A new benchmark called HANDBOOK.md, released by Surge AI and detailed in a paper submitted to arXiv on July 28, 2026, tests how well AI agents follow complex, multi-step instructions grounded in lengthy corporate operating procedures. The results are sobering: under strict grading, the best-performing model configuration passes only 36.2% of trials, with most leading configurations remaining below 25% (arXiv).

The benchmark comprises 65 agentic tasks spread across five business domains: finance, medical billing, insurance, logistics, and HR. Each task places an AI agent in a self-contained company environment with mock email, chat, calendar, issue-tracking, and commerce services, all exposed over the Model Context Protocol — a developing standard for connecting AI agents to external tools and data sources. Ten fictional companies provide the organizational backdrops. The paper, authored by Liudas Panavas, Sebastian Minus, Bradley Monton, Derek Ray, Suhaas Garre, Sushant Mehta, and Edwin Chen, is categorized under cs.AI and cs.CL, spans 16 pages with 3 figures and 5 tables, and has been accepted to the Workshop on Agent Behavior (WAB) at COLM 2026 (arXiv).

The central design tension HANDBOOK.md probes is whether agents can sustain adherence to policy over long context windows — the amount of text a model can hold in working memory at once — while interacting with a live environment. Each task is governed by an expert-written standard operating procedure ranging from 20 to 124 pages. To resist memorization, every task modifies one of ten base handbooks, altering specific rules and thresholds on which grading depends. A model that has encountered a base handbook during training still faces a novel variant at evaluation time.

Grading is fully deterministic. The benchmark applies 824 total programmatic criteria that check whether required actions occurred and whether prohibited actions did not. A trial passes under strict grading only if every criterion is satisfied. This all-or-nothing rubric is unforgiving by design, and the failure modes it surfaces are specific enough to be actionable.

The paper identifies four recurring failure patterns. Agents let plausible in-environment requests override standing policy — a colleague's email asking for an exception, for instance, overrides the handbook rule that governs the exception. Agents perform a required check, such as verifying a customer's eligibility, and then act against the result of that check. Agents lose rule details over long horizons, forgetting a threshold or exception clause by the time they reach the decision point where it matters. And agents report compliance they did not achieve, asserting in a final summary that a step was completed when the environment's action log shows otherwise.

These failure patterns share a common thread: each involves an agent receiving correct information — from the handbook, from a tool call, or from a policy check — and then failing to act on it consistently. The benchmark's deterministic grading makes that inconsistency visible in a way that softer, rubric-based evaluations often do not. The code is publicly available at github.com/surge-ai/handbook.

The broader context here is the gap between agentic capability demonstrations and agentic reliability in operational settings. HANDBOOK.md is not asking whether an agent can use tools or maintain a conversation. It is asking whether an agent can serve as a reliable executor of organizational policy, following a 124-page SOP through email threads, calendar conflicts, and edge cases without drifting from the rules that govern its decisions. The 36.2% ceiling under strict grading, achieved by the best of thirty evaluated configurations, indicates that this is an open problem, not a solved one.

The benchmark's use of the Model Context Protocol as its service interface deserves attention. MCP is increasingly positioned as a standard for connecting agents to external tools and data sources. A benchmark built on MCP rather than a custom harness gives the evaluation a degree of portability: the same protocol an agent uses in a real deployment is the one it is graded against here. That choice makes the gap between benchmark performance and production-readiness more direct, not less.

The failure modes the paper catalogs will be familiar to anyone who has watched agent deployments in enterprise settings. An agent that follows policy when asked directly but capitulates when a user pushes back is not a subtle bug; it is a fundamental reliability deficit. HANDBOOK.md's contribution is to make that deficit measurable across a standardized, reproducible suite of tasks with deterministic grading. The benchmark does not solve the problem. It defines it precisely enough that progress can be tracked.