Forrester named the cost and stopped there. The "trust tax", the drag that ungoverned, unexplainable AI puts on adoption, is now a fixture of analyst vocabulary and boardroom conversation. It is also still a metaphor. Everyone agrees the tax is real and is slowing deployment, but no one can tell you what a given agent's trust tax actually is, as a number two people would calculate the same way.
That gap is not cosmetic. A tax that has a name but no price gets paid in the dark:
- budgets approved on faith,
- deployments blocked on instinct, and
- agents waved through procurement on the strength of a demo.
This analysis argues that the next step is the obvious one: give the trust tax a number. It lays out what that number measures, what standard it enforces, where it acts as a gate, and why it reads directly off the harness.
1. The moment before the score
Counterparty risk used to be a matter of judgment. A lender knew a borrower, or knew someone who did, and made a call. That call:
- made no sense to anyone outside the relationship,
- could not be carried from one institution to the next, and
- could not be compared across two applicants without redoing the judgment from scratch.
Credit was extended on confidence and withdrawn on rumor, and the whole system priced risk badly because it had no common unit to price it in.
The credit score changed what counterparty risk was. It took a fuzzy judgment tied to a relationship and made it a number that:
- meant the same thing to every lender,
- went with the borrower from institution to institution, and
- could be compared, given a cutoff and traded.
A lender could decline below a cutoff, charge a spread above it and sell the exposure to a third party who read the same number and underwrote it the same way. The score did not make borrowers more trustworthy. It made trustworthiness readable, and that is what let a whole market form on top of it.
Agent automation is at the moment before the score. Every company is piling up agents, copilots, scripts and workflows whose controls nobody has scored. How far any one of them can be trusted depends on whoever built it, can only be known by redoing the review and cannot be compared with the agent the next team stood up. The company has automation it cannot compare, price or gate, which is exactly where lending was before the score. A Trust Debt Index is the score that ends that for agents.
2. Trust debt, defined
Trust debt is the gap that builds up between what an agent claims and what it can prove. The word "debt" is chosen with care. It behaves like financial debt in three ways:
- It is taken on to move faster. Every control skipped, every test not written and every source not captured is a shortcut that ships the agent sooner.
- It is a liability carried forward, not a one-time cost.
- It accrues interest. The bill arrives later, as incidents in production, findings in the audit, the deployment the risk committee will not approve and the deal term a buyer marks down.
A company running a fleet of ungoverned agents is not operating cheaply. It is operating on credit, and the principal is coming due.
The reason to score it rather than describe it is the same reason credit moved from judgment to a number. A description ("this agent is risky") cannot gate, cannot price and cannot be compared. A score can do all three. And because trust debt is built from signals that can each be observed on their own, it can be calculated mechanically rather than judged case by case. That is the only way it scales past the handful of agents one reviewer can keep in mind.
3. What trust debt is made of
The index reads seven signals. Each can be observed on its own, each maps to a failure a controller already recognizes, and each matches something the harness either produces or, when it is absent, leaves missing.
| Signal | What it measures | Failure mode when present |
|---|---|---|
| Unsupported claims | Assertions the agent makes with no source behind them | Confident output that cannot survive a "how do you know?" - the audit fails on the first sampled decision |
| Citation / evidence gaps | Outputs that cite weakly, partially, or after the fact | The reasoning cannot be reconstructed; reviewers must re-derive every conclusion by hand |
| Missing controls | No segregation of duties, no approval gate on material actions | One actor initiates and approves; the classic control breakdown, now automated and faster |
| Absent human-in-the-loop | Material, high-impact actions executed with no human accountable | An irreversible action ships with no one who can be asked why, or stop it |
| No evidence trail | Actions that leave no reconstructable record of inputs, reasoning, and result | Nothing to audit, nothing to replay after an incident, no defense in a dispute |
| No eval pack / regression gate | No test suite gating changes | Quality drifts silently; the agent degrades and the first to notice is a customer or a regulator |
| Stale grounding | Decisions made against context that has gone out of date | The agent is confidently, fluently wrong because the world moved and its grounding did not |
These are not weighted guesses. Each is a yes or no, or a measurable degree, observable from the agent's own records and runtime telemetry.
- An agent that does all seven (sources every claim, cites cleanly, runs under an approval gate, keeps a human accountable for material actions, writes a complete evidence trail, passes an eval pack on every change and works from fresh context) carries almost no trust debt.
- An agent missing four of the seven carries a liability the index now states as a number, instead of leaving it to whether a reviewer happened to ask the right question.
The signals add up and roll up.
- One agent gets a score.
- A process domain (lead-to-cash, source-to-pay, record-to-report) gets the total of its agents' scores.
- A portfolio gets the total across domains.
The same number works at every level, which lets a CFO talk about portfolio trust debt and a builder talk about one agent's, in the same unit.
4. The standard the index enforces
A score has to measure against something. The Trust Debt Index reads against one governance standard, and every signal in section 3 is one way of asking whether the agent meets it. An agent ready for the enterprise is:
- Always sourced. Every claim traces to evidence the company can inspect (a document, a record, a system of record), not to how fluent the model sounds. Sourcing is the difference between a decision and an opinion.
- Always owned. A named human owns the agent's behavior and outcomes. Ownership turns "the AI did it" back into "someone is accountable for what it did."
- Always tested. An eval pack gates every change. The agent that worked yesterday is proven again today, before the change reaches anyone who depends on it.
- Always permissioned. The agent works inside scoped, minimum-necessary authority. It can do what its job requires and provably nothing more.
- Always observable. Quality, cost, tool use, latency and policy exceptions are visible in real time, not pieced together after an incident.
- Always tied to value. The agent carries a baseline, a target and one of the five value levers it moves: revenue, margin, working capital, productivity or risk. An agent with no value link is an expense; the standard requires it to be an investment.
- Accountable to a person. Material actions clear an approval gate before they run. Automation does not mean unattended. It means people's attention goes where it changes the outcome.
These seven conditions are the bar.
- A low trust debt score certifies that an agent meets them.
- A high score flags exactly which ones it fails.
The standard is what makes the number mean the same thing for two agents built by two teams who never spoke. That is the property that made the credit score useful, and the property today's case-by-case reviews can never have.
5. A number that gates, prices and travels
The value of a comparable score is that it moves the decision. A trust judgment made in a meeting is slow, inconsistent and gone the moment the meeting ends. A trust number lives in the workflow and does three things a named tax never could.
It gates production.
- The company sets a threshold. Agents on the right side of it deploy; the rest go back to the harness with a list of exactly which signals to fix.
- The funding conversation changes. The CFO is no longer asked to approve "AI" on faith, but to approve agents that cleared a stated bar, with the portfolio's trust debt reported beside its value.
- The risk committee stops being the office of "no" and becomes the office of "here is the threshold," because for the first time it has a number to set the threshold against.
Production access becomes a function of the score, the way a deploy gate is a function of a passing test suite.
It prices procurement.
- When a company buys an agent or an agent platform, the supplier's trust debt score becomes a procurement term, next to the security questionnaire and the SOC 2 report buyers already require.
- A vendor shipping high-trust-debt agents (unsourced, untested, uncontrolled) finds the trust tax is no longer an abstraction in an analyst report. It is a worse price, a longer security review or a lost deal.
The pressure the credit score put on borrowers, the trust debt index puts on agent vendors: clear the bar or pay the spread.
It travels into deal terms. As agents move from drafting emails to touching revenue, cash and the close, their trust debt becomes part of due diligence.
- An acquirer valuing a target now has a set of automations to assess, and a portfolio trust debt score is the fastest way to assess it. A high score is a cleanup cost priced into the offer.
- An insurer underwriting AI-related coverage wants the number.
- A partner connecting its systems to the company's agents wants the number.
The score becomes the unit in which agent risk is bought, sold and insured: the trust tax, finally priced, the way counterparty risk became priceable once it had a score.
6. Prior art: the index already exists
This is not a thought experiment about infrastructure that would have to be invented. Koko Knows already runs a Trust Debt Index on public companies. It turns the control signals disclosed in SEC filings (the language and substance of how a company governs itself) into a comparable score across a whole universe of companies.
The hard parts are already solved:
- defining signals that predict failure,
- extracting them at scale from messy real-world inputs,
- normalizing them into a number that means the same thing across very different companies, and
- publishing it as something comparable.
Moving that engine from company disclosures to individual agents changes the input, not the method.
- The company index reads filings.
- The agent index reads the harness: agent cards, control packs, eval packs, evidence ledgers and observability telemetry.
The scoring discipline, the normalization and the comparability are the same machinery pointed at a new source of signal that is richer and far more structured. An agent's controls are not buried in prose the way a company's are; they are declared in records built for exactly this purpose. If anything, the agent index is the easier read.
7. The harness is what the score reads from
A Trust Debt Index is not a questionnaire. It is a meter, and a meter is only as good as the instruments it reads. The harness installs those instruments, which is why each part of the index maps one to one onto what the earlier pieces of this series built:
- The agent card declares the agent's sourcing, ownership, scope and value link. It is where the index reads where things came from, the named owner and the value lever. No card means nothing to read, so the unsupported-claims and value-link signals fail by default.
- The control pack holds segregation of duties, approval gates and minimum-necessary permissions. It is where the index reads the controls and whether a human is in the loop. No control pack means the missing-controls and absent-human signals fire automatically, because nothing says otherwise.
- The eval pack is the regression gate. It is where the index reads whether changes are tested. No eval pack means the test signal fails on contact, because there is no suite for the meter to confirm.
- The evidence ledger is the trail. It is where the index reads whether a run can be reconstructed. No ledger means the no-evidence-trail signal is automatic, because by definition there is nothing to reconstruct.
This mapping is the analysis's central claim, and it has a sharp consequence: a high trust debt score is the direct, mechanical result of skipping the harness.
- The agent stood up as a clever script, with no card, no control pack, no eval pack and no ledger, does not score badly because a reviewer was in a bad mood.
- It scores badly because there is nothing for the meter to read, and that absence is the very liability the score exists to show.
The index does not add a judgment on top of the agent. It reads what the agent's own construction left present or missing.
That turns the index from a grade into a diagnosis. A high score does not just say "this agent is risky." It says, signal by signal, which piece of the harness is missing, and so which part to build to bring the score down. The fix list writes itself:
- Low on the evidence signal: install the ledger.
- Low on the test signal: write the eval pack.
- Low on controls: add the control pack and the approval gate.
Build the harness and the score takes care of itself, because the score was only ever reading the harness. Skip it, and the index does not punish the company. It just states the bill the company was already running up, as a number it can finally act on.
8. The view ahead
The trust tax was always going to get a price. The only open question was who would price the company's agents first, and on whose terms.
Over the next several quarters, expect trust debt to move from metaphor to metric:
- a number reported alongside agent value,
- a gate on production access, and
- a line in the procurement template.
The companies that adopt it early will do so because it is the only way to approve agent automation at scale without losing track of what those agents are actually allowed to do and can prove.
Further out, the score does what the credit score did: it leaves the building.
- Procurement teams demand it from vendors.
- Auditors expect it as standard evidence.
- Acquirers price it into due diligence.
- Insurers underwrite against it.
At that point, the company that scored its own agents first, with an index it controls and can act on, is where the prepared borrower stands: it walks into the conversation with the number already in hand, on terms it set, while its competitors wait for someone less generous to assign them one.
The harness produces agents that earn a low trust debt score. The Trust Debt Index is how the rest of the world finally learns to read it.