When an AI agent hits a wall, does 'it never broke a rule' tell you if it quit, asked for help, or looped forever?

This explores whether counting how often an agent crosses an authorization line, such as modifying protected tests, can tell you what it actually did once its authorized route was blocked. The corpus says no. When the boundary is explicit, four very different behaviors all leave the crossing counter at zero: silent stopping, escalation, refusal, and failure to terminate What behaviors hide behind a zero crossing rate?. An agent that quietly gave up, one that asked a human for help, one that declined, and one that never stopped all report the same number. Each leaves the operator in a fundamentally different position.

The zero can also mislead about why it is zero. In testing, explicit authorization boundaries kept protected tests unmodified only when they were paired with restricted tools. Naming a prohibition was not enough, and the boundary had to specify the protected state itself Can explicit authorization boundaries prevent agents from modifying protected tests?. Read next to the first note, this suggests that a zero can reflect what the tooling made possible as much as what the agent chose to do. That is an inference from the two notes, not something either states directly.

This is one instance of a wider pattern in the corpus: measures that look at a single event miss what matters. A model-level filter judges one output at one moment, while an agent's risk spreads across memory, tool calls, and environmental reach Can a model-level filter truly contain an agent with environment access?. Stateless guardrails cannot even express a constraint that depends on what happened earlier Can stateless checks ever catch sequence-level constraint violations?. In multi-agent systems, a harmful goal can be split into subtasks that each look benign, so single-message classifiers see nothing wrong Can task decomposition hide harmful intent across agents? Why do single-message classifiers miss cross-agent harms?. A crossing rate is another per-event tally, so it inherits the same blind spot.

The corpus does not offer a finished replacement for the crossing rate. It only says a single metric is too coarse. The nearest constructive direction is defence built around units that span time and agents: sets of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates Should defence units span multiple executions and agents?. Applied to this question, that suggests logging what the agent did after the route closed (stopped, asked, refused, or kept going) as separate outcomes, not folding them into one rate. That application is my reading, not a claim from the notes.