errors beyond a fixed audit budget. Under persistent error profiles, an audit on one agent could provide information about related agents. Its benchmark traces showed substantial cross-model co-failure associated more with shared item difficulty than model lineage.[^1]
That does not prove how failures propagate through a production fleet. The authors explicitly note limits around verifier noise, persistent errors, aligned inputs, confidence elicitation, and the size of the trace replay. They also caution that correlation measured on aligned inputs may overstate what applies when a fleet handles different inputs.[^1]
My operator read is narrower: when one audit finds a failure, look for the boundary of the failure before treating it as an isolated event. Shared prompts, retrieval indexes, tool adapters, context, data, policies, and dependencies are useful cluster hypotheses. They are not precise failure probabilities, but they can tell you where the next audit may be more informative.
Treat the audit queue as a portfolio
The paper does not validate the framework below. The Audit Allocation Scorecard is my operator synthesis: an illustrative starting policy for teams to test and tune from their own outcomes.
The score ranks known risk across five factors. A separate random reserve protects exploration.
Score each ranked factor on a local 0–4 scale:
- 0 — no current signal
- 1 — low
- 2 — material
- 3 — high
- 4 — critical or severely under-covered
Those labels are only an interface. Each team still has to write concrete anchors for its work. “Critical consequence” in a read-only research workflow is different from “critical consequence” in a workflow that can move money, expose private data, alter production, or contact a customer.
1. Consequence — 25%
Ask: If this output is wrong, what can it cost, expose, block, or irreversibly change?
Consequence keeps a calibrated, high-confidence output in the review pool when the downside justifies inspection. It also prevents the queue from filling with harmless uncertainty while high-impact actions pass untouched.
2. Observed calibration gap — 20%
Ask: For this agent and task family, how far is reported confidence from observed accuracy?
Confidence enters the framework here, but only through observed behavior. A sparse agent/task-family cell should remain uncertain. It should not inherit trust from an unrelated fleet-wide average merely because the dashboard needs a number.
3. Correlated-failure risk — 20%
Ask: Could this failure repeat across agents, prompts, tools, shared context, data, or a common dependency?
Treat this as a review-allocation hypothesis. If several agents depend on the same retrieval index and one audit reveals stale retrieval, inspect that shared boundary. Do not translate the hypothesis into a fake probability.
4. Task-family coverage gap — 20%
Ask: Which task families have received too little recent human inspection relative to their volume and risk?
A high-volume task family with little recent review should gain priority even if nothing in its confidence stream looks alarming. Coverage is how the audit policy notices what it has been systematically ignoring.
5. Recent-change risk — 15%
Ask: Did a model, prompt, tool, policy, dependency, or workflow change faster than evidence has accumulated?
Recent change temporarily weakens the relevance of old calibration. Give changed surfaces more review weight until enough post-change outcomes exist to support a new judgment.
The illustrative ranking formula is:
auditPriority =
0.25 × consequence
+ 0.20 × calibrationGap
+ 0.20 × correlatedFailureRisk
+ 0.20 × taskFamilyCoverageGap
+ 0.15 × recentChangeRisk
These weights are judgment calls chosen to expose tradeoffs. They are not learned coefficients, research-validated values, or a mathematical optimum. Start with explicit assumptions, then revise them from observed outcomes.
Keep exploration outside the score
Do not add randomness as a sixth weighted factor.
Sample a protected random reserve from eligible work before ranking the rest of the audit capacity. Then use the scorecard to allocate the non-random portion.
A scoring policy can select only the risks it knows how to represent. If every audit is chosen by the same score, the review process may become very efficient at confirming its existing model of failure.
The random reserve gives the policy two things: a chance to discover failure modes the score cannot yet see, and a baseline against which risk-ranked and confidence-ranked slices can be compared. Random sampling is a comparator in the preprint; the protected-reserve design is my recommendation, not the paper's.[^1]
There is no universal reserve percentage. The appropriate slice depends on audit capacity, the cost of exploration, the rate of change, and how quickly the scored policy is learning. Protect the function, then tune the size.
How to allocate human audits across AI agents
The queue should learn from the audits it buys.
- Preserve context. Record the outcome, consequence, agent, task family, relevant change, and suspected shared dependencies.
- Stratify eligible work. Make volume, consequence, coverage, and possible failure clusters visible before selecting individual outputs.
- Sample the random reserve. Draw it independently so the ranked policy cannot consume it.
- Rank the remaining capacity. Apply the locally anchored scorecard to the rest of the eligible work.
- Audit both slices consistently. Use the same outcome and consequence labels so the results can be compared.
- Revise the policy. Update calibration by agent and task family, inspect which failure modes each slice found, and tune the factors without erasing exploration.
Do not judge the policy only by raw errors found. A useful readback keeps several dimensions separate:
- errors discovered;
- severity or consequence covered;
- task-family coverage;
- new failure modes found by the random reserve;
- calibration learned for each agent and task family.
A policy that finds many trivial errors may have higher apparent yield and worse risk coverage. A random slice that finds fewer errors may still expose a blind spot that changes the entire scoring model. The allocation decision needs both views.
For example, imagine the random slice finds stale retrieval in a task family the score had treated as low risk. The next round should raise that family's coverage priority, test the shared retrieval boundary, and treat its old calibration as weaker evidence until post-fix outcomes accumulate. That is an illustrative policy update, not a production result.
Make confidence earn influence
Confidence is useful when it is treated as a claim about reliability that outcomes can test.
Audit capacity is too scarce to allocate with one signal, especially when that signal can be miscalibrated and failures can cluster. Rank the known risks across consequence, calibration, correlation, coverage, and recent change. Keep exploration protected. Feed every audit back into the next allocation decision.
The operating rule is simple: confidence earns influence through observed calibration for the specific agent and task family. It does not get to allocate the budget on its own.
Source
[^1]: Cesare Zavattari, Alessandro Tommasi, and Giuseppe Prencipe, “One Human, N Agents: Audit-Budget Allocation for LLM Agent Fleets under Miscalibrated, Correlated Confidence”, arXiv:2607.28317v1, July 2026 preprint.