This document is a formula-free companion to the full PBR specification. For complete mathematical specifications, refer to the PBR White Paper v3.0.

1. What PBR Is and Why It Matters

AI agents are becoming economic participants. They handle customer data, execute trades, write code, review contracts, and increasingly delegate work to each other. Yet there is no standardized way to answer a simple question: will this agent succeed on its next task?

This is the same problem that plagued consumer lending before credit scores. Without observable quality signals, buyers can't tell good agents from bad ones. High-quality agents get undervalued, low-quality ones sneak through, and the whole market suffers. Economists call this the "Market for Lemons" problem.

Predictive Behavioral Reputation (PBR) is a scoring system that produces a 0–100 trust score for any AI agent, computed from five dimensions: Reliability, Safety, Consistency, Efficiency, and Transparency. The score is task-conditioned (you query it per category, not as one number for everything), drift-aware (it detects when an agent's behavior changes), and adversarially hardened (it's designed to make gaming more expensive than building a good agent).

PBR is deployment-topology agnostic. The same scoring math works whether you run it as a centralized platform, a federated enterprise system, or an off-chain scoring oracle feeding into blockchain registries like ERC-8004. Protol is the reference implementation, available as a Python SDK and REST API.

2. How PBR Scores Work

The Five Dimensions

Every PBR score is built from five independent dimensions, each measuring something different about the agent. The composite score is a weighted combination, analogous to how a credit score combines payment history, credit utilization, and account age into one number.

The five PBR dimensions

Only Reliability has a direct probabilistic interpretation ("80 means ~80% success rate"). The composite PBR score is an ordinal ranking: higher is better, and the relative ordering should predict real-world outcomes. Whether it actually does is the most important validation task for the system.

Evidence Quality: Not All Data Is Equal

The most important design decision in PBR is this: every piece of data that goes into the score is weighted by how trustworthy it is. PBR defines four Data Integrity Levels:

Data Integrity Levels

An agent operating entirely on self-reported data (L1) can still get a PBR score, but that score will be visibly lower-confidence and contribute less to tier advancement. This creates a natural incentive to seek external validation without mandating it.

Commissioner Credibility

Commissioners are the external parties (customers, orchestrators, validators) who rate an agent's work. Not all commissioners are equally trustworthy. PBR learns commissioner credibility over time from three signals:

Diversity: Does this commissioner rate many different agents, or just one? A commissioner who rates 20 agents across the ecosystem provides a stronger signal than one who only rates a single agent. PBR uses the Herfindahl-Hirschman Index (the same concentration metric used in antitrust law) to measure this. Single-client commissioners aren't flagged as Sybils, but their ratings carry less weight.

Timing realism: Do ratings arrive suspiciously fast? If 80%+ of a commissioner's ratings land within 60 seconds of task completion, that pattern looks automated rather than genuine review. Their credibility drops by 50%.

Track record: Do their ratings align with independently validated outcomes? Commissioners whose ratings consistently correlate with L3-verified results earn higher credibility over time. Those who are persistent outliers lose it.

3. Reliability: The Core Prediction

Reliability is the most important dimension. It answers: given everything PBR knows about this agent in this task category, what's the probability it will succeed on its next task?

The system works by maintaining a running tally of weighted successes and failures for each agent in each category. Recent actions count more than old ones (exponential decay). Verified actions count more than self-reported ones (integrity weighting). Actions rated by credible commissioners count more than those rated by low-credibility ones. The math behind this is Bayesian inference with a Beta-Bernoulli model, but what matters for practical purposes is the behavior:

New agents start at a baseline, not zero. A new agent in a category gets a score blended from two sources: how this agent performs in other categories, and how other agents perform in this category. This prevents the cold start problem from being either too generous or too punitive.

Thin evidence is penalized. An agent with 3 successes out of 3 attempts doesn't get a Reliability of 100. PBR uses a Lower Confidence Bound that accounts for statistical uncertainty. More evidence = tighter confidence = score closer to the true performance rate.

The published score is conservative by design. PBR reports the 10th percentile of its confidence interval, not the average. This means an agent's Reliability score is a "we're 90% sure it's at least this good" statement.

Self-Calibrating Decay

Not all agents operate at the same frequency. A CI/CD agent processing 500 tasks per day needs a short memory: yesterday's performance on a pre-patch model version is irrelevant. A regulatory compliance agent that runs weekly audits needs a long memory: each data point is precious and should remain informative for months.

PBR solves this by self-calibrating the decay rate based on the agent's own action frequency. The half-life (time for an observation's weight to halve) is set to approximately 10 times the median interval between actions, clamped between 7 and 90 days. A high-frequency agent gets a 7-day half-life; a weekly agent gets a 70-day half-life. No operator input. No configuration decisions. The agent's behavior determines its own decay rate.

Difficulty-Adjusted Evidence

A major gaming vector in any reputation system is cherry-picking: only accepting easy tasks and declining hard ones. PBR addresses this by giving harder tasks more evidential weight.

"Difficulty" is inferred from observable metadata that's hard to fake: task duration, number of tool calls, whether external APIs were invoked. Token counts are only included when a commissioner has validated them (L2+), preventing agents from inflating difficulty by self-reporting high token counts.

An agent that succeeds at a 90th-percentile difficulty task gets roughly 95% evidence weight. One that succeeds at a 10th-percentile task gets roughly 55%. The adjustment applies symmetrically to both successes and failures, because a failure on a genuinely hard task is more informative than a failure on a trivial one.

4. Safety, Consistency, Efficiency, Transparency

Safety (25% weight)

Safety starts at 100 and drops with confirmed incidents. It uses a demerit system, not a probability model, because even one safety incident matters. A critical incident confirmed at L3 integrity deducts 28.5 points; the same incident self-reported at L1 deducts only 15.0. Incidents recover gradually over time (28 days for medium, 56 days for critical), and these decay rates are fixed regardless of how frequently the agent operates. Safety has asymmetric integrity: self-reported absence of incidents counts less than reported incidents, because agents have a stronger incentive to hide failures than to fabricate them.

Consistency (20% weight)

Consistency penalizes agents whose performance swings wildly. An agent delivering 85% success rate steadily is more trustworthy than one swinging between 95% and 60%. The system separates agent-attributable variance from environmental noise (upstream API outages, infrastructure issues affecting everyone). Only the agent's excess variance counts against it. Two factors contribute: success rate stability (70% weight) and response time stability (30%).

Efficiency (15% weight)

Efficiency compares an agent's cost to behavioral peers, not self-declared category peers. An agent claiming to be in the "document analysis" category but actually doing simple keyword matching gets compared to other keyword-matching agents, not to sophisticated NLP agents. Peer groups are determined by observed behavior (duration, tool usage, complexity) through behavioral fingerprinting. Agents with thin cost data get conservative (lower) efficiency estimates. Efficiency's contribution to the composite is further multiplied by the agent's integrity level, so staying at L1 to appear "cheapest among the unverified" doesn't work.

Transparency (10% weight)

Transparency rewards two things: metadata completeness (do you report all available fields?) and confidence calibration (when you say you're 90% confident, are you right 90% of the time?). PBR uses the Brier score, a metric that is mathematically impossible to improve by lying about your confidence. It also includes a Sharpness component that penalizes agents who hedge by always reporting 50% confidence. An agent that always says "50/50" gets mediocre Transparency. An honest, well-calibrated agent that says "I'm 95% sure" when it should be, and "I'm only 30% sure" when appropriate, scores highest.

5. Trust Tiers: From Unrated to Platinum

PBR scores translate into human-readable tiers, but reaching a tier requires more than just a high score. Three conditions must be met simultaneously: score threshold, evidence volume (measured in effective sample size, not raw count, so L1-only actions contribute less), and eligibility requirements that prevent gaming.

Trust tier requirements

"Broad commissioners" means commissioners who rate at least three distinct agents. This requirement prevents an agent from advancing tiers by creating a single captive commissioner who rates only that agent. "Verified Spend" is a base floor or a cluster-relative alternative (whichever is higher), weighted by commissioner credibility. This means spend thresholds scale with the cost tier the agent operates in. A wash-trading attack through a low-credibility commissioner ring (γ ≈ 0.3) accumulates spend at roughly 30% efficiency, tripling the effective cost. Gold and Platinum tiers also require Spend Velocity: at least 60% of verified spend must come from the most recent half of the account age window, preventing dump-and-park strategies.

No single axis is sufficient: spend alone is pay-to-win, time alone is wait-to-win, diversity alone is network-to-win. Requiring all three simultaneously makes tier advancement genuinely difficult to fake.

6. Anti-Gaming: Five Layers of Defense

PBR does not claim to prevent all manipulation. That's provably impossible in open systems without a central identity authority (Douceur, 2002). Instead, PBR's goal is economic: make faking a reputation more expensive than building a real one. Five defense layers work together, each raising the cost of attack.

Layer 1: Commissioner Credibility Analysis

Every commissioner earns a credibility score from 0 to 1, starting at 0.5. The score is learned from behavioral patterns: rating diversity (HHI concentration), timing realism, account age, and correlation with independently validated outcomes. Low-credibility commissioners' ratings still count, but at reduced weight. A commissioner with 0.3 credibility effectively contributes 30% of the evidence weight that a fully credible commissioner would.

Layer 2: Graph Concentration

PBR analyzes the bipartite graph of agents and commissioners. Three structural signals emerge. Agent-side concentration: an agent whose ratings all come from one commissioner has fragile, potentially manufactured reputation. Externality ratio: what fraction of the agent's commissioner mass comes from commissioners who participate broadly in the ecosystem? Component isolation: small, tightly connected clusters of agents and commissioners with few connections to the rest of the network are flagged as potentially Sybil clusters. These flags are diagnostic (visible in API responses) but don't auto-penalize, avoiding false positives from legitimate niche use cases.

Layer 3: Resource Gating

Public index eligibility requires meeting spend, time, and diversity thresholds simultaneously. Spend thresholds are cluster-relative: rather than a fixed dollar amount (which is meaningless for a $0.01/task classifier and trivial for a $5/task research agent), the requirement scales to whichever is higher between a base floor and a multiplier of the agent's behavioral cluster median cost. Verified spend is cumulative L2+ cost weighted by commissioner credibility, so wash-trading through a Sybil commissioner ring requires roughly 3x the nominal spend. Gold and Platinum tiers also require Spend Velocity: at least 60% of verified spend must come from the most recent half of the account age window, preventing attackers from dumping money upfront and going dormant. Account age prevents instant identity creation. Commissioner diversity prevents captive validation. Four axes of friction, all required at once.

Layer 4: Volume and Behavioral Filtering

Action volume is monitored for anomalies using the same statistical machinery as drift detection. Sudden sustained volume increases (65%+ above baseline) trigger reduced evidence weighting. Actions below the 5th percentile of their behavioral cluster's work complexity are classified as trivial and excluded from scoring entirely. The threshold is relative to the agent's own workload class, not a fixed number that can be dodged.

Layer 5: Cross-Dimensional Tradeoffs

This is PBR's structural defense. Gaming one dimension degrades another. Inflating tokens to appear more complex increases costs (hurts Efficiency). Using low-diversity commissioners reduces evidence quality (hurts all dimensions). Stuffing volume triggers anomaly detection (hurts AR). Selective task intake reduces difficulty-adjusted evidence weight (hurts Reliability). No single optimization axis yields a high composite score. Multi-axis gaming is expensive, slow, and detectable.

Adversarial Resistance (AR) Score

The AR score is computed from commissioner concentration, volume anomaly, and integrity factors. It operates as an annotation, not a heavy penalty. AR above 0.7: no effect. Between 0.5 and 0.7: a warning flag is attached to API responses. Below 0.5: the agent is excluded from leaderboards, capped at Silver tier, and faces a maximum 30% score reduction. Larger penalties come from evidence quality weights already embedded in dimension scoring, preventing mysterious score collapses when a single signal flips.

What Does a Sybil Attack Actually Cost?

Cost of achieving Gold tier via Sybil manipulation

A fleet of 10 Gold-tier Sybil agents costs over $83,000 in real spend plus three months of sustained, coordinated activity involving genuine ecosystem participation. At this cost, building legitimate agents is the rational economic choice. Meanwhile, a legitimate code review agent spending $0.50/task accumulates natural verified spend well below the $2,500 floor through normal operation. The thresholds are designed to be invisible to real agents and prohibitive to attackers.

7. Drift Detection: When Agents Change

When a model provider pushes an update, every agent built on that model silently changes behavior. The wrapper code is the same. The configuration is the same. But the output distribution has shifted. This is the drift problem, and most reputation systems ignore it entirely.

PBR monitors four metrics per category per agent: success rate, latency, cost, and confidence calibration. Each metric is tracked using CUSUM (Cumulative Sum) control charts, a well-established statistical method from quality control that detects sustained shifts rather than random noise. The system is tuned to catch meaningful changes: a 5-percentage-point shift in success rate, a 10% shift in latency, a 15% shift in cost.

When drift is detected, PBR doesn't reset the score to zero. Instead, it enters evidence-gated recovery: the score gradually blends from pre-drift to post-drift performance as new evidence accumulates. If the agent performs well after the change, the score transitions smoothly to reflect the new performance level. If it performs worse, same thing. No manual "reset" button is needed, and no operator can game it by triggering resets after bad periods.

8. Threat Model

PBR defines its attack surface explicitly. A specification that doesn't state what it defends against invites critics to define it unfavorably.

PBR threat model summary

The system also monitors population-level health via Score Entropy. If the distribution of PBR scores compresses (most agents scoring 90+), that indicates systemic gaming or parameter staleness. When Score Entropy drops below a threshold for four consecutive weeks, a scoring model version review is triggered. Parameter changes are published with 30-day notice. Historical scores are not retroactively changed. Percentile rank is always reported alongside absolute score, providing discrimination even under ceiling compression.

9. Integration

Protol is the reference implementation. Three components: a Python SDK, a REST API, and a background computation engine.

Protol platform architecture

Integration is minimal. Register an agent, wrap actions in a context manager, query reputation. The SDK handles all metadata capture, evidence submission, and score retrieval.

API Response (v3)

Every reputation query returns: the composite PBR score (0–100), per-dimension breakdowns, percentile rank within category, trust tier, scoring model version, data integrity distribution, adversarial resistance status (clean/warning/restricted), and effective sample size. Action immutability is enforced: once an action's metadata is submitted, it cannot be modified. Corrections require a new action record linked via an amendment field.

10. Known Limitations

PBR is transparent about what it cannot do.

Calibration is unvalidated. "Reliability = 80 means ~80% success rate" is the target claim, not a demonstrated fact. It will be validated via time-split backtesting on production data. This is the single most important open validation task.

L1 is inherently gameable. Self-reported telemetry can be faked. PBR reduces its influence but doesn't eliminate it. An all-L1 agent's score is visibly low-confidence, but it exists and could mislead consumers who don't check integrity levels.

Sybil resistance is economic, not absolute. Five defense layers raise the cost substantially, but a well-funded, patient attacker can build convincing Sybils. Full prevention requires identity infrastructure that PBR doesn't mandate.

Selective intake requires routing visibility. The difficulty adjustment reduces reward for easy-task cherry-picking, but detecting whether an agent declines hard tasks requires offer/accept data from a routing layer. Standalone SDK deployments can't observe this.

Goodhart's Law applies. Any score that matters economically will be gamed. PBR's cross-dimensional tradeoffs make multi-axis gaming expensive, and population monitoring detects compression. But no scoring system is permanently game-proof. PBR treats score integrity as a continuous monitoring problem, not a solved one.

11. Competitive Landscape

Competitive landscape

ERC-8004 is the closest in vision. It launched on Ethereum mainnet in January 2026 with identity, reputation, and validation registries. But its reputation registry stores ratings, not scores. Actual reputation computation is delegated to off-chain services. PBR fills that gap: it can serve as the scoring engine that gives ERC-8004's on-chain reputation data mathematical teeth.

For complete mathematical specifications, proofs, and derivations:

PBR White Paper v3.0 (Full Specification)

Publication License

This specification is published by FlyingBoat AI for the purposes of technical review, academic citation, and ecosystem development.

Permitted Uses: Reading, reviewing, and citing this specification. Implementing PBR-compatible scoring systems that interoperate with the Protol platform via the official SDK or API. Academic research and publication referencing this work. Building integrations that consume PBR scores.

Restricted Uses (require written license from FlyingBoat AI): Creating competing commercial scoring services that substantially replicate the PBR methodology described herein. Redistributing this document in modified form. Using "PBR", "Protol", or "Predictive Behavioral Reputation" as trademarks or product names.

Patent Notice: Certain methods described in this specification, including but not limited to the commissioner credibility learning system, cross-dimensional anti-gaming mechanisms, and behavioral fingerprinting for trust scoring, may be subject to pending patent applications by FlyingBoat AI.

Attribution: Mulge, S. (2026). "Predictive Behavioral Reputation: A Trust Framework for Autonomous AI Agents." FlyingBoat AI. Version 3.0. protol.dev

Contact: Licensing: shravan@flyingboat.ai · Technical: developers@protol.dev · First published February 2026 · Version 3.0

Technical Brief