Beyond Component Testing: Validating Agentic AI Systems

[3] \fnm Stefano \sur Silvestri

[1] \orgdiv Department of Biomedical, Dental, and Morphological and Functional Imaging Sciences, \orgname University of Messina, \orgaddress \street A.O.U. Policlinico “G.Martino” - Via Consolare Valeria, \city Messina, \postcode 98125, \country Italy

2] \orgdiv Department of Engineering, \orgname University of Messina, \orgaddress \street Contrada di Dio, Sant’Agata, \city Messina, \postcode 98158, \country Italy

3] \orgdiv Institute for High Performance Computing and Networking of National Research Council of Italy , \orgname ICAR-CNR, \orgaddress \street Via Pietro Castellino 111, \city Naples, \postcode 80131, \country Italy

4] \orgdiv National Interuniversity Consortium for Informatics, \orgname CINI, \orgaddress \street Via Ariosto, 25, \city Rome, \postcode 00185, \country Italy Beyond Component Testing:Validating Agentic AI Systems

\fnm Fabio Orazio \sur Mirto fmirto@unime.it

\fnm Luca \sur D’Agati ldagati@unime.it

\fnm Giuseppe \sur Tricomi gtricomi@unime.it

stefano.silvestri@icar.cnr.it

\fnm Francesco \sur Longo flongo@unime.it

\fnm Antonio \sur Puliafito apuliafito@unime.it

\fnm Giovanni \sur Merlino gmerlino@unime.it * [ [ [

Abstract Agentic AI systems act through multi-step trajectories that combine planning, tool use, memory, interaction, and adaptation. This behavior stretches validation practice beyond component testing and one-shot input–output evaluation, because acceptable system behavior now depends on how decisions unfold over time and under changing environmental conditions. This survey synthesizes 257 papers spanning agent evaluation, software assurance, cyber-physical systems, runtime monitoring, and regulatory guidance in order to characterize the validation problem for agentic systems. The review is organized around a five-dimension taxonomy covering behavioral, safety, temporal, regulatory, and multi-agent concerns, and uses that taxonomy to map current approaches and expose recurrent coverage gaps. The analysis shows that behavioral evaluation is comparatively mature, while temporal validity, runtime evidence maintenance, regulatory legibility, and open-ended multi-agent systems assurance remain under-developed. Three cross-domain case studies (medical care, industrial operations, smart-mobility systems) provide operational illustrations of how the five taxonomy dimensions recur in safety-critical settings, grounded in the failure patterns documented in the reviewed literature. The paper concludes with a lifecycle-oriented research agenda centered on bounded-autonomy specifications, adversarial trajectory generation, runtime monitoring, and audit-ready evidence structures. The central claim is that trustworthy deployment of agentic AI depends on validating trajectories in context rather than assessing isolated components alone.

keywords: agentic AI, agentic systems, runtime validation, behavioral evaluation, software verification and validation, AI assurance

1 Introduction

1.1 The Agentic Shift

Agentic artificial intelligence (AI) systems are increasingly deployed as software systems that pursue goals through multi-step reasoning, planning, memory, tool use, and adaptation under changing context [ luo2025 , zou2025 ] . This shift changes the validation target. Classical software components primarily implement bounded functions over inputs, state, and interfaces, whereas agentic systems must be evaluated as policies acting over trajectories in dynamic environments. The question is therefore no longer only whether a component returns the correct output, but whether the overall system behaves acceptably over time, across interactions, and under changing operational conditions.

Recent agent architectures make this shift concrete. Contemporary frameworks organize execution around loops of perception, planning, tool invocation, reflection, memory update, and possible delegation to other agents or services [ autogen2025 , luo2025 ] . Even when built from familiar software parts, such as models, Application Programming Interfaces (APIs), retrieval modules, schedulers, and user interfaces, their system-level behavior emerges from how these parts are orchestrated across trajectories rather than from any single module in isolation. The result is a software architecture that is more open-ended, history-dependent, and environment-coupled than the systems for which mainstream testing abstractions were originally designed.

1.2 Five Testing Mismatches

Software engineering already provides mature foundations for unit and regression testing [ myers2004 , beizer1990 ] , as well as integration testing and specification-based verification [ ammann2016 ] . Those foundations remain necessary. However, they were largely developed for systems whose relevant behaviors are relatively reproducible, decomposable, and specifiable at the level of components and interfaces. Agentic systems stress those assumptions in at least five recurring ways.

Table 1: Five abstract mismatches between classical testing assumptions and agentic-system validation targets.

Mismatch

Classical testing assumption

Agentic-system reality

Validation implication

Determinacy mismatch

Repeating the same test should yield the same or predictably equivalent result.

Stochastic inference, contingent planning, and tool availability can produce different trajectories from the same starting state.

Validation must characterize acceptable variation, not only exact reproducibility.

Decomposition mismatch

Correct components compose into correct system behavior.

Failures often arise from orchestration across planner, memory, tools, users, and other agents.

Evidence must cover end-to-end trajectories and cross-component interactions.

Specification mismatch

Requirements can be stated as explicit input–output properties or interface contracts.

Goals such as “act helpfully,” “escalate appropriately,” or “use tools safely” are partial, contextual, and temporally extended.

Validation needs bounded-autonomy contracts, runtime constraints, and scenario-based evidence.

Environment mismatch

Operating conditions can be bounded into stable test fixtures and controlled mocks.

Agent behavior depends on dynamic environments, external services, changing data, and human responses.

Assurance must include simulation, adversarial scenarios, and monitoring in context.

Temporal mismatch

Correctness is treated as a property established prior to deployment.

Agentic behavior unfolds over long horizons and can drift with memory, updates, and changing workflows.

Validation must become lifecycle-oriented, with post-deployment oversight and evidence refresh.

Table 1 shows that unit, regression, integration, and specification-based tests cover only part of the assurance space. The validating question expands from “Did the component return the correct output?” to “What evidence justifies trust in this system’s behavior over realistic trajectories and operating conditions?” Established software-engineering practice therefore remains essential but requires extension for agentic autonomy.

Section 5 returns to these same five abstract mismatches by examining them across classical testing methods. In that comparison, fault injection is listed separately because it operationalizes both decomposition and environment concerns within the five mismatches of Table 1 .

1.3 Why a Validation-Centered Survey Now

Three developments make a validation-centered synthesis timely. The first is a gap in the survey landscape. The agent surveys of 2024–2026 map architectures, capabilities, benchmarks, and evaluation practice with increasing precision [ yehudai2025 , luo2025 ] , but they organize the field by what agents can do , not by what must be shown before and during consequential deployment. As Table 3 makes explicit, temporal validity and regulatory legibility are rarely treated as first-class axes among the closest adjacent surveys, and almost none rests on a systematically screened corpus. A reader of the existing literature can learn how agents are built and how well they score; what evidence package would justify trusting one in deployment is a question that literature does not yet organize itself around.

The second development is that the governance clock is already running. FDA guidance on AI-enabled device software and predetermined change control, together with the MDCG positions on adaptive AI, has moved lifecycle evidence, traceability, and change control from aspiration to operative expectation. FDA guidance addresses AI-enabled devices and predetermined change control [ fda-aiedsflm2025 , fda-pccp2025 ] ; MDCG guidance provides complementary European expectations [ mdcg2025-6 , mdcg2025-10 ] . These documents state what must be demonstrated; the engineering literature that should supply the demonstration methods remains fragmented across the five streams surveyed here. The cost of that fragmentation is borne now, by teams deploying agentic systems in clinical, industrial, and mobility settings under evidence expectations that the technical literature does not yet operationalize.

The third development is the rapid consolidation of the empirical base: 209 of the 257 included papers were published in 2025–2026 (Figure 2 ). This concentration makes it possible to synthesize agent-specific validation work while evaluation norms are still developing.

1.4 Contributions

This survey makes four contributions:

1. Systematic literature review. We synthesize five partially disconnected bodies of literature: classical software engineering (SE) testing, agent-framework evaluation, Cyber-Physical Systems (CPS) validation, runtime assurance, and regulatory guidance, through a PRISMA-inspired screening of 7,197 retrieved records down to 257 included papers.

2. Five-dimension taxonomy. We introduce a standalone taxonomy of validation challenges for agentic systems spanning behavioral, safety, temporal, regulatory, and multi-agent dimensions, with explicit validation objects, characteristic failure modes, and measurable metrics for each. Its distinguishing choice is to treat temporal validity and regulatory legibility as first-class axes rather than as remarks appended to capability valuation, the two axes on which adjacent surveys are weakest (Section 6 ).

3. Quantified gap analysis. We derive gaps from the coded corpus: a coverage matrix over approach families and validation dimensions identifies which pairings are mature and which remain structurally under-addressed, with adversarial sensitivity bounds showing that the directional claims survive worst-case reassignment of borderline papers (Section 7 ).

4. Research agenda. We translate the identified gaps into a four-direction validation stack with candidate metrics andsoftware-engineering targets, moving from a generic call for better evaluation toward a concrete research program (Section 9 ).

   The remainder of the paper is organized as follows. Section 2 describes the survey methodology. Section 3 organizes prior literature along five validation axes. Section 4 defines agentic systems and the expanded assurance target, while Section 5 analyzes which classical software-testing assumptions break and which still carry over. Section 6 presents the five-dimension taxonomy, and Section 7 maps existing approaches onto it to identify directional gaps. Section 8 grounds the taxonomy in three consequential domains, Section 9 develops the research agenda, Section 10 discusses open challenges, and Section 11 concludes.

   2 Survey Methodology

   2.1 Research Questions

   The review is structured by four research questions: which classical software-testing assumptions fail for agentic systems (RQ1), which validation dimensions a comprehensive framework must cover (RQ2), how existing approaches distribute across those dimensions (RQ3), and which research directions follow from the remaining gaps (RQ4). These RQs map directly onto Sections 5 , 6 , 7 , and 9 .

   2.2 Search Strategy

   We searched five primary databases: ACM Digital Library, IEEE Xplore, Scopus, arXiv (cs.SE, cs.AI, cs.MA, cs.RO), and Semantic Scholar. The initial search was conducted between January and April 2025, followed by a refresh pass between January and March 2026 that re-interrogated the same five sources to capture newly indexed 2025–2026 publications. The review covers publications from January 2019 to March 2026, with selective inclusion of foundational earlier work where it defines the classical baseline being challenged. Unless noted otherwise, counts reported below refer to the consolidated retrieval set after both passes.

   Each database was queried with a core string combining agent-identity terms (“agentic,” “LLM agent,” “language model agent,” “autonomous agent”), validation terms (“validation,” “assurance,” “verification,” “testing,” “evaluation”), and trajectory-level terms (“trajectory,” “tool use,” “multi-step,” “stateful,”) adapted to each database’s field-search syntax. Dimension-specific expansion added behavioral terms (e.g., “benchmark,” “trajectory consistency”), safety terms (e.g., “runtime assurance,” “safe autonomy”), temporal terms (e.g., “concept drift,” “evidence freshness”), regulatory terms (e.g., “assurance case,” “post-market surveillance”), and multi-agent terms (e.g., “coordination,” “emergent behavior”).

   We additionally performed forward and backward citation searches from agent-evaluation anchor papers [ luo2025 , yehudai2025 ] and CPS-validation anchor papers [ collaco2026 , zhao2026 ] , and included regulatory documents from the Food and Drug Administration (FDA) and Medical Device Coordination Group (MDCG) not indexed in academic databases.

   All retrieved records were exported with bibliographic metadata (including title, abstract, venue, year, and DOI where available) and consolidated into a unified dataset for screening and analysis.

   The review process follows a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA)-inspired structure [ PRISMA ] with explicit reporting of deduplication, screening, and inclusion stages. The merged retrieval set used for screening contained 7,197 unique records after both passes. Of these, 7,125 carried a single-source provenance tag: 4,575 from IEEE Xplore, 1,194 from arXiv, 709 from the ACM Digital Library, 364 from Semantic Scholar, and 283 from Scopus. A further 72 unique records were retrieved from two or more of those sources and were retained as a separate multi-source provenance category for audit traceability. Regulatory and standards documents from the FDA and MDCG were retained as background references but are not counted in the screened paper corpus. IEEE Xplore alone supplies 64% of single-source records (4,575/7,125), well above arXiv (1,194); Section 2.8 returns to this skew as a threat to validity.

   Deduplication was performed using title and source normalization, followed by manual inspection for ambiguous cases and cross-source matches.

   2.3 Inclusion and Exclusion Criteria

   The following criteria governed all three screening stages. They were defined and frozen before screening began and applied consistently across all records.

   Inclusion criteria. A paper was included if it satisfied all of the following conditions:

   • I1: Validation relevance. The primary contribution had to address validation, testing, verification, runtime monitoring, assurance, benchmarking, safety enforcement, or auditable oversight of software behavior.

   • I2: Agentic execution feature. The evaluated system had to execute over a trajectory rather than a single inference step. For corpus-inclusion purposes, this required at least one agentic execution feature : explicit planning across steps, tool invocation with feedback, persistent memory/state carry-over, closed-loop interaction with an external environment, or coordination among multiple autonomous components. These disjunctive criteria ensured that papers addressing trajectory-level validation in any form could enter the corpus, even if they did not emphasize all three canonical agentic properties.

   • I3: Software-level scope. The paper had to contain a substantive software or systems contribution relevant to agentic AI, CPS, runtime assurance, or AI-enabled software engineering.

   • I4: Sufficient technical content. Empirical studies, benchmark papers, frameworks, formal methods papers, and technical reports were included only if they supplied enough methodological detail to support analytical coding.

   • I5: Time and language window. The source had to be published in English and fall within the January 2019 to March 2026 search window, unless it was a deliberately retained foundational baseline source.

   Exclusion criteria. A paper was excluded if any of the following conditions held:

   • E1: Single-shot inference only. The paper evaluated a single forward pass, a static prompt-response exchange, or prompt quality without an autonomous trajectory.

   • E2: Prompt-only orchestration. The system used prompt templates, self-consistency, or prompt ensembles but did not expose persistent state, tool-mediated feedback, iterative control, or interacting agents.

   • E3: Non-agentic adjacent AI. The contribution focused on perception-only natural language processing (NLP), vision, or prediction tasks not embedded in an autonomous action loop.

   • E4: Non-software assurance target. The paper addressed hardware reliability, sensor fault tolerance, or physical device dependability without a software-level validation contribution.

   • E5: Insufficient scholarly record. Editorials, blog posts, slide decks, and very short abstracts without retrievable technical content were excluded. Preprints were retained only when they were the principal technical record for a widely used agentic benchmark or framework.

   The review focuses on software-level validation of agentic systems. Formal verification of hybrid systems and model checking of finite-state software provide background context, while hardware reliability and sensor fault tolerance are included only when they directly affect software-level validation claims.

   2.4 Paper Selection

   Selection proceeded in three sequential screening stages, each applying the criteria of Section 2.3 at increasing levels of granularity. Figure 1 reports record counts at each stage; the decision trace records exclusion criteria at the record level for audit purposes.

   Stage 1: Title screening (7,197 to 3,214). Each of the 7,197 deduplicated records was assessed on title alone. A record was excluded only when its title provided unambiguous evidence of out-of-scope content: hardware reliability or sensor fault tolerance without a software validation contribution (E4); NLP/vision/speech work with no agentic framing and no assurance term (E3); or LLM capability studies without any testing or verification component (E1, E2). Ambiguous titles were retained for abstract review. This pass reduced the corpus from 7,197 to 3,214 records (55% reduction).

   Stage 2: Title-and-abstract screening (3,214 to 561). The 3,214 records were assessed on title and abstract together. The most frequent exclusion reasons were: papers using “agent” in a non-agentic sense such as reinforcement-learning (RL) agents on low-level state spaces (E2, E3); benchmark papers evaluating static model capabilities without a trajectory or tool-use component (E1); and papers addressing LLM evaluation without a lifecycle or assurance framing, where validation appeared as a secondary concern (I1 not satisfied). This pass reduced the corpus from 3,214 to 561 records (83% reduction).

   Stage 3: Full-text review (561 to 257). The 561 records were reviewed in full. Exclusions arose from three patterns: architecturally oriented papers whose validation component was too thin to constitute a primary contribution (I1, I4 not satisfied); papers proposing validation methods evaluated exclusively on static benchmarks with no agentic trace as the unit of assessment (E1); and workshop or position papers too preliminary to provide citable methodological detail (E5). Of the 257 retained papers, 237 were assigned high confidence and 20 medium confidence based on centrality to a taxonomy dimension.

   Figure 1: PRISMA-style workflow for literature identification, screening, eligibility assessment, and inclusion. The retrieval stage yielded 7,197 unique records after source merging and deduplication across five primary sources. Sequential screening reduced the corpus to 257 papers included in the final survey.

   2.5 Coding Scheme

   The unit of analysis is the individual paper, even when multiple systems or evaluations are reported. Each paper was coded along three axes: primary validation dimension, approach family, and domain context. The validation dimensions (behavioral, safety, temporal, regulatory, and multi-agent) are defined operationally in Section 6 and applied consistently during coding. Papers could contribute evidence to more than one dimension, but a single primary dimension was assigned based on the main validation objective emphasized by the work; secondary contributions are recorded in the coding trace but do not duplicate counts across the primary-dimension totals reported in Section 7 .

   The initial screening and study-selection stages were conducted by a single reviewer. To strengthen the reliability of the analytical phase, we ran two distinct reliability checks. The first is an inter-rater check: a second reviewer independently classified all 257 included papers, achieving substantial agreement with the primary reviewer (Cohen’s κ = 0.759 \kappa=0.759 ) for this classification step. The second is an intra-rater check on the primary reviewer’s own consistency over time: the codebook was frozen before full-corpus coding and applied by the primary reviewer in three passes. Pass 1 assigned a primary dimension and confidence label (high/medium) to all 257 papers; Pass 2 re-coded, after a week-long interval, an 84-paper audit subset (all 20 medium-confidence papers plus a 64-paper stratified high-confidence sample); Pass 3 reconciled discordant cases against the written codebook, logging each adjudication decision. Within-reviewer stability was 76/84 before adjudication; the eight discordant cases all fell at pre-specified borderlines (behavioral/safety, temporal/regulatory, safety/multi-agent). This intra-rater procedure documents within-reviewer stability and remaining coding ambiguities; it is distinct from the independent classification check reported above and in Section 2.8 .

   2.6 Corpus Composition

   Two descriptive views of the 257-paper corpus ground the analysis in later sections. The first is primary-dimension composition: under the frozen codebook each included paper carries exactly one primary dimension, yielding 71 behavioral (27.6%), 62 temporal (24.1%), 50 multi-agent (19.5%), 42 safety (16.3%), and 32 regulatory (12.5%) papers. Behavioral work is the largest primary category, but the corpus is not dominated by a single validation style: temporal and multi-agent work occupy substantial shares, while regulatory work is the smallest primary category. The second view is recency: the corpus is heavily concentrated in recent years (1 paper pre-2019, 29 in 2019–2023, 18 in 2024, 189 in 2025, and 20 in January–March 2026), with the sharpest growth from 2024 onward. These patterns motivate the directional gap analysis in Section 7 ; Figure 2 reports the year-band composition.

   Figure 2: Primary-dimension composition of the corpus by publication-year band. Each included paper carries exactly one primary dimension, so the per-band counts ( n n ) sum to the 257 included papers.

   2.7 Automated Classification Validation

   The second reviewer’s role was limited to validating the classification of the included studies rather than participating in the primary screening pass. Across the 257 included papers, the two human reviewers achieved Cohen’s κ = 0.759 \kappa=0.759 . Four open-weight classifiers (qwen2.5:3b, llama3.2:3b, ministral-3:3b, phi4-mini:3.8b) were added as auxiliary raters; their agreement improved from the zero-shot condition (Fleiss’ κ = 0.559 \kappa=0.559 ) to the few-shot condition (Fleiss’ κ = 0.665 \kappa=0.665 ), where the Fleiss coefficient is computed across the four classifiers alone. The primary reviewer enters the separate pairwise Cohen comparison against the second reviewer. These results show that the taxonomy supports independent classification while retaining borderline cases for human judgment.

   2.8 Limitations and Threats to Validity

   The first limitation concerns corpus coverage and timing. Agentic AI validation remains terminologically unstable, and terms such as “assurance,” “evaluation,” and “monitoring” span overlapping research programs. The search therefore used expanded queries across five databases, citation chaining from anchor papers, and regulatory documents not consistently indexed in academic databases. Residual risks include terminology emerging after the March 2026 cut-off, metadata inconsistencies in preprint-heavy venues, and the dominance of IEEE Xplore in the merged retrieval set, which may under-represent some machine-learning venues.

   The second limitation is reviewer dependence. A single reviewer conducted title, abstract, and full-text screening, creating a risk of systematic selection bias. Classification was independently validated by a second reviewer and is therefore less exposed to this limitation.

   For classification, the codebook was frozen before full-corpus coding; a second reviewer independently classified all 257 included papers (Cohen’s κ = 0.759 \kappa=0.759 ); and four LLM classifiers served as auxiliary raters. The eight Pass 1/Pass 2 discordances occurred at the three pre-specified codebook boundaries (behavioral versus safety, temporal versus regulatory, and safety versus multi-agent). The adversarial sensitivity analysis in Table 2 shows that the directional claims persist under worst-case reassignment of all eight cases.

   Internal checks cannot exclude systematic interpretation bias in the single-reviewer selection stage, which may have shifted corpus composition. Accordingly, the analysis emphasizes directional patterns, and Table 2 reports how plausible reassignment changes the primary-dimension totals.

   Table 2: Sensitivity of paper-level primary-dimension counts to adversarial reassignment of the eight Pass 1/Pass 2 discordant cases documented in the adjudication record. “Nominal” is the adjudicated primary-dimension count; “Range” gives the minimum and maximum count obtained when each discordant case is reassigned to its non-adjudicated alternative in the direction least or most favorable to that dimension. Every reassignment preserves the 257-paper total.

   Dimension Nominal Worst-case range

   Behavioral 71 [70, 72]

   Safety 42 [40, 45]

   Temporal 62 [61, 63]

   Regulatory 32 [30, 33]

   Multi-agent 50 [48, 52]

   3 Related Work

   This section positions the survey against five adjacent literatures that partially address agent validation but rarely yield a single assurance framework. The through-line is that each body of work captures one part of the problem, whether benchmarking, architectural evaluation, CPS validation, runtime assurance, or governance, while leaving other validation objects under-specified. Together, they show the need for a lifecycle account of what must be validated, when validation must be renewed, and what evidence must remain available for review.

   3.1 Classical SE Testing Limits

   Recent evaluation work converges on a familiar software-engineering lesson: task success is not equivalent to system assurance. Agent-evaluation surveys show that prevailing benchmarks privilege outcome completion while under-specifying trace quality and tool-use correctness [ yehudai2025 , luo2025 ] . Work on diagnosis makes the remaining limitation explicit: failure explanations are rarely part of the benchmark target [ kddeval2025 ] . Static benchmark suites are vulnerable to contamination and leaderboard aging [ liang2022helm , lipton2018mythos ] ; recent evidence documents these effects directly in agent evaluation [ benchcontam2025 ] . AgentBench [ agentbench2023 ] established the baseline for multi-environment evaluation but reports task completion rather than trajectory acceptability; SWE-rebench [ swerebench2025 ] and ITBench [ itbench2025 ] show that contamination-free refresh can materially change ranking, confirming that outcome scores are environment-snapshot artefacts. Convergent benchmark work such as AgentBoard, TheAgentCompany, and AgentHarm is important here because it broadens evaluation from static question answering to multi-turn interaction, consequential office-style tasks, and harmful-action exposure, yet still leaves intermediate-step legibility and trajectory acceptability only partially specified: AgentBoard and TheAgentCompany broaden the interaction setting [ agentboard2024 , theagentcompany2025 ] , whereas AgentHarm foregrounds harmful-action exposure [ agentharm2024 ] . Convergent evidence across clinical, cybersecurity, logistics, and financial deployments confirms that the outcome-score gap is domain-independent: clinical and cybersecurity studies report it in high-consequence settings [ autonomousAgentic2025 , agenticSecurity2025 ] , and logistics and planning studies report the same limitation in operational workflows [ ablLlmbased2025 , agenticPlanning2025 ] . The practical limit of this literature is therefore not lack of evaluation effort, but the narrow validation target encoded in most benchmark designs.

   3.2 Agentic Frameworks Evaluation Gaps

   A second literature evaluates agent frameworks directly, but in terms of capability rather than assurance. wang2024survey provide the most comprehensive architectural survey of LLM-based agents, covering memory, planning, tool use, and interaction patterns, but do not define validation dimensions or conduct systematic corpus coding. acharya2025 and abouali2025air offer further architectural surveys with attention to safety risks and governance, but neither treats temporal lifecycle validity or regulatory evidence legibility as first-class assurance targets. More focused work adds trajectory awareness only partially: MultiAgentBench [ multiagentbench2025 ] and MAST [ mast2025 ] score coordination outcomes and failure modes, AutoGen-style framework studies [ autogen2025 ] expose orchestration patterns, recent protocol-oriented work such as Autogenesis [ autogenesis2026 ] makes explicit that agent protocols themselves can evolve across deployment, and studies of asynchronous software-engineering agents show that handoff, parallelism, and coordination policy materially affect system behavior even when the base model is fixed [ caid2026 ] , yet the field still lacks shared methods for validating whether trajectories remain acceptable under changing tools, humans, and environments [ luo2025 , zou2025 ] . In other words, framework surveys explain how agents are assembled, but still leave open how those assemblies should be assured once their components evolve in deployment.

   3.3 CPS Trajectory Validation

   The CPS literature contributes a more deployment-grounded view by treating behavior as closed-loop, temporal, and environment-coupled. Work on digital twins, runtime safety, autonomy in medical and industrial systems, and International Conference on Cyber-Physical Systems (ICCPS)-style validation emphasizes that hazards emerge from feedback, delays, stale state, and coupled infrastructure, not only from wrong final outputs. Digital-twin and ICCPS work emphasize feedback, delays, and stale state [ veledar2019dt , lin2025iccps ] , while recent CPS validation studies examine coupled infrastructure and closed-loop autonomy [ brown2025iccps , collaco2026 ] . Medical and industrial agent studies extend the evidence to deployment settings [ zhao2026 , sharma2026 ] ; healthcare simulation work shows related trajectory risks [ draelos2026 , synthea2026 ] , including in gym-style evaluation environments [ healthgym2025 ] . This literature is closest to the present paper’s assurance target, but it is usually domain-specific and does not systematically connect CPS validation concerns to the broader wave of LLM-based agentic systems. Its importance here is conceptual: it shows that trajectory validity is inherently relational and time-dependent, even when the surrounding evaluation culture is not yet organized around LLM-agent terminology.

   3.4 Runtime Assurance and Monitoring

   Runtime-assurance work addresses the gap that static testing cannot close once systems adapt in the field. greshake2023 established the indirect prompt-injection problem, where malicious content in tool outputs hijacks agent behavior, as one of the most studied runtime safety failures in the current corpus, motivating the trajectory-level containment gap identified in Section 7 . Research on runtime verification, assurance monitors, drift management, policy shields, and expert monitoring shows how safety envelopes, conformance checks, and evidence refresh can intervene after deployment rather than treating release as the end of validation. Assurance and runtime-verification work supplies conformance and safety-envelope mechanisms [ hawkins2021amlas , rtbas2025 ] , while MLOps and expert-monitoring work focuses on evidence refresh in operation [ mlops2023 , expertmonitoring2024 ] . Safe control and regulatory guidance specify complementary obligations [ alshiekh2018safe , fda-pccp2025 ] ; MDCG guidance and anomaly monitoring extend these concerns to evolving deployments [ mdcg2025-10 , yourAnomaly2025 ] . More agent-specific systems such as AgentGuard and ControlA move from static evaluation toward runtime verification and workflow control for autonomous or semi-autonomous agents, addressing local monitoring and containment problems within an agentic execution [ agentguardRuntime2025 , controlaAgentic2025 ] . What remains missing is integration: most monitoring papers specify local safeguards, but not a full stack connecting requirements, simulation, runtime evidence, and audit-ready assurance artifacts. This is the clearest sign that runtime assurance is a necessary layer of validation, but not a substitute for the upstream and downstream evidence structures that make interventions explainable.

   3.5 Regulatory and Assurance Frameworks

   Regulatory and assurance-case literatures specify the accountability requirements that technical evaluation must satisfy. FDA, MDCG, International Electrotechnical Commission (IEC), European Union (EU), and Institute of Electrical and Electronics Engineers (IEEE) guidance consistently foreground lifecycle evidence, change control, documentation, human oversight, and post-market surveillance. FDA guidance foregrounds lifecycle evidence and good machine-learning practice [ fda-action-plan , fda-gmlp ] , while its AI-enabled-device guidance treats adaptive change explicitly [ fda-aiedsflm2025 ] . MDCG documents address software and adaptive AI governance [ mdcg2025-6 , mdcg2025-10 ] ; the EU MDR, IEC 62304, and IEEE guidance provide the surrounding accountability requirements [ eu-mdr , iec62304 ] , with IEEE guidance providing an additional reference point [ ieeeguide2025 ] . Assurance-case methods, including Goal Structuring Notation (GSN)-style argumentation and recent responsible-AI frameworks for healthcare autonomy, show how heterogeneous evidence can be assembled into reviewable claims [ alelyani2025 ] . The unresolved problem is evidentiary generation: governance documents say what must be shown, but not how agentic systems should be tested and monitored so that those claims can be credibly made. Recent assurance-oriented work on agentic GenAI risk mapping and broader AI-safety assurance methods is therefore relevant to the present corpus because it starts to translate governance obligations into candidate evidence structures, even if the trajectory-level instrumentation problem remains open [ reliabilitybydesignAgentic2025 , landscapeSafety2025 ] .

   3.6 Positioning of This Paper

   Our paper sits at the intersection of these five axes. Relative to classical testing, it explains why component-oriented methods remain necessary but no longer define the full assurance target. Relative to agent-framework evaluation, it shifts attention from benchmark scores to trajectory validation in context. Relative to CPS work, it generalizes environment-coupled validation beyond any single domain. Relative to runtime-assurance research, it places monitoring inside a lifecycle stack rather than as an isolated safeguard. Relative to regulatory and assurance-case work, it translates governance demands into concrete validation objects. The integrative contribution is a unified view of the validation problem across the residual gaps of these literatures.

   To situate this survey relative to the closest adjacent reviews, we compare them along six properties: publication year, whether they release a systematically screened corpus, whether they organize the field by validation objects rather than capabilities or domains, which of the five validation dimensions they treat as primary axes, whether they contain an explicit gap analysis, and whether they produce a research agenda with candidate metrics. These are the properties that most clearly distinguish an inspectable synthesis survey from a high-level overview.

   Table 3: Comparison with adjacent surveys. Corpus: S = systematic screened corpus, O = curated overview. Organization: VO = validation objects, CAP = capabilities, DOM = domains. Primary dimensions: B = Behavioral, Sa = Safety, T = Temporal, R = Regulatory, M = Multi-agent. Gap analysis: Y = explicit, P = partial, N = absent. Agenda: M = directions with candidate metrics, D = directions without metrics, N = none.

   Survey

   Year Corpus Organization

   Evaluation dimensions / gap analysis

   Agenda

   wang2024survey

   wang2024survey O CAP

   {B} / P

   D

   luo2025

   luo2025 O CAP

   {B} / P

   D

   yehudai2025

   yehudai2025 O CAP

   {B} / P

   N

   acharya2025

   acharya2025 O CAP

   {B} / N

   N

   abouali2025air

   abouali2025air O CAP

   ∅ \emptyset / N

   N

   zhao2026

   zhao2026 O DOM

   {B, Sa, R} / P

   D

   kddeval2025

   kddeval2025 O CAP

   {B, Sa} / P

   D

   zou2025

   zou2025 O CAP

   {B, M} / P

   D

   trustagent2025

   trustagent2025 O CAP

   {Sa, M} / P

   D

   comparativeSurvey2025

   comparativeSurvey2025 O CAP

   {Sa, M} / N

   N

   zha2023datacentric

   zha2023datacentric O DOM

   {B} / N

   D

   benchcontam2025

   benchcontam2025 O DOM

   {T} / P

   D

   zhang2020mltesting

   zhang2020mltesting O CAP

   {B, Sa} / N

   D

   landscapeSafety2025

   landscapeSafety2025 O VO

   {Sa, R} / P

   M

   collaco2026

   collaco2026 S DOM

   {Sa} / P

   D

   This survey

   2026 S VO

   {B, Sa, T, R, M} / Y

   M

   Table 3 shows four recurring patterns: most adjacent surveys are curated overviews rather than systematic syntheses; the field is organized by capabilities or domains rather than validation objects; temporal, regulatory, and multi-agent coverage are rarely treated as co-equal axes; and few surveys combine explicit gap analysis with a metrics-based research agenda. These are the gaps this paper is structured to address.

   4 Agentic Systems: Definitions and Validation Challenges

   4.1 What Makes Systems “Agentic”

   We use agentic system to denote a software system that pursues a goal through temporally extended action rather than through a single inference. Three properties matter for validation. First, the system maintains state across steps, whether through memory, retrieved context, or workflow state. Second, it acts through tool use, delegation, or other environment-coupled interventions. Third, its relevant behavior is a trajectory: planning, execution, escalation, recovery, and stopping conditions may all matter independently of the final answer. This definition covers contemporary LLM-based agents while remaining broad enough to include software-intensive autonomy in CPS and enterprise workflows. Agent-evaluation surveys support the former comparison [ luo2025 , zou2025 ] , while CPS validation studies motivate the latter [ collaco2026 , zhao2026 ] .

   Formally, we use trajectory to denote a finite temporally ordered sequence τ = ( ( s 0 , a 0 , m 0 ) , … , ( s T , a T , m T ) ) \tau=((s{0},a{0},m{0}),\dots,(s{T},a{T},m{T})) , where each s t s{t} is the relevant system–environment state at step t t , each a t a{t} is the action selected at that step, and each m t m_{t} records minimal execution annotations such as tool invocation, retrieved evidence, delegation, or human handoff. This definition is intentionally lightweight: the state may be partially observed, the action may be symbolic or natural-language, and the annotations need only be rich enough to reconstruct why a step occurred and what external intervention it triggered.

   We separate three boundary terms. An agentic execution feature is any trajectory-relevant property used for screening: planning across steps, tool invocation with feedback, persistent state, closed-loop external interaction, or coordination among autonomous components. A canonical agentic system satisfies the three conceptual properties together: persistent state, environment-coupled action, and trajectory-level behavior. An LLM-based agent with planning loops, persistent memory, and tool-call sequences exemplifies this canonical case. A consequential assurance trigger arises when any agentic execution feature affects workflows, infrastructures, or physical processes strongly enough that lifecycle validation becomes necessary.

   This distinction matters operationally. The corpus-inclusion criterion (I2) is disjunctive because a paper enters the corpus if it addresses trajectory-level validation of any system exhibiting at least one agentic execution feature. A stateful dialog manager with no external tool calls occupies a boundary zone and is included only if the paper demonstrates that its lifecycle or trajectory-level properties matter for assurance. Conversely, a stateless tool dispatcher that invokes an external service is included if the paper treats the multi-step outcome as the unit of validation rather than only the final response. The canonical cases form the primary target of the taxonomy and most of the survey findings, while the permissive inclusion boundary captures consequential assurance triggers that do not emphasize all three canonical properties.

   4.2 Architecture Typology

   For validation purposes, three architectural patterns matter. Pipeline systems follow predetermined stages with limited branching, so the main risks are interface mismatches, stale handoffs, and accumulation of stage-local errors. A clinical documentation pipeline that extracts findings, classifies urgency, and drafts a note in fixed sequence illustrates this pattern: errors in the extraction stage propagate silently into later stages, and the fixed stage order offers no mechanism for dynamic error recovery. Network systems route dynamically across tools, planners, or peer agents, shifting attention to coordination failures, non-local causality, and weak trace reproducibility. A code-repair agent that queries a retrieval index, invokes a linter, calls an LLM planner, and conditionally delegates to a test executor illustrates this pattern: the same defect report can trigger different tool invocation sequences across runs, making it difficult to define a canonical trajectory against which to evaluate correctness. Human-in-the-loop systems insert review, override, or escalation checkpoints, making calibration of handoffs, authority boundaries, and accountability for mixed human–agent trajectories the dominant assurance concern. A triage agent that surfaces high-risk cases to a clinician while autonomously closing low-risk ones illustrates this pattern: validation must address not only whether the agent acts correctly in isolation, but whether its escalation threshold is well-calibrated, neither suppressing alerts that require human review nor generating so many interruptions that human oversight becomes ineffective in practice.

   4.3 The Expanded Assurance Target

   Once a system is agentic, the assurance target expands from isolated component outputs to acceptable trajectories in context . The relevant questions become whether the system gathered the right evidence, used tools appropriately, respected safety and escalation boundaries, coordinated correctly with humans or peer agents, and remained valid as the environment changed. This is why the paper’s central validation object is not the model response alone, but the trajectory realized by the socio-technical system.

   This expansion has a direct methodological consequence: test adequacy can no longer be defined by coverage of input–output pairs. A test suite that exercises all intended tool calls in isolation may still fail to expose trajectory-level failures, such as incorrect tool ordering, unsafe intermediate states, or recovery breakdowns, that only become visible when the full action sequence is examined end to end. The five-dimension taxonomy in Section 6 articulates what trajectory-level adequacy requires across behavioral, safety, temporal, regulatory, and multi-agent concerns.

   4.4 Scope and Boundary Conditions

   The paper focuses on software-intensive agentic systems whose actions are consequential because they affect workflows, infrastructures, or physical processes. Full lifecycle assurance applies when systems exhibit an agentic execution feature and act consequentially; in these settings, classical testing no longer covers the full assurance target. Table 1 and the five-dimension taxonomy in Section 6 specify where that coverage breaks. The dividing line is not model size or interface type, but whether the system’s assurance target requires reasoning about sequences of actions, state transitions, and environment feedback rather than about isolated responses.

   These trajectory-level assurance burdens are triggered disjunctively: any one of them can be sufficient to create a validation gap that classical component testing cannot close. That is why a system that exhibits only one of the three canonical agentic properties (persistent state, environment-coupled action, trajectory-level behavior) can still warrant lifecycle assurance if it operates consequentially. The inclusion boundary (I2) therefore remains disjunctive at the corpus level, while the conceptual core of agentic systems remains the canonical case where all three properties hold. The research agenda and gap analysis focus primarily on that canonical case, because that is where the convergence of all five validation dimensions becomes most pressing.

   5 Why Classical SE Testing Assumptions Break

   5.1 Core Assumptions of Classical Testing

   Classical software testing assumes that behavior is sufficiently stable, decomposable, specifiable, and environment-bounded that evidence from unit, integration, regression, and system tests can be composed into a credible judgment about the deployed system. Those assumptions remain valuable for deterministic subsystems, tool wrappers, validators, interfaces, and change control. They stop being sufficient when the system’s relevant behavior is an open-ended action trajectory.

   Each assumption encodes a tacit decomposability claim. Unit testing assumes that function-level correctness composes into system-level correctness. Integration testing assumes that interface contracts are stable enough that component interactions can be verified once and trusted thereafter. Regression testing assumes that prior behavior is a meaningful baseline against which to detect degradation. Specification-based testing assumes that requirements can be expressed as checkable pre- and postconditions. System testing assumes that a bounded set of representative scenarios covers the space of safety-relevant behaviors. Fault injection typically assumes that failures can be injected at identified components and traced through sufficiently bounded interactions. In agentic systems, none of these assumptions holds without qualification, as the structural argument below and the empirical examples below both show.

   5.2 Empirical Mismatch Examples

   Table 4 summarizes the structural mismatch by operationalizing the five abstract mismatches from Table 1 across six familiar testing methods; the fault-injection row is separated as a method-level view of breakdowns that cut across decomposition and environment mismatch rather than as a sixth abstract mismatch. The key empirical point is that the failure is visible in real deployments, not only in abstract argument.

   Table 4: Why classical testing abstractions are insufficient for agentic systems. The six method rows operationalize, rather than extend, the five abstract mismatches in Table 1 , and the table should be read as an author synthesis of the classical testing and agentic-systems assurance literatures discussed in this section and in Section 4 .

   Testing method

   Core assumption

   Why agentic systems break it

   Operational implication

   Unit testing

   Reproducible function behavior

   The same apparent state can induce different reasoning traces, tool calls, and memory updates

   Passing micro-tests does not imply dependable autonomous behavior

   Integration testing

   Stable interfaces and predictable composition

   Tool APIs, retrieval behavior, and orchestration policies evolve during deployment

   Workflow-dependent failures appear after release

   Regression testing

   Prior behavior is a stable baseline

   Memory, model updates, and environment change invalidate historical baselines

   Evidence decays unless refreshed

   Specification-based testing

   Requirements can be stated as complete properties

   Goals such as “escalate appropriately” and “use tools safely” are partial and contextual

   Runtime constraints and scenario evidence become necessary

   System testing

   Representative end-to-end scenarios can be bounded

   Context spans tools, humans, timing, and coordination effects that labs under-approximate

   Safety-critical hazards escape fixed test suites

   Fault injection

   Injected faults can be isolated to bounded components and propagated through tractable interactions

   Breakdowns can cascade across planner, tool, memory, and human couplings and become only partially attributable at component level

   Root-cause analysis becomes trajectory-level and often requires cascade-aware tracing

   Three short examples make the mismatch concrete. In vessel-traffic and smart-mobility settings, superficially similar observations can induce different action sequences because timing, routing context, and human responses alter which trajectory is safe; validating the final maneuver alone misses the path-dependent hazard [ brown2025iccps , lin2025iccps ] . In power and industrial systems, planners that look accurate on nominal scenarios can still fail when stale telemetry, delayed actuation, or tool disagreement shifts the safe operating window [ collaco2026 , sharma2026 ] . In clinical workflows, an agent may produce a plausible recommendation while relying on stale lab data, mis-timed escalation, or incomplete chart retrieval; the clinically salient failure is the trajectory, not the surface plausibility of the endpoint. CPS and clinical studies demonstrate this concretely [ zhao2026 , draelos2026 ] , while expert-monitoring work describes its operational consequence [ expertmonitoring2024 ] .

   5.3 What Still Carries Over

   Classical methods remain essential: component testing, interface contracts, hazard analysis, fault injection, and change control retain their roles, while machine-learning (ML) engineering adds versioning and conservative deployment discipline [ zinkevich2016rules , zhang2020mltesting ] . Testing research provides further methods for the transition [ riccio2020testing , braiek2020testing ] . What changes is their role: each method retains validity within a circumscribed scope, component tests for input–output-stable subsystems, contract tests at API boundaries, Failure Mode and Effects Analysis (FMEA)/Hazard and Operability Study (HAZOP) when scoped to specific tool invocations or handoff points, fault injection targeting tool-call responses and inter-agent messages, and change control for model checkpoints and tool-schema versions. What none of these supplies alone is the composition of component-level assurances into trajectory-level claims. That gap is the entry point for the taxonomy in Section 6 .

   6 A Taxonomy of Validation Dimensions

   We organize the validation problem into five dimensions derived from the primary assurance burdens that recur across the corpus: trajectory quality, bounded safety, persistence of evidence over time, regulatory legibility, and collective behavior under interaction. This taxonomy of validation objects defines what is validated and why; coverage across the literature is examined in Section 7 . Table 5 summarizes the dimensions, their characteristic failure modes, and representative metrics.

   The five dimensions correspond to five recurring questions in the surveyed literature: whether the trajectory is acceptable, whether it stays within risk bounds, whether that judgment remains valid after change, whether the supporting evidence is auditable, and whether local policies compose into acceptable joint behavior. These questions are analytically distinct even when they co-occur in deployment. A system can be behaviorally effective yet unsafe, temporally stale yet still presently auditable, or individually well-behaved yet collectively hazardous. This is why the taxonomy is organized by failure mode rather than by capability list.

   Table 5: Standalone taxonomy of validation dimensions for agentic systems. Each row states a validation object, a characteristic failure mode, general metrics, and a brief example.

   Dimension

   Conceptual definition (validation object + failure mode)

   General measurable metrics

   Brief example

   Behavioral

   Task-level trajectory: action choice, tool sequence, state updates, and recovery under realistic variation. Failure appears as brittle or unjustified behavior across semantically similar situations.

   Task-completion rate; constraint satisfaction; trajectory consistency; recovery success; tool-selection precision/recall; escalation appropriateness.

   A support agent chooses different refund procedures for equivalent complaints, producing inconsistent service outcomes.

   Safety

   Risk boundary for autonomy during error, uncertainty, or interface failure. Failure appears as harmful action, unsafe tool use, or uncontrolled degradation despite nominal competence.

   Unsafe-action rate; near-miss rate; severity-weighted incidents; policy violations; time to safe stop; intervention success.

   A warehouse robot agent routes forklifts into a restricted area after receiving corrupted sensor data.

   Temporal

   Persistence of assurance claims as inputs, tools, policies, and memory evolve. Failure appears as evidence decay after drift, updates, or accumulated history.

   Drift slope; calibration drift; memory contamination; evidence freshness; revalidation interval; post-update regression.

   A rehabilitation-planning agent becomes less reliable after therapy-slot encodings change.

   Regulatory

   Evidence package for traceable, auditable, and governable behavior under external oversight. Failure appears as missing justification for intended use, change control, provenance, or accountability.

   Trace completeness; audit-log coverage; requirement-to-test linkage; provenance completeness; change-impact latency; evidence-backed claims.

   A loan-processing agent cannot reconstruct why it changed a credit recommendation after a model update.

   Multi-agent

   Collective behavior of interacting agents, services, and humans. Failure appears when locally acceptable policies combine into conflict, oscillation, duplication, deadlock, or unsafe delay.

   Coordination success; conflict frequency; deadlock/livelock incidence; duplicated actions; interaction latency; resource contention.

   A delivery-routing agent and an inventory agent issue conflicting shipment instructions, causing delays.

   6.1 Behavioral Dimension

   The behavioral dimension evaluates whether an agent’s realized trajectory is competent, consistent, and justifiable rather than merely whether the final answer looks plausible. The literature shows this from several directions: evaluation surveys establish the gap between outcome scores and trajectory quality [ yehudai2025 , luo2025 ] ; failure-mode studies locate breakdowns in reasoning transitions and tool-invocation sequences rather than in final answers [ mast2025 ] ; data-centric work shows how quality and provenance defects propagate through otherwise plausible traces [ zha2023datacentric , retrievalAugmented2025 ] . Applied pipeline studies confirm the same pattern in production-like settings: orchestration and simulation-optimization studies expose it in automated decision pipelines [ auraAgent2025 , agenticSimheuristic2025 ] , while workflow-generation and monitoring studies observe it in evolving processes [ autoflowgenMultiagent2025 , thresholdtriggeredDeep2025 ] . Domain-adapted deployments supply further evidence [ prismaiDualstage2025 , vtsllmDomainadaptive2025 ] . The characteristic gap is outcome-preserving but procedurally defective behavior.

   The practical implication is that behavioral validation cannot be reduced to measuring task success rates at the endpoint. An agent that achieves the correct final output via an inconsistent, unjustified, or brittle trajectory offers weaker assurance guarantees than one whose intermediate steps are themselves verifiable. This matters most when intermediate tool calls produce external side effects, including database writes, API calls that trigger downstream processes, and escalation decisions that route work to human reviewers, because a procedurally defective trajectory may leave the environment in an inconsistent state even when the final answer appears correct. Trajectory consistency under repeated trials and recovery success after perturbation are therefore first-class behavioral metrics, not secondary proxies, for this dimension.

   6.2 Safety Dimension

   The safety dimension evaluates bounded autonomy: whether the system can avoid harmful actions, unsafe tool use, and uncontrolled degradation under error, uncertainty, or attack. In this survey, Safety is an intentionally aggregated dimension because functional safety and adversarial security both define the action boundary that keeps agent autonomy within acceptable risk limits. Foundational safety work and agent-specific safeguards articulate bounded action [ amodei2016concrete , agentguard2025 ] , whereas adversarial benchmarks and autonomy analyses expose ways those bounds can be crossed [ nemesisAdversarial2025 , autonomousAgents20252 ] . Threat-adaptation and observability studies add operational evidence [ adaptiveThreat2025 , breakingObservability2025 ] , including multilingual and cross-agent attacks [ adversarialMultilingual2025 , crossagentMultimodal2025 ] . The former emphasizes hazard analysis, fail-safe behavior, bounded degradation, and safe-stop or handoff mechanisms; the latter emphasizes prompt injection, tool misuse, privilege escalation, data exfiltration, and adversarial manipulation. Because the corpus skews toward the security-oriented strand, Safety counts should be read as aggregate breadth rather than as uniform maturity across both sub-strands. The underspecified-goal problem, in which agents appear safe while exploiting loopholes in vaguely specified objectives, is documented empirically as specification gaming and is a structural precursor to both safe-stop failures and security policy bypass [ krakovna2020gaming ] . The recurring gap is therefore not just hazard detection, but the specification of safe-stop, defer, or handoff behavior that remains robust under underspecified goals, partial observability, and adversarial interference.

   6.3 Temporal Dimension

   Temporal validation asks whether assurance evidence persists after updates, drift, memory accumulation, workflow change, or benchmark aging. This dimension synthesizes work from dataset shift, MLOps, post-deployment monitoring, and production ML research, all of which show that validation is a moving target rather than a one-time pre-release event. Benchmark-contamination and MLOps studies show that evaluation conditions and models both change over time [ benchcontam2025 , mlops2023 ] ; expert-monitoring and dataset-shift work describe the resulting evidence-maintenance burden [ expertmonitoring2024 , quionero2009dataset ] . Production-ML research supplies the complementary account of hidden technical debt and operational regression [ sculley2015hidden , breck2017ml ] , including rules for dependable deployment [ zinkevich2016rules ] . Its central failure mode is evidence decay: a system once judged acceptable no longer merits the same claim after its operating context changes.

   This dimension is especially consequential for agentic systems because many of their assurance claims are path-dependent rather than purely input–output based. A benchmark score or pre-deployment test result may look stable even while the underlying trajectory-generating process has changed: memory may accumulate stale assumptions, retrieved evidence may shift in quality or provenance, tool interfaces may silently change their semantics, and escalation behavior may drift as surrounding workflows adapt. Three channels recur: memory or retrieved-context drift, tool-version and schema change, and environment or workload shift. In each case, a release-time claim can become stale without the system ever failing a release-time test.

   Temporal adequacy therefore requires explicit evidence-expiry conditions: what kinds of change invalidate prior claims, which traces or monitoring signals count as sufficient warning, and what revalidation scope follows. Without that linkage, monitoring remains observational rather than normative, able to report change, but not to determine when a previously accepted deployment is no longer adequately validated. Section 9 develops this as a lifecycle-assurance direction.

   6.4 Regulatory Dimension

   The regulatory dimension evaluates whether validation evidence is traceable, reviewable, and governable under external oversight. This is where audit trails, provenance, requirement-to-evidence linkage, change control, and post-market processes become part of the validation target rather than administrative afterthoughts. FDA documents articulate lifecycle evidence and good machine-learning practice [ fda-action-plan , fda-gmlp ] , and FDA’s AI-device guidance makes change control central [ fda-aiedsflm2025 ] . MDCG guidance provides the parallel European perspective [ mdcg2025-6 , mdcg2025-10 ] , while the EU MDR and IEC situate it in wider oversight practice [ eu-mdr , iec62304 ] , with IEEE guidance adding a further reference point [ ieeeguide2025 ] . Assurance and evidence-design studies show how these requirements can be made reviewable [ alelyani2025 , assurancedrivenDesign2025 ] , with concise agentic proposals extending the argument [ shortPaper2025 ] . The gap repeatedly exposed in the corpus is that even technically strong systems often lack an evidence package that can be reconstructed and defended after deployment changes or incidents.

   This gap has a structural cause: regulatory evidence requirements are typically defined at system release, but agentic systems continue to evolve as model updates, tool schema changes, retrieval corpus refreshes, and policy revisions accumulate after the initial evidence package is assembled. Maintaining regulatory legibility therefore requires not only that the release-time evidence is complete and traceable, but also that a change-impact assessment process exists to determine when a post-release change is material enough to require evidence re-submission or re-evaluation. The FDA’s good machine learning practice guidance and the MDCG position papers on adaptive AI both identify this as an open operational challenge, and the corpus confirms that most technical validation frameworks address it incompletely if at all. The implication for this dimension is that audit-log coverage and provenance completeness must be treated as runtime properties maintained continuously, not as documentation artifacts assembled at release and left static thereafter.

   6.5 Multi-Agent Dimension

   The multi-agent dimension evaluates the joint trajectory produced by interacting agents, services, and humans. It is structurally distinct from single-agent validation because acceptable local policies can still compose into conflict, deadlock, duplication, delay, or distributed risk. Benchmark and failure-mode evidence documents these compositional breakdowns directly [ multiagentbench2025 ] ; work on cooperation and coordination mechanisms shows how they arise from interaction structure rather than from agent-level defects. Collaborative and mean-field analyses relate failures to interaction structure [ collaborativeMultiagent2025 , meanfieldDeep2025 ] ; cooperative learning and strategic-interaction work identifies further coordination mechanisms [ efficientCooperative2025 , strategicLearning2025 ] , including explicit coordination models [ multiagentCoordination2025 ] . Studies of LLM-based frameworks and role design confirm the pattern in contemporary stacks [ frameworkbasedMultiagent2025 , multiagentLlm2025 ] , at increasing organizational scale [ harnessingMultiagent2025 , analysingRole2025 ] , and in scientific multi-agent settings [ scienceScaling2025 ] . The joint trajectory, not any component in isolation, is therefore the proper validation object.

   This makes the dimension asymmetric with the other four in a basic sense: behavioral, safety, temporal, and regulatory concerns all apply to single-agent systems as well, whereas multi-agent validation exists only once assurance claims depend on relations among multiple decision makers. The distinctive burden here is therefore not merely to add more agents to an existing validation frame, but to validate interaction-level properties, including coordination, delegation, conflict resolution, and joint accountability, that do not arise in isolated-agent settings.

   The structural challenge is that emergent coordination failures cannot generally be predicted from single-agent test results: an agent whose individual behavior is within specification may still produce unsafe outcomes when coupled with other agents whose policies interact with its own in unanticipated ways. Shared resource contention, implicit assumptions about message ordering, and uncoordinated escalation are recurring examples in the corpus. Validating this dimension therefore requires test scenarios that exercise inter-agent interactions explicitly, including adversarial compositions in which one agent’s well-intentioned action is precisely the trigger that causes another’s policy to fail. Blame resolution and causal attribution in such settings are particularly difficult because the observable failure may occur far removed from its initiating cause, both temporally and across a chain of interacting agents.

   6.6 Dimension Intersections and Relation to Prior Surveys

   The most consequential failures often lie at dimension intersections: behavioral × \times safety yields competent-but-dangerous trajectories; temporal × \times regulatory yields stale but still-claimed evidence; and multi-agent interaction amplifies both behavioral and safety hazards through coordination breakdowns [ sambasivan2021cascades ] . For behavioral × \times safety, a concrete failure mode is an agent that competently completes its assigned task while choosing an unsafe tool sequence or escalation path: the behavior is goal-effective, yet the trajectory violates the safety boundary precisely because competence and constraint satisfaction come apart. For temporal × \times regulatory, a concrete failure mode is a system whose release-time evidence package remains formally on file even after tool semantics, retrieved knowledge, or escalation workflows have changed, so the deployment still appears compliant while the evidential basis for that claim has already expired. Relative to existing surveys, our taxonomy differs by organizing the field around these validation objects rather than around capabilities or application domains. luo2025 and yehudai2025 foreground evaluation gaps but do not make temporal validity or regulatory legibility first-class dimensions; zhao2026 captures safety and governance pressures in healthcare but does not generalize them as a cross-domain taxonomy.

   7 Survey of Existing Approaches

   This section maps concrete validation approaches onto the five taxonomy dimensions and identifies robust coverage gaps in the coded corpus (RQ3). Unlike Section 3 , which positions adjacent literatures, the emphasis here is evidentiary: which approaches cover which validation objects, and where durable asymmetries remain.

   7.1 Behavioral Validation

   Behavioral validation is the most developed dimension in the current literature. Benchmarks such as SWE-bench and ITBench, LLM-as-judge methods, and newer multi-agent suites have made capability measurement substantially richer, but the dominant target remains task success or broad process scoring rather than whether trajectories remain acceptable, consistent, and stable across semantically equivalent cases. SWE-bench and ITBench establish software-engineering task performance [ swerebench2025 , itbench2025 ] , while LLM-as-judge and process-scoring methods broaden the measurement toolkit [ llmjudge2025 , costar2025 ] . Assessment frameworks offer further general evaluation designs [ assessmentFramework2025 , unifiedEvaluation2025 ] . Multi-agent and interactive suites extend coverage to coordination and environments [ multiagentbench2025 , mast2025 ] , including AgentVerse and Tau-bench [ agentverse2023 , taubench2024 ] . Benchmark-aging work qualifies the durability of those scores [ liang2022helm ] . Across domains, the pattern is the same: behavioral evaluation is broad in coverage but shallow in what it guarantees, because outcome scores scale more readily than trajectory auditing.

   This limitation is visible even in the strongest contemporary benchmark families. AgentBoard, TheAgentCompany, and AgentHarm extend behavioral evaluation toward multi-turn interaction, consequential workflows, and harmful-action measurement, yet they still stop short of specifying lifecycle criteria for whether trajectories remain acceptable under change, handoff, or tool failure. AgentBoard and TheAgentCompany expose the interaction and workflow dimensions [ agentboard2024 , theagentcompany2025 ] , while AgentHarm measures harmful-action exposure [ agentharm2024 ] . The same pattern recurs across domains: in clinical orchestration [ autonomousAgentic2025 ] , software engineering benchmarks and analyses [ evaluatingSoftware2025 , bib:beyondchatbox ] , and plan-execute-generate-judge pipelines [ planexecutegeneratejudgeSelf2025 ] , cybersecurity [ agenticSecurity2025 , benchmarkingOffensive2025 ] , and finance and logistics [ ablLlmbased2025 , smartopsDemand2025 ] , outcome scores do not expose intermediate-step inconsistencies, tool-use brittleness, or non-deterministic plan selection. Broader evaluations of agent-based and generative deployments report the same asymmetry [ evaluatingAgentbased2025 , overviewGenai2025 ] , including autonomous-agent deployments [ autonomousAgents2025 ] , and failure-analysis studies locate the breakdowns specifically in reasoning transitions and tool-invocation sequences rather than in final answers [ exploringAutonomous2025 , confidentBut2025 ] . Dynamic suites such as RefuteBench 2.0 and AutoONBench probe consistency under perturbation [ refutebenchAgentic2025 , autoonbenchBenchmark2025 ] . Agent-drift studies track degradation over repeated interaction [ agentDrift2025 , limitsVerification2016 ] , including in self-evolving settings [ agenticSelfevolving2025 ] ; trajectory-level auditing is nevertheless not a standard behavioral-validation requirement.

   7.2 Safety Validation

   Safety validation is active but fragmented. As Section 6 noted, the Safety column aggregates functional-safety and adversarial-security work; in the approaches layer, most recent density comes from prompt injection, misuse containment, and runtime enforcement rather than explicit safe-stop or graceful-degradation design. RTBAS and G-Safeguard exemplify runtime enforcement [ rtbas2025 , gsafeguard2025 ] , whereas AgentGuard and foundational safety work motivate bounded autonomy [ agentguard2025 , amodei2016concrete ] . Partial progress comes from tool-use containment through access control, semantic gating, defense-in-depth architectures, and uncertainty-driven monitoring. MCP security and semantic gating constrain tool use [ mcpsecureRuntime2025 , adaptiveSemantic2025 ] ; defense-in-depth and uncertainty monitoring add complementary controls [ multilayeredSecurity2025 , uncertaintydrivenMonitoring2025 ] . From verifiable safeguards and safety-requirement derivation. Explainable and unified-safeguard approaches make local controls inspectable [ explainableVerifiable2025 , agentsafeUnified2025 ] ; security and assurance frameworks translate them into broader claims [ securityFramework2025 , safetyAssurance2025 ] . Safety-requirement derivation and calibration work address the specification side [ derivingSafety2025 , kadavath2022knowing ] , with debate-based approaches providing a related mechanism [ debate2025 ] . Multimodal and multi-agent defenses broaden the threat coverage [ multimodalFramework2025 , unifiedFramework2025 ] ; runtime resonance and moderation systems add operational controls [ resonateRuntime2025 , agenticModeration2025 ] , alongside cybersecurity-focused defenses [ bib:cybersecurity ] .

   The remaining gap is not intervention in general, but a unified specification for safe-stop, graceful degradation, and reviewable evidence generation across diverse agent architectures and toolchains. Even systems such as RTBAS, G-Safeguard, and AgentGuard treat agents as intervenable information-flow systems: RTBAS and G-Safeguard provide runtime controls [ rtbas2025 , gsafeguard2025 ] , and AgentGuard extends them to agentic execution [ agentguard2025 ] . They still leave open how deployments should hand off, roll back, or degrade when confidence collapses, or safeguards disagree.

   7.3 Temporal and Lifecycle Validation

   Temporal validation remains the least consolidated dimension: temporal concerns attract substantial paper volume, but no mature, agent-specific validation family yet anchors them. Benchmark-contamination work shows that static suites age, while MLOps, CPS, and regulatory literatures show that deployed systems require evidence maintenance, change control, and post-deployment monitoring rather than one-time benchmark results. Benchmark contamination and MLOps work show why one-time scores become stale [ benchcontam2025 , mlops2023 ] ; expert monitoring and dataset-shift research identify the signals that should prompt renewal [ expertmonitoring2024 , quionero2009dataset ] . Hidden-debt and production-ML studies explain the operational sources of this decay [ sculley2015hidden , breck2017ml ] , while FDA and MDCG guidance makes the resulting change-control obligation explicit [ fda-pccp2025 , mdcg2025-10 ] . What is still missing is operationalization for agentic systems: what to monitor, when to revalidate, and how to refresh evidence when memory, tools, or workflows change.

   Recent work makes this gap concrete without closing it. Agent-drift and long-horizon studies show degradation over repeated interaction or after many locally acceptable steps [ agentDrift2025 , memoryt1Reinforcement2025 ] , including explicitly temporal agent settings [ agenticTemporal2025 ] . MLOps monitoring detects performance change, feature drift, and retraining triggers, but usually assumes stable prediction targets rather than open-ended policies that evolve through tool use, interaction, and memory adaptation. Observability and monitoring-maintenance frameworks provide the core instruments [ observabilityFramework2025 , maintainingMonitoring2025 ] ; anomaly and reliability studies address their operational use [ yourAnomaly2025 , improvingReliability2025 ] , alongside model-updating methods [ bib:updatingml ] . Agent-specific harnesses and protocols increasingly treat lifecycle change as expected [ ahe2026 , autogenesis2026 ] , and CPS work connects temporal validity to control loops, delays, and operational constraints [ collaco2026 , zhao2026 ] , as also shown by digital-twin work [ veledar2019dt ] . The core temporal gap is therefore the missing bridge between observability and obligation: when a tool-schema revision invalidates earlier evidence, when memory contamination requires a fresh evaluation window, or when monitored drift becomes assurance failure.

   7.4 Regulatory and Assurance Approaches

   The regulatory dimension is addressed primarily by governance and assurance-case frameworks rather than technical methods. FDA guidance makes lifecycle evidence and change control explicit [ fda-aiedsflm2025 , fda-pccp2025 ] , while MDCG guidance supplies the European counterpart [ mdcg2025-6 , mdcg2025-10 ] . IEEE guidance and assurance-case methods provide structured argumentation [ ieeeguide2025 , alelyani2025 ] , but the engineering implementation remains underspecified for agentic systems. Put concretely, the surveyed governance documents are comparatively clear about the evidentiary requirements, such as traceability, change control, post-market evidence, and reviewable justification. However, they are far less specific about how an agentic system should operationally package trajectory evidence, monitoring outputs, override records, and revalidation triggers into a reviewable evidential payload. Mature argument patterns already exist across regulated domains, autonomous inspection, unmanned aircraft, spacecraft, automotive systems, and safety-critical machine learning. Reference patterns and interlocking-safety work establish reusable assurance structures [ patternsReference2025 , interlockingSafety2025 ] ; software and formal assurance-case studies carry them into regulated engineering [ softwareAssurance2025 , assuranceCase20252 ] . Automotive and security applications demonstrate domain transfer [ applicationAutomotive2025 , quantitativeSecurity2025 ] , including for safety-critical machine learning [ assuranceAimlbased2025 ] . A second body of work makes the assurance stack more operational through automated case management and continuous assurance [ automatedModelbased2025 , continuousDeployment2025 ] , model-risk governance and policy pipelines [ modelRisk2025 , policyPipeline2025 ] , and automated interpretation [ automatedInterpretation2025 ] . Governance-oriented analyses extend the picture to liability and decentralized accountability [ liabilityProblem2025 , decentralizedGovernance2025 ] , and agentic-specific assurance proposals begin to translate these obligations toward agent deployments. Reliability-by-design and safety-landscape studies make this move explicitly [ reliabilitybydesignAgentic2025 , landscapeSafety2025 ] ; agentic assurance cases and holistic frameworks extend it [ assuranceCase2025 , holisticAssurance2025 ] , alongside broader assurance-case work [ bib:assurancecase ] . All of these still stop short of specifying the trajectory-evidence bundle for open-ended agentic systems.

   7.5 Multi-Agent Validation

   Multi-agent validation is emerging but still immature. Benchmarks, failure-mode studies, and runtime monitoring now provide useful data on interaction quality, yet they do not yield compositional validation certificates for open-ended LLM coordination. MultiAgentBench and MAST measure coordination outcomes and failure modes [ multiagentbench2025 , mast2025 ] , while G-Safeguard supplies a runtime perspective [ gsafeguard2025 ] . Formal verification and distributed-systems work provides candidate compositional methods [ verifyingMulti2025 , formalizingDistributed2025 ] , including engineering and multilevel protocol approaches [ engineeringMultiagent2025 , multilevelProtocol2025 ] . Classical coordination frameworks offer additional precedents [ camel2023 , bib:auctionmas ] , with recent design work extending them [ dawnDesigning2025 ] . Recent evidence from asynchronous software-engineering agents makes the same point in a practically important setting: coordination quality depends on delegation structure, synchronization discipline, and handoff management, not only on single-agent competence [ caid2026 ] . Classical multi-agent systems (MAS) verification remains methodologically relevant but only partially transferable because LLM-based agents operate over open-ended natural language and learned policies rather than bounded programs and finite vocabularies. The central gap is therefore structural: the challenge is not merely to test more agents, but to certify interaction-level properties that emerge only at the system level.

   Supporting evidence converges from three further directions. Studies of collaborative planning, auction-based allocation, and decentralized coordination show that individually competent agents still produce oscillation, deadlock, or degraded joint behavior. LLM and reactive-coordination studies document these effects [ canLlm2025 , reactiveMultiagent2025 ] , as do behavior-tree approaches [ behaviorTree2025 ] . Trust modeling and role-specialized traceability improve partner selection and post-hoc auditability without yielding compositional guarantees. Task-specific and contextual trust models improve partner selection [ taskspecificTrust2025 , contextualTrust2025 ] ; traceability and comparative studies improve auditability [ traceabilityAccountability2025 , comparativeSurvey2025 ] , including in scientific scaling settings [ scienceScaling2025 ] . And digital-twin simulation together with cascade-aware analysis supplies the substrate on which interaction-level hazards can be exercised before deployment [ veledar2019dt , sambasivan2021cascades ] . The common conclusion is that collective failures and interaction-level hazards cannot be inferred from single-agent scores alone.

   Table 6: Coverage gap matrix across approach families and evaluation dimensions. Higher-intensity cells indicate denser coverage, while low-intensity cells highlight approach–dimension gaps.

   Table 7: How the two counting layers used in the paper relate to each other: paper-level primary-dimension counts (single label, total 257) and gap-matrix appearance counts (multi-label over approach families and dimension tags, total 360).

   Counting layer

   Behavioral / Safety / Temporal / Regulatory / Multi-agent

   Total

   What is being counted

   Primary dimension (paper-level; single label)

   71 / 42 / 62 / 32 / 50

   257

   Each included paper carries exactly one primary dimension under the frozen codebook; these counts ground all paper-level claims, the year-band composition in Figure 2 , and the sensitivity bounds in Table 2 . Reported in Section 2.6 .

   Gap-matrix coverage (approach-family × \times dimension-tag appearances; multi-label on both axes)

   120 / 85 / 40 / 70 / 45

   360

   Appearance counts used for the coverage matrix in Table 6 : a paper may contribute to several approach-family cells and, through secondary dimension tags, to more than one dimension column. The six approach families are not exhaustive, so papers whose approach fits none of them contribute no appearances. The matrix therefore measures coverage intensity, not unique-paper frequency; the sensitivity analysis in Table 2 applies to the paper-level primary-dimension counts, not to this multi-label appearance layer.

   Table 7 clarifies that the paper-level counts assign one primary dimension to each of the 257 papers, whereas Table 6 counts multi-label approach-family appearances. The latter therefore measures coverage intensity, not unique-paper frequency. On this reading, behavioral validation is strongest on both layers: 71 primary papers (27.6%) and 120 appearances, including 68 in benchmark-centric evaluation. Safety accounts for 42 primary papers (16.3%) but 85 appearances, with runtime monitoring as the clearest concentration and with the functional-safety/security split noted above. Temporal validation diverges most sharply: it is the second-largest primary category (62 papers, 24.1%) but produces only 40 coverage appearances, with no temporal cell above medium intensity. Regulatory evidence shows the opposite profile: 32 primary papers (12.5%) but 70 appearances in governance and assurance-case work, and multi-agent validation remains under-covered on both layers (50 primary papers, 19.5%; 45 appearances). Overall, the matrix supports the same directional claim as the sensitivity analysis: behavioral instruments are relatively strong, while lifecycle evidence decay, compositional multi-agent assurance, and audit-ready governance remain weaker.

   8 Illustrative Case Studies Across Operational Domains

   The five-dimension taxonomy is domain-general, but its force is clearest when applied to deployment settings where agentic systems already act consequentially. We present three parallel case studies, namely medical care delivery, industrial operations, and smart-mobility CPS, as matched illustrations of the same validation pressures. Each surfaces heterogeneous tool use, temporally evolving evidence, safety-critical intervention, human override, and operational accountability. CPS and clinical case studies establish the basic pattern [ collaco2026 , zhao2026 ] ; industrial and healthcare work extends it to deployed workflows [ sharma2026 , draelos2026 ] . ICCPS studies provide complementary evidence on closed-loop systems [ lin2025iccps , brown2025iccps ] . The recurrence of the five validation questions across these domains indicates a deployment-level structure.

   Each case study is grounded in the reviewed literature and pairs the dimension mapping with a constructed trajectory trace: a step-by-step walkthrough using the per-step ( s t , a t , m t ) (s{t},a{t},m{t}) notation from the trajectory τ = ( ( s 0 , a 0 , m 0 ) , … , ( s T , a T , m T ) ) \tau=((s{0},a{0},m{0}),\dots,(s{T},a{T},m_{T})) defined in Section 4 , consistent with the failure patterns documented in the cited deployment and failure studies . The constructed traces show where each latent defect would be intercepted and by which monitor. As illustrative operational constructions, they make the taxonomy’s dimensional structure concrete at step granularity; they are not incident reports or independent empirical evidence. The reviewed literature shows that components can pass their local tests while the trajectory as a whole fails.

   8.1 Metric Definitions for the Case Studies

   Three metrics appear throughout the illustrative case studies and policy vignettes. All are operationally defined by the papers cited in the taxonomy section; they are reproduced here to clarify the numerical statements in the traces that follow.

   Table 8: Operational definitions of three illustrative metrics used in case-study traces. These definitions are derived from the taxonomy discussion in Section 6 ; the thresholds shown in the case studies (Section 8 ) are example policy values, not empirical benchmark results.

   Metric

   Definition

   Evaluation window and interpretation

   Evidence Freshness Interval (EFI)

   Time elapsed since the last refresh of a data source (e.g., laboratory panel, sensor reading, or retrieved evidence) used in a trajectory decision. Measured in minutes or hours from the source’s timestamp to the decision point.

   Evaluation window: from source creation to decision time. Interpretation: if EFI exceeds a policy-specified freshness limit (e.g., 60 minutes for medication-relevant labs), the decision is flagged or blocked until the source is refreshed. Example threshold: EFI = 105 ​ min > 60 ​ min policy limit =105,\text{min}>60,\text{min policy limit} → \rightarrow block .

   Unsafe-Action Rate (UAR)

   Proportion of executed actions (typically tool invocations or control commands) within a session or trajectory that violate safe-operating constraints or authorization policy. Numerator: count of unsafe actions. Denominator: total actions executed in the window.

   Evaluation window: rolling window over the current session or trajectory (typically 10–100 steps). Interpretation: if UAR exceeds a threshold (e.g., 0.02 for safety-critical systems), containment or rollback is triggered. Example threshold: UAR = 0.08 > 0.02 ​ plant threshold =0.08>0.02,\text{plant threshold} → \rightarrow block .

   Coordination Success Rate (CSR)

   Proportion of inter-agent or human–agent handoff events that complete without conflict, deadlock, or timeout. Numerator: count of conflict-free transitions. Denominator: total handoff events attempted in the evaluation window.

   Evaluation window: rolling count of handoffs in the current session or deployment period. Interpretation: if CSR falls below a threshold (e.g., 0.95 for safety-critical coordination), escalation is triggered to reduce the coordination load or involve human oversight. Example threshold: CSR = 0.91 < 0.95 =0.91<0.95 (deployment threshold) → \rightarrow flag .

   Note on illustrative thresholds. The numerical examples in the metric definitions above (60 minutes, 0.02, 0.95) are representative policy-threshold values used only in the illustrative case-study traces. They are not empirical results from agentic-system benchmarks and should not be interpreted as recommendations for real deployments. Each operational context requires calibration of these thresholds based on risk tolerance, domain constraints, and deployment-specific data.

   8.2 Medical Care Delivery

   A representative deployment target in the surveyed corpus is postoperative nursing support with LLM-agent systems, where agents assist observation, follow-up, and coordination around postoperative care workflows [ parallelNursing2025 ] . The most directly documented failure evidence comes from Draelos et al., who show that large language models can provide unsafe answers to patient-posed medical questions, including advice that is clinically unsafe or insufficiently escalatory for the presenting condition [ draelos2026 ] . While Draelos et al. examine LLM responses rather than full agentic trajectories, their findings document unsafe and insufficiently escalatory response patterns. In the constructed trace below, we treat those response-level failures as local breakdowns that an agentic clinical deployment could amplify through retrieval, escalation, and follow-up. The stale-evidence step is an illustrative trajectory-level risk motivated by clinical workflow coupling rather than a direct incident reported by Draelos et al. In the five-dimension structure, this failure is behavioral because similar symptom descriptions can produce different advice trajectories; safety because the recommendation itself can be unsafe; temporal because the correctness of the advice depends on whether medication lists, recent vitals, or symptom progression are still current; regulatory because any recommendation that affects care requires reviewable justification; and multi-agent because the effective outcome depends on coordination across the agent, electronic health record (EHR) tools, nursing staff, physicians, and pharmacy. Zhao et al. likewise characterize healthcare agents as operating in tightly coupled socio-technical loops rather than as isolated predictors. Clinical and expert-monitoring studies motivate these indicators [ zhao2026 , expertmonitoring2024 ] ; taxonomic and knowledge-action work specifies related measures [ bib:seventax , knowledgeAction2025 ] , including convenient human-facing designs [ empoweringConvenient2025 ] . The validation lesson is that clinical usefulness cannot be separated from freshness, escalation timing, and documented responsibility for action.

   Table 9 makes the mapping operational through a constructed postoperative-support trajectory. Every component in this trace can pass its local tests; the retrieval API returns well-formed records; the classifier meets its accuracy target on its test distribution; the generated message is fluent, while the trajectory as a whole is unsafe. Each latent defect is intercepted, if at all, by a different dimension, and the first interception (the freshness breach at t 1 t{1} ) precedes the clinically dangerous step at t 3 t{3} : trajectory-level validation matters precisely because it can stop a defective episode before its consequential action.

   Table 9: Constructed trajectory trace for the medical case study, consistent with the response-level failure patterns documented in [ draelos2026 ] and the socio-technical coupling described in [ zhao2026 ] . Each row is one step ( s t , a t , m t ) (s{t},a{t},m_{t}) ; the final column names the taxonomy dimension and monitor signal that intercepts the defect. Thresholds are illustrative policy values, not reported benchmark results.

   t t

   Trajectory event ( s t , a t , m t ) (s{t},a{t},m_{t})

   Latent defect

   Dimension → \rightarrow signal and outcome

   0

   Patient message reports a new post-operative symptom; the agent opens a session and initializes state s 0 s_{0} .

   —

   —

   1

   Agent retrieves chart and laboratory data via the EHR tool; m 1 m_{1} records that the renal panel timestamp is 105 minutes old.

   Freshness policy for medication-relevant decisions is 60 minutes.

   Temporal → \rightarrow EFI = 105 > 60 =105>60 min: block pending refresh.

   2

   Planner classifies the report as routine discomfort; a replay run with a semantically equivalent phrasing yields a different classification.

   Trajectory inconsistency under paraphrase.

   Behavioral → \rightarrow consistency check on replayed trajectories: flag .

   3

   Agent drafts medication-adjustment advice and does not escalate to clinical staff.

   Advice insufficiently escalatory for the presenting differential, the pattern documented in [ draelos2026 ] .

   Safety → \rightarrow escalation-appropriateness rule: escalate .

   4

   Memory update logs the episode as resolved without linking the advice to the chart snapshot used.

   Decision rationale not reconstructable.

   Regulatory → \rightarrow trace-completeness audit: flag .

   5

   Follow-up task enters the nursing queue with low priority and misses the shift handover.

   Mistimed coordination between agent and care workflow.

   Multi-agent → \rightarrow handoff-latency monitor: escalate .

   8.3 Industrial Operations

   A representative industrial target is multi-agent support for commissioning and troubleshooting industrial drives, where specialized agents coordinate diagnosis steps, parameter checks, and operator-facing recommendations during equipment setup and fault analysis [ driveaiagentMultiagent2025 ] . The five-dimensional structure recurs end to end: behavioral , because similar fault signatures can trigger different diagnostic decompositions or recovery plans; safety , because an incorrect recommendation can propagate into unsafe actuator settings or ill-timed restart advice; temporal , because telemetry, maintenance history, and machine state can drift while the troubleshooting loop is still running; regulatory , because industrial interventions require a reconstructable rationale for why a suggested action was issued; and multi-agent , because the outcome depends on coordination across specialized software agents, plant-control tools, operators, and the physical asset itself. Recent industrial AI-drift and uncertainty work reinforces this mapping: changing operating regimes and limited supervision undermine the validity of learned decision support if monitoring and recalibration are not built into the loop. Connection and boundary-aware approaches motivate this integration [ connectionBetween2025 , boundaryawareConcept2025 ] , and CPS deployment studies demonstrate its need [ collaco2026 , sharma2026 ] . Here the important shift is from evaluating whether a recommendation looks plausible to evaluating whether it remains safe and accountable while plant state, operators, and controllers continue to change.

   Table 10 traces a constructed commissioning episode. The trace makes the drift literature concrete: the defect introduced at t 1 t{1} is temporal, but its consequential expression at t 3 t{3} is a safety violation, and the only dimension that explains the duplicated restart at t 4 t_{4} is multi-agent coordination. A validation regime checking any single dimension would have caught one defect and missed the episode.

   Table 10: Constructed trajectory trace for the industrial case study, consistent with the multi-agent drive-commissioning setting of [ driveaiagentMultiagent2025 ] and the industrial drift and uncertainty findings of [ connectionBetween2025 , boundaryawareConcept2025 ] . Thresholds are illustrative policy values.

   t t

   Trajectory event ( s t , a t , m t ) (s{t},a{t},m_{t})

   Latent defect

   Dimension → \rightarrow signal and outcome

   0

   An intermittent overcurrent fault is reported during drive commissioning; the diagnostic session opens.

   —

   —

   1

   Telemetry tool returns a cached parameter snapshot predating a recent firmware update; m 1 m_{1} records the snapshot version.

   Tool output reflects a superseded machine configuration.

   Temporal → \rightarrow evidence-version check: flag .

   2

   Planner decomposes the diagnosis; a replay of the same fault signature yields a different tool-invocation order.

   Non-deterministic decomposition of an identical fault state.

   Behavioral → \rightarrow tool-sequence consistency under replay: flag .

   3

   Agent recommends raising the current limit and issuing a restart; the session’s unsafe-action rate over actuator-setting recommendations reaches 0.08.

   Recommendation violates the post-update safe operating envelope.

   Safety → \rightarrow UAR = 0.08 > 0.02 =0.08>0.02 plant threshold: block .

   4

   The thermal-monitoring peer agent is not consulted; a duplicated restart instruction is issued through a second channel.

   Conflicting inter-agent instructions to the same asset.

   Multi-agent → \rightarrow duplicated-action detector: flag .

   5

   Operator accepts the remaining suggestion; the log does not link the recommendation to the telemetry version that produced it.

   Audit cannot reconstruct why the action was issued.

   Regulatory → \rightarrow provenance-completeness audit: flag .

   8.4 Smart-Mobility CPS

   A representative mobility-side target is highway safety monitoring with multimodal agentic systems, where an agent consumes heterogeneous road, sensor, and situational signals to decide whether to flag hazards, request intervention, or prioritize follow-up analysis [ multimodalAgentic2025 ] . The validation issues again map cleanly onto five dimensions: behavioral , because small changes in perception inputs can alter downstream interpretations and recommended responses; safety , because missed or spurious hazard classification directly affects roadway risk; temporal , because the validity of a decision depends on whether traffic state, weather, and map context are still current; regulatory , because public-safety actions need inspectable justification and replayable evidence; and multi-agent , because the effective behavior is distributed across perception modules, runtime monitors, infrastructure services, and human supervisors. CPS work on out-of-distribution safety monitoring and perception-based quantitative runtime verification treats smart-mobility assurance as a runtime problem rather than a pre-deployment benchmark problem. ICCPS studies describe the closed-loop requirement [ lin2025iccps , brown2025iccps ] , and digital-twin work provides a complementary account [ veledar2019dt ] . This makes mobility the clearest reminder that locally sensible steps can still compose into globally unsafe behavior when timing, coordination, and intervention logic are wrong.

   Table 11 traces a constructed fog-onset episode. It differs from the previous two traces in that the earliest signal ( t 1 t_{1} ) is already an escalation trigger: runtime out-of-distribution monitoring is the most mature instrument in this domain [ lin2025iccps , brown2025iccps ] , yet the trace still accumulates four further defects that OOD monitoring alone does not see. Maturity in one dimension does not substitute for the others.

   Table 11: Constructed trajectory trace for the smart-mobility case study, consistent with the multimodal highway-monitoring setting of [ multimodalAgentic2025 ] and the runtime-assurance instruments of [ lin2025iccps , brown2025iccps ] . Thresholds are illustrative policy values.

   t t

   Trajectory event ( s t , a t , m t ) (s{t},a{t},m_{t})

   Latent defect

   Dimension → \rightarrow signal and outcome

   0

   Highway monitoring agent ingests camera and roadside-sensor feeds as fog develops over a monitored segment.

   —

   —

   1

   Perception confidence degrades; the out-of-distribution score rises and persists; m 1 m_{1} logs the monitor output.

   Inputs are leaving the validated operating domain.

   Safety → \rightarrow OOD-persistence monitor: escalate .

   2

   Agent classifies the obstruction as low-priority debris; a near-identical scene in replay is classified as a hazard.

   Timing-dependent divergent interpretation of similar scenes.

   Behavioral → \rightarrow consistency under scene perturbation: flag .

   3

   The deferral decision relies on a map layer older than its freshness bound.

   Stale context informs a safety-relevant deferral.

   Temporal → \rightarrow map-freshness check: flag .

   4

   Handoff to the infrastructure service misses its latency budget; the session’s conflict-free handoff rate falls to 0.91.

   Coordination below the deployment threshold.

   Multi-agent → \rightarrow CSR = 0.91 < 0.95 =0.91<0.95 : flag .

   5

   Escalation eventually occurs, but the inputs that drove the earlier deferral are not replayable for review.

   Intervention record not legible to oversight.

   Regulatory → \rightarrow audit-replay check: flag .

   8.5 Cross-Domain Summary

   Table 12: Cross-domain summary of the five validation dimensions.

   Dimension

   Medical

   Industrial

   Smart Mobility

   Behavioral

   Divergent tool-use and escalation trajectories for similar patient states

   Similar process states can trigger brittle planning or actuator sequencing

   Similar traffic scenes can produce unsafe trajectory choices under different timing assumptions

   Safety

   Unsafe recommendations, delayed holds, or missed escalation affect care

   Wrong sequencing or delayed intervention can damage equipment or violate limits

   Navigation, routing, or handoff errors create system-level risk

   Temporal

   Labs, device feeds, and orders age asynchronously

   Telemetry, controller state, and maintenance context drift during execution

   Sensor latency, map freshness, and traffic evolution alter safe decisions over time

   Regulatory

   Clinical interventions require traceable justification and reviewability

   Audits require change traceability, incident reconstruction, and operator accountability

   Public-safety actions require legible intervention records

   Multi-agent

   Outcomes depend on coordination among agent, EHR tools, clinicians, and pharmacy

   Agent, control tools, operators, and plant infrastructure form one coupled loop

   Safety emerges from coordination among agents, platforms, infrastructure, and supervisors

   Illustrative policy vignettes. Medical: EFI = 105 =105 min against a 60-min limit → \rightarrow block . Industrial: UAR = 0.08 =0.08 against a threshold of 0.02 0.02 → \rightarrow block . Smart mobility: CSR = 0.91 =0.91 against a threshold of 0.95 0.95 → \rightarrow flag . These values are illustrative policy examples rather than reported benchmark results; they correspond to the threshold breaches at t 1 t{1} , t 3 t{3} , and t 4 t_{4} of the worked traces in Tables 9 – 11 .

   Across all three domains, the common pattern is that the agent is not an isolated predictor but a participant in a closed-loop socio-technical system. Failures emerge from stale evidence, unsafe intermediate actions, mistimed escalation, and coordination breakdowns, precisely why behavioral, safety, temporal, regulatory, and multi-agent validation must be addressed together rather than as separate checklists. The trajectory, not the final output, is the unit at which the relevant failure modes become visible. The worked traces (Tables 9 – 11 ) make this concrete in a second way: the medical and industrial traces are both first intercepted by a temporal signal, yet only in the industrial trace does that stale-evidence defect go on to express itself as a downstream safety violation, while the mobility trace is instead intercepted first by runtime safety monitoring; no single instrument dominates across domains. The policy vignettes in Table 12 show how the same thresholds convert dimension signals into actionable outcomes such as block, flag, or escalate. What the case studies add beyond the taxonomy alone is cross-domain mapping of the taxonomy onto three unlike deployment domains. The reviewed literature provides empirical support for the claim that the same five validation questions recur independently in medical care (Draelos et al., Zhao et al.), industrial operations (Collaco et al., Sharma et al.), and smart mobility (Lin et al., Brown et al.) despite their different hazards, tools, oversight regimes, and time scales. The constructed traces operationalize that mapping by showing where latent defects would be intercepted and by which dimension’s monitor. The recurrence shows that the taxonomy captures deployment-level validation concerns across consequential domains. The illustrative traces make this literature-grounded mapping concrete.

   9 Research Agenda: Building the Validation Stack

   The survey supports four cumulative directions for a validation stack: specification, stress exposure, runtime containment, and auditability.

   1) Bounded-autonomy specifications. Which specification formalisms can express partial trajectory contracts for open-ended, tool-using agents without collapsing them into brittle scripts? This direction directly addresses the Behavioral × \times Assurance Cases cell in Table 6 , which contains only 4 coded appearances and therefore remains red despite the apparent maturity of behavioral evaluation overall. The gap is not measuring whether an agent can solve a task once; it is stating, in machine-checkable form, what the agent is allowed, forbidden, or obligated to do while pursuing that task.

   The core research problem is to define partial contracts over trajectories: obligations to escalate, regions of forbidden action, constraints on delegation, and memory-update rules that survive policy variation and environment change. In agentic systems, engineers rarely know the exact action sequence in advance; what they know instead is the structure of acceptable behavior under uncertainty. That makes the problem a requirements-language challenge at the boundary of temporal logic, assume–guarantee reasoning, runtime shielding, and socio-technical systems engineering rather than a mere benchmark-design exercise. Runtime shielding and safety-of-the-intended-functionality work supplies formal starting points [ alshiekh2018safe , iso21448 ] ; CPS validation studies ground the problem in deployed autonomy [ zhao2026 , collaco2026 ] , while constitutional approaches offer a related agentic framing [ bib:constitutional ] .

   The expected artifact is an interchange format for bounded autonomy: a specification object that can be compiled into test oracles, runtime monitors, and assurance claims, evaluated through obligation coverage, violation-detection recall, and representational adequacy.

   2) Adversarial trajectory generation. Which techniques can generate test trajectories that cover the fat-tail failure modes unique to agentic systems? This direction directly addresses the Temporal × \times Benchmarks cell in Table 6 , which contains only 4 coded appearances and leaves long-horizon temporal failure discovery largely outside the benchmark mainstream. The immediate gap is not the absence of environments per se, but the absence of generators for rare, off-policy, state-dependent trajectories in which memory errors, tool misuse, delayed side effects, and adversarial perturbations combine over time.

   Existing environments provide useful starting points, including WebArena, WorkArena, and AgentDojo [ webarena2024 , agentdojo2024 ] , together with the adversarial Nemesis benchmark [ nemesisAdversarial2025 ] , but they do not yet provide systematic coverage of temporally extended failure surfaces. What is needed is search procedures that preferentially discover tail failures through environment mutation, counterfactual replay, disturbance injection, and policy-guided stress generation [ collaco2026 , draelos2026 ] .

   The expected artifact is a fat-tail generator : a replayable test generator that emits adversarial trajectory families and minimal counterexamples for debugging and audit. Progress is visible through rare-event coverage, adversarial failure discovery, and replay reproducibility.

   3) Temporal runtime monitoring. Which runtime monitors can detect trajectory-level drift early enough to trigger containment before localized deviations compound into unsafe outcomes? This direction directly addresses the Temporal × \times CPS Validation cell in Table 6 , which contains only 3 coded appearances, the sparsest cell among the engineering-oriented approach families. That scarcity matters because many agentic deployments are not one-shot services but closed-loop systems in which delayed tool effects, memory corruption, schema changes, and workload shift accumulate across operational time.

   Three monitoring channels recur across the surveyed literature: memory and retrieved-context drift, tool-version and schema change, and environment or workload shift. The unsolved problem is to turn those signals into revalidation triggers, degradation modes, rollback rules, and escalation paths that activate before error propagation becomes opaque. Assurance monitoring and runtime verification provide the initial containment mechanisms [ hawkins2021amlas , rtbas2025 ] ; MLOps and expert-monitoring work identifies observable signals [ mlops2023 , expertmonitoring2024 ] . FDA and MDCG guidance establishes the associated change obligations [ fda-pccp2025 , mdcg2025-10 ] , while agent harnesses and evolving protocols make the need concrete [ ahe2026 , autogenesis2026 ] . A key implication of the Safety split in Section 7 is that runtime monitors must distinguish security-triggered containment from functional-safety degradation.

   The expected artifact is an event calculus for revalidation : a monitor specification that binds observable drift events to containment actions and evidence refresh. It specifies which changes in memory state, tool schema, workload, or policy behavior are revalidation-relevant, how those signals combine across time, and which assurance action each pattern triggers. Progress can be assessed through drift-slope sensitivity, unsafe-action rate (UAR), and response-rule correctness: block, rollback, degrade, or escalate before downstream hazard propagation becomes opaque.

   4) Human oversight and evidence legibility. Which oversight and evidence-chain designs allow human reviewers to verify, contest, and renew trajectory-level assurance claims as systems evolve? This direction directly addresses the Regulatory × \times Runtime Monitors cell in Table 6 , which contains only 7 coded appearances and marks a specific weakness in the current literature: operational traces are monitored, and regulatory claims are documented, but the connection between the two is rarely engineered as a reviewable chain of evidence.

   Two distinct concerns have to be separated here because they draw on different literatures and produce different artifacts. The first is human oversight : human-computer interaction (HCI) and human-factors work asks when to interrupt, how to present uncertainty, what escalation path is usable, and how to avoid over-trust, alert fatigue, and nominal human-in-the-loop theater. Trust and human-factors research establishes the basic risks [ lee2004trust , parasuraman1997humans ] ; clinical deployment studies show their relevance to agents [ zhao2026 , draelos2026 ] , and cascade analysis exposes their systemic consequences [ sambasivan2021cascades ] . The second is evidence legibility : assurance-case, formal-methods, and traceability work asks whether a reviewer can reconstruct what claim was made, which evidence supported it, which monitor fired, which override occurred, and whether that evidence remained valid at decision time. FDA documents establish the lifecycle-evidence expectation [ fda-action-plan , fda-gmlp ] ; IEC and IEEE guidance specify complementary traceability practices [ iec62304 , ieeeguide2025 ] . MDCG documents and the EU MDR provide the regulatory setting [ mdcg2025-6 , mdcg2025-10 ] , with assurance-case work addressing reviewable arguments [ eu-mdr , alelyani2025 ] . Treating them as one problem obscures the fact that a usable override interface is not yet an audit-ready assurance package, and conversely that a formally traceable log may still be unusable for real-time human review.

   The expected artifacts are therefore an oversight interface specification for escalation, override, acknowledgment, and handoff, plus proof objects and linking schemas that bind specifications, test traces, runtime logs, overrides, and update events into audit-ready claims. Oversight quality is evaluated through reviewer uptake, correct override or escalation use, and low interruption burden; evidence legibility is evaluated through claim support, audit replay success, and freshness checks such as EFI. Together, these directions shift validation from measuring whether a component can succeed to demonstrating that trajectories remain acceptable, governable, and evidentially current in context.

   10 Open Challenges and Methodological Directions

   Even with the proposed validation stack, several structural problems are likely to persist beyond any single research direction.

   Scalability of assurance. Assurance cost grows superlinearly as deployments expand from single agents to interacting ecologies of tools, humans, and organizations. Compositional methods can validate local properties, but system-level properties of multi-agent systems with dynamic membership and open communication vocabularies resist tractable state-space analysis [ scienceScaling2025 , harnessingMultiagent2025 ] . Better local validation does not automatically compose into system-level assurance, and each additional coordination or security layer adds obligations that do not aggregate cleanly [ hybridMultiagent2025 , decisionAlignment2025 ] . A general solution likely requires new assume-guarantee frameworks adapted to open-ended LLM interaction rather than bounded agent programs.

   Performance versus assurance overhead. Richer simulation, denser logging, monitoring, and more frequent human review improve evidence depth, but each creates a persistent tension with latency, usability, compute efficiency, and workflow acceptance. Work on sustainable monitoring explicitly quantifies this trade-off between accuracy and energy efficiency [ sustainablyMonitor2025 ] , while cost analyses of agentic reasoning show that assurance instrumentation carries measurable operational overhead [ costDynamic2025 ] . Adaptive protocols that reduce monitoring granularity during low-risk operation and scale up when risk indicators rise are a promising partial mitigation [ adaptiveCommunication2025 ] , but the fundamental tension between evidentiary depth and performance remains unresolved.

   Human-AI teaming as a moving target. Human-in-the-loop validation is a pillar of the research agenda, but it does not fully solve the problem that human behavior changes in response to automation. Over-trust, under-reliance, intervention fatigue, complacency, and shifting norms of responsibility are adaptive properties of socio-technical systems, not static interface issues. Mission-oriented and user-facing agent studies illustrate this shift [ agenticMission2025 , agentUser2025 ] , including personalized-agent settings [ agentPersonalized2025 ] . Validating the agent alone therefore undershoots the problem; validating the human-agent team is difficult precisely because the target of validation evolves through use. Studies designed to capture this dynamic, such as tracking override behavior longitudinally, varying automation reliability systematically, and measuring responsibility diffusion after incidents, are largely absent from the current corpus.

   Evidence portability and regulatory harmonization. Even well-formed assurance artifacts may not transfer across domains, jurisdictions, or procurement settings. Regulatory concepts such as acceptable risk, traceability, and post-deployment accountability are not interpreted identically across governance regimes, and benchmarks and architectures keep changing faster than evaluation norms can stabilize. Verifiable-semantics and accountability-oriented architectures provide candidate foundations [ verifiableSemantics2025 , accountabilitybasedArchitectural2025 ] ; agent fusion and team-aware methods extend them to multi-agent systems [ agentfusionMultiagent2025 , taaeTeamaware2025 ] , alongside explicit verification models [ verificationModel2025 ] . The engineering challenge is therefore not only how to produce evidence, but how to make assurance claims portable, comparable, and durable under heterogeneous external oversight. This ultimately requires coordination between technical standards bodies and governance institutions that lies beyond any single engineering contribution.

   The four-direction validation stack addresses engineering within a deployment lifecycle. Assurance at scale, overhead management, human-team dynamics, and evidence portability remain broader socio-technical and governance challenges.

   11 Conclusion

   This survey argues that unit, integration, and benchmark results alone do not provide adequate validation coverage for agentic systems. Their relevant behavior is a trajectory realized through planning, tool use, memory, coordination, and adaptation in context. That shift changes the assurance target from isolated component correctness to bounded acceptable behavior over time.

   Drawing on a corpus of 257 papers, the survey makes four claims. First, classical testing abstractions remain necessary but stop short of the validation target once software acts autonomously in consequential environments. Second, the literature is most usefully organized by five validation dimensions: behavioral, safety, temporal, regulatory, and multi-agent, each capturing distinct failure modes and evidence needs. Third, existing work is unevenly distributed across those dimensions: behavioral evaluation is comparatively mature, while temporal validity, lifecycle evidence, and certifiable governance remain structurally underdeveloped. Fourth, the survey translates those asymmetries into a four-direction lifecycle stack spanning bounded-autonomy specifications, adversarial trajectory generation, temporal runtime monitoring, and human-verified evidence chains, an interpretive synthesis of the surveyed gaps supported by the corpus-level counts.

   The broader implication is methodological as much as technical. Validation for agentic AI is no longer mainly about measuring whether a model can succeed on a task; it is about demonstrating that trajectories remain acceptable, inspectable, and governable as environments, interfaces, and evidence change. That is why agentic AI demands not a larger benchmark alone, but a new validation paradigm.

   Statements and Declarations

   Funding

   This research received no external funding.

   Ethics approval and consent to participate

   Not applicable

   Consent for publication

   Not applicable

   Competing interests

   The authors declare that they have no conflict of interest related to this work.

   Data availability

   Not applicable

   Author contributions

   F.O.M. conceived the original idea, designed the review methodology, developed the five-dimensional taxonomy, conducted the literature review and analysis, synthesized the findings, prepared the case studies, and drafted the manuscript. L.D. and G.T. contributed to the methodology, literature analysis, taxonomy refinement, interpretation of the findings, and critical revision of the manuscript. S.S., F.L., A.P., and G.M. supervised the work, contributed to the interpretation of the findings, and critically revised the manuscript for important intellectual content. All authors read and approved the final manuscript.