Agent trajectory: Definition and Examples

An agent trajectory is the complete record of one agent run: the goal, every intermediate reasoning artefact the system exposes, each tool call with its arguments, each tool result, and the final response. Trajectory evaluation scores this whole sequence rather than only the final answer.

Definition

Borrowing reinforcement learning notation, a trajectory of length $T$ is

τ = (s_{0}, a_{0}, o_{1}, a_{1}, o_{2}, \dots, a_{T - 1}, o_{T}),

where $s_{0}$ is the initial context (system prompt, user goal), each $a_{t}$ is an action such as a tool call or message, and each $o_{t + 1}$ is the observation that comes back. In RL training of agents, a return is computed over $τ$ , and the same object is what evaluators read.

Why the final answer is not enough

Two runs can end with the same correct message and differ completely in safety. In one, the agent queried the right record. In the other, it queried every customer's record, emailed a draft to the wrong address, then corrected itself. An outcome-only grader scores both as successes. Trajectory evaluation can catch:

unsafe or unauthorised tool calls, even if later undone;
following instructions planted in tool outputs (indirect prompt injection);
wasted steps and cost;
right answers reached by wrong reasoning or luck.

Worked example

Illustrative numbers: a team evaluates 300 runs of a travel-booking agent. Final-answer grading reports 82% success. A trajectory grader with three checks (correct booking, no booking outside the user's stated budget, no personal data sent to tools that do not need it) reports 82%, 94% and 89% pass rates respectively, and only 71% of runs pass all three. The gap between 82% and 71% is risk the outcome metric could not see.

Practical notes

Log trajectories in a structured format with stable identifiers for tools and arguments. Use deterministic checks where possible (was a forbidden tool called?) and calibrated model-based judges for the rest. Because runs are stochastic, evaluate several trajectories per task and report per-task variance.

Why it matters

For agents, the path is part of the product: actions have side effects that the final message does not reveal. Trajectory-level evaluation is the agent equivalent of process supervision, and it is how teams find failures before they become incidents.

Sources

Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, Florian Tramèr. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents, 2024. arxiv.org