Lab setup
Run the same AgentDojo task set with the same model, tools and environment. First establish the baseline attack-success rate. Then enable the defense and rerun the same scenario set.
The important comparison is not only how many attacks fail. It is how many legitimate tasks still complete.
What to record
Record task success, attack success, blocked tool calls, reviewed exceptions and the policy rule that produced each decision. Without that evidence, a score is hard to reproduce or defend.
A practical lab should make failed attacks inspectable by engineering, not just visible as a final percentage.
From lab to rollout
Use the lab to tune policy before deploying to a real workflow. The target is not perfect detection; it is a clear boundary where dangerous actions are blocked or reviewed before execution.
Policy before action. Evidence after execution.