In an October 1, 2026 DEV Community post, builder Debashish Ghosal says his HivePlane certification gate blocked four deliberately bad agent submissions: an uncertified agent, a model swap, a behavioral regression, and a run that exceeded its cost ceiling. The account offers a concrete look at where admission checks and runtime controls can help—but it is one builder’s field test, not an independent security audit or proof that certification prevents production failures.
What the test was trying to catch
Ghosal describes spending a day trying to defeat software he had written. The test focused on distinct failure points: whether an agent was eligible to enter production, whether it used the model identity tied to its certification, whether it behaved acceptably on tasks, and whether a run could exceed its spending limit. These controls act at different points in an agent’s lifecycle; none alone establishes that an agent will remain safe or reliable over time.
As an Amazon Associate I earn from qualifying purchases.
The following results are the author’s reported observations in his October 1, 2026 post. The post refers to a v0.1.0 field-test report and other supporting documents, but those underlying artifacts are not independently assessed here. Read the author’s DEV Community post.
Four attempts and what the gate did
1. An uncertified agent was denied admission
Ghosal says he registered an agent and submitted it to production without certification. The system returned HTTP 403, identifying the agent as uncertified while production required certified. According to the account, the workload was refused before a run was persisted.
#1 Best Overall
This is an admission check: it evaluates eligibility before the system accepts the run. That timing matters because a refusal before persistence is different from detecting a problem after work has begun.
2. A different model identity was refused
The author says he certified an agent using omlx/qwen3-4b-instruct-2507/4bit, then submitted it with openai/gpt-4o/2024-08-06. The reported refusal came because the submitted model identity did not match the identity bound to the certification attestation.
An attestation can only help with model substitution if the identity actually used is checked against the identity that was certified. The post reports that check for this test case; it does not establish how the mechanism performs across other deployment configurations.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →3. A weak agent failed behavior checks despite valid-looking output
For a regression fixture, Ghosal used an agent that guessed, failed to escalate, and skipped a required issue lookup. It returned well-formed JSON, but the author says the certification result was uncertified: its pass rate was 0.40 (2/5), below a 0.90 production threshold, and it had one critical action-audit failure. The author also reports 11 ms p95 latency for this test.
The three described failures were concrete behavioral misses:
- It guessed an account tier rather than establishing the answer.
- It returned success instead of escalating an unknown topic.
- It failed to call
mcp.github.read_issuewhen the task required it.
The example illustrates why schema-valid output is not the same as correct task behavior. Evaluations can check not only what an agent returns, but whether it takes required actions and escalates when it lacks a reliable answer. The reported scores describe this fixture, not a general benchmark of agent quality.
4. A run stopped after its reported cost exceeded the limit
Ghosal says he configured a per-run ceiling of $0.000001 and made a governed model call. Once usage was reported above that limit, the run stopped; the recorded cost was $2.85. The test used a priced model identity and a configurable cost table. The author notes that end-to-end cloud pricing remained future work, so the figure should be read as the cost recorded in this test—not as a verified estimate of a typical production call.
Free tools Windows power users keep installed
One-click scans. No signup required.
This control acts at a different point from admission: the system needs usage information before it can enforce a spending ceiling. A budget rule can therefore limit further execution after cost evidence arrives, but it cannot make already accrued usage disappear.
Best Value
Other controls the author reports
Approval paused a destructive action
A destructive pagerduty.acknowledge action reportedly paused the run until approval through the operator UI, then resumed after approval. Ghosal says the approval judgment was simulated by him. The test therefore demonstrates the reported pause-and-resume flow, not an independently evaluated human review process.
A large tool payload was truncated and events were recorded
The author reports that a 40 KB tool payload was truncated to 16,384 bytes before reaching the agent. He also says refusals and interventions were recorded in a tamper-evident audit chain. These details describe controls in the tested setup; the post does not provide independent verification of their security properties.
What this test does—and does not—show
The examples make a useful distinction between checks at admission and checks during execution. Certification status and model identity can be checked before a run is persisted. Behavioral evaluations can test required actions and escalation against chosen fixtures. A cost ceiling can respond once usage is reported. Each control depends on evidence being available at the point where it acts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The boundaries are important. The approval decision was simulated; only one priced model identity was used, and end-to-end cloud pricing was still future work. Ghosal also says a detector for gradual drift between recertifications had not shipped. The described tests therefore do not establish that the system would detect slow behavioral decay between certification events, nor that the gate prevents every production failure.
For teams evaluating a similar design, the practical questions are whether the certified identity is the identity invoked, whether evaluation tasks cover consequential behavior rather than formatting alone, whether enforcement happens before or during execution as appropriate, and what changes between recertifications can go unnoticed. A plausible agent is not a certified agent—but certification is only as useful as the evidence, checks, and update process behind it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
