---
title: "Anthropic Embeds METR Inside the Building: A Three-Tier Model for Auditing Your Own Agents"
date: 2026-11-08
tags: ["anthropic","metr","safety","evaluation","agentic-workflows","governance"]
categories: ["Industry"]
summary: "On October 15 Anthropic said six METR employees now have employee-like access to its hardware, offices and internal tools, under a three-tier access framework in which evaluators can publish without Anthropic's approval. It is vendor-described and unverified by METR in the post, but the structure is a useful template for how engineering teams should audit their own agents."
---


Most AI "safety evaluation" is a vendor handing a model to a third party through an API, then publishing a PDF. On October 15, Anthropic described [something different](https://www.anthropic.com/news/an-update-on-independent-evaluators): evaluators who sit inside the company.

This is a policy post, not a product launch, so there is no benchmark to quote. But if you run agents that write and ship code, the *structure* Anthropic describes is directly reusable. That is the angle here.

## What Anthropic says it did

According to the post, a team from METR, the nonprofit that evaluates frontier models, has been onboarded with employee-like access:

- **Six METR employees** received company hardware, office space, and access to internal tools and systems.
- Anthropic describes this as "roughly on par" with its own risk-assessment teams.
- Anthropic staff are encouraged to share information with them, except for three defined categories: customer data, attorney-client privileged material, and model architecture information.
- METR will publish its analysis. Anthropic says it **cannot veto publication**, but can require redaction of predefined categories (for example, reproducing confidential IP). METR can state publicly what level of access it had.
- The engagement is limited to a small team under enforceable agreements, with other METR staff, including those who work with Anthropic on other projects, siloed from it.

Other evaluators are named too. SecureBio is reviewing the chemical and biological weapons chapter of Anthropic's August Risk Report. Accenture and Faculty are described as working toward a partnership on evaluation, red-teaming, alignment assessments and safeguard testing. Hugging Face is listed among organizations in early discussions. Anthropic ties the move to a commitment made the previous month and to its signing of the White House Accord on Super Intelligence, in which companies pledged to work with independent external auditors.

All of this is Anthropic's own account. The post does not include a METR statement, and METR's findings are not yet published. Treat the *arrangement* as announced and its *quality* as unproven until METR publishes.

## The three tiers

The most interesting part is the access framework, because it names the trade-off most audit regimes leave implicit:

| Tier | Who decides access | Publication |
|---|---|---|
| 1 | Anthropic, narrowly scoped risk investigations | Requires Anthropic's approval |
| 2 | Broader information | Evaluator can publish without approval; Anthropic may require removal of specific categories; evaluator can say whether it thinks redactions were justified |
| 3 | Employee-like access (the METR arrangement) | Similar to Tier 2 |

Anthropic says it hopes several evaluators reach Tier 3 over time. It also lists four requirements for an evaluator: **expertise, independence** (no equity, financial or operational dependence), **sufficient access**, and **freedom to publish**. The analogy it draws is bank supervision, where regulators embed examiners inside large banks.

Whatever you think of the company marking its own homework with friendly examiners, the design has a real virtue: the *redaction right* is bounded and the evaluator can publicly dispute it. That is a much better failure mode than a silent veto.

## Why this matters for people who ship code with agents

Here is the opinionated part. If you run Claude Code, or any autonomous agent, against a real codebase, you have the same problem Anthropic is describing at a smaller scale: the party that built or operates the system is the worst-placed party to judge it. Your agent's "all tests pass" is a self-report.

Anthropic's four requirements translate cleanly into engineering terms.

### 1. Expertise: the reviewer must understand the task

A reviewer agent with the same context window and the same blind spots as the author is not an evaluator. In practice: give the review pass a different prompt, a different model tier or effort level, and the *spec* rather than the author's reasoning.

### 2. Independence: don't let the author write its own acceptance tests

This is the oldest rule in testing and the one agentic workflows break most. If the implementing agent also wrote the tests, you have measured agreement, not correctness. In a spec-driven setup, derive acceptance checks from the spec in a separate session, before implementation, and make them read-only to the implementer.

```markdown
# spec/payments-refund.md (excerpt)
## Acceptance (owned by the reviewer session, read-only to implementer)
- A refund larger than the captured amount returns 422 and writes nothing.
- Two concurrent refunds on one charge never exceed the captured amount.
- Every refund emits exactly one audit event.
```

Then enforce the read-only part with a permission rule or a CODEOWNERS entry rather than trusting a prompt to behave.

### 3. Access: a reviewer who can't see the system can't review it

Anthropic's own admission is that API-only evaluation leaves a gap between what the evaluator understands and what the lab understands. Same for code review: a reviewer shown only the diff will approve a change that is locally fine and globally broken. Give review sessions the repo, the spec, the CI logs and the dependency graph, with the narrow exclusions you actually need (secrets, customer data), and say what those exclusions are, just as Anthropic does.

### 4. Freedom to publish: findings must not be filterable by the author

For a team, "publish" means the review result goes somewhere the implementing agent and its operator can't edit. A review comment on the PR, a check run, or a log in a separate store. If the same session can rewrite the verdict, you have a tier-zero process.

## Where the analogy breaks

Be honest about the limits. METR is a six-person embedded team at a company with thousands of employees; "roughly on par" with risk teams is a claim about access, not about coverage. The excluded categories include model architecture, which is arguably what you'd most want an evaluator to inspect when judging capability risk. And the whole thing is voluntary: Anthropic's closing line is that it believes "every frontier AI company should do the same," which is an argument for a norm, not evidence of one.

Compare that with how most of the AI coding market handles verification: vendor-reported SWE-bench numbers, with the harness and scaffolding chosen by the vendor. Anthropic's move doesn't fix that, but it points in a direction competitors have mostly not matched in public. For a company with an IPO on the calendar (see our [IPO risk-factors piece](/posts/anthropic-ipo-november-timeline-risk-factors-developers/)), credible third-party scrutiny is also good business, so read the incentives as mixed.

## What to do this week

1. **Audit who grades your agents.** For each autonomous workflow, write down who authored the acceptance criteria. If the answer is "the same agent", fix that first.
2. **Adopt tiers explicitly.** Decide which review passes are Tier 1 (scoped, author-controlled), which are Tier 2 (can block a merge without author approval), and make your highest-risk paths (auth, payments, migrations) Tier 2 at minimum.
3. **Write the redaction list.** Name what reviewers can't see, and keep that list short and public inside your team.
4. **Watch for METR's publication.** The real test is whether the first embedded-access report contains findings Anthropic would rather not have published. That will tell you more than the announcement does.

## Sources

- Anthropic, [An update on independent evaluators](https://www.anthropic.com/news/an-update-on-independent-evaluators) (Oct 15, 2026)
- Anthropic, [News index](https://www.anthropic.com/news) (for related Oct 2026 announcements)