Only Believe What You Can Validate: A Verification Framework for Agentic AI

Experts who review AI-generated documentation often feel confident after scanning the first few sections. The problem is that “feels right” is not a check.

Julia Kordick, Software Global Black Belt at Microsoft, published a piece on the All Things Azure blog that reframes agentic AI adoption as a verification problem — and offers a structured framework to solve it. The core argument: when AI agents produce long, confident-sounding outputs, the most dangerous response is a quick expert review. Humans validate the parts they find easiest to check, leaving the rest untouched.

What Happened

Kordick identifies three failure modes that plague agentic output at scale: the miss (overlooked information producing incomplete output), the hallucination (plausible but false content), and the misinterpretation (wrong execution of a reasonable intent). What makes all three worse is context rot — as a model’s context window fills past 50% capacity, middle tokens lose fidelity, and even beginning tokens degrade above that threshold. The model keeps producing confident output regardless.

The framework she proposes maps verification across three actors: humans, AI, and deterministic tools. Each covers failure modes the others can’t. Humans catch misses but miss systemic issues. AI fixes found problems but can’t identify what it doesn’t know it doesn’t know. Deterministic tools compile and test but miss semantic errors. Effective verification uses all three.

To operationalize this, Kordick proposes six questions for any check: what is the check, what does it cost to build, who performs it, what does it actually prove, what is the result, and what tools help? The last two are underappreciated. She writes: “A check without a result is not a check.” Human reviews must deliver tangible artifacts — confirmed or corrected business rules — not vague sign-offs.

Why It Matters

The real-world example in the piece is instructive. An AI agent reverse-engineers 150 COBOL modules in five minutes and produces 2,500+ words of documentation per module. A domain expert spending an hour “reviewing” that output can realistically validate a fraction of the claims. Without a structured verification ladder, the organization has consumed AI output it cannot actually stand behind.

Kordick maps the verification levels for both reverse engineering and code generation scenarios — from deterministic entity validation at Level 0 (tools like SonarQube, AppCAT, CAST) through full-scope expert validation, use-case testing against source systems, and continuous production monitoring. The ladder design acknowledges that not every output needs every level — it’s about intentionally choosing coverage depth, not defaulting to spot-check-and-hope.

What This Means for Builders

The verification cost question is one most teams avoid until after a problem surfaces. Building the ladder upfront is cheaper than debugging undetected hallucinations six months into production — but only if teams map their existing implicit verification model first, document the gaps, and invest in automation where the cost-per-check is high.

Organizations running agentic workflows in 2026 face a specific risk: they’ve moved fast enough to ship agents into real workflows but haven’t yet built the deterministic tooling to validate outputs at scale. The temptation is to use human experts as a quality gate. That works until the volume of outputs exceeds expert capacity — which is almost immediately, because that’s why you deployed the agents.

Source: Microsoft DevBlogs

Content created with AI assistance and reviewed for accuracy.