China's Ministry of Commerce, with eight other departments, published an opinion on 21 October on accelerating technology-driven commerce. It is a long document: eighteen measures spanning manufacturing, retail, logistics, tourism and standards. Most of it is familiar industrial policy. The passage worth reading closely sits in measure fifteen, which asks for prudent, scenario-based tiered governance of commercial agents. A tier, in any regulatory sense, is a claim that a system has been measured and found to behave within stated limits. The rest of the document does not yet supply the measuring instrument.
What the document actually builds
The concrete asks are specific enough to be checkable. Measure one extends the AI-plus-manufacturing campaign to phones, computers, home devices, wearables and robots, and encourages intelligent products built on secure open-source operating systems. Measure two pushes industrial large models and edge intelligence into flexible and made-to-order production. Measure ten creates a category of commercial agents for shopping guidance, store operations and logistics, and puts embodied intelligence into home services and trade logistics. Measure thirteen promotes the national standard series on grading the intelligence level of AI terminals and asks for a unified standard system covering all terminal forms. Measure fourteen calls for commerce-specific high-quality datasets and trusted data spaces. Measure fifteen adds governance: tiered agent oversight, boundaries on collecting and sharing commercial data, a to-be-published negative list for data applications, a risk monitoring and early-warning system, and sandbox pilots inside controllable limits.
Read together, the stack is coherent. Devices get graded, agents get scenarios, data gets a boundary. What is missing is the join between the first two.
The terminal grade measures a different object
Grading terminal intelligence and grading a commercial agent are not the same measurement, and the difference is structural rather than a matter of degree. A terminal grade describes a bounded device: fixed hardware, a short interaction, a task that ends when the user stops. A commercial agent runs a loop. It calls tools, reads external state, retries, and changes something outside itself: an order, a refund, a delivery slot, an inventory count. Its failures are rarely a wrong answer to a single question. They are a plausible sequence that books the wrong item on the ninth repetition, or an escalation that never happens because the model was confident.
An agent tier therefore has to be defined as a pair: a capability envelope and a named failure mode. A tier label is meaningless unless it states which scenario class the system was tested in, what autonomy it was allowed, how reliably it completed the task, and what it must do when it cannot. The terminal standard can bound the runtime, which is useful. It cannot substitute for the behavioural claim.
What a testable tier needs
A tier that can be audited needs, at minimum, five things recorded together:
- scenario class: the environment, the tool set, the adversarial customer behaviours included, and the version of each;
- autonomy level: whether the agent recommends, asks for confirmation before side effects, or executes unattended;
- measured reliability: task completion, tool-call validity, correct escalation and handoff, recovery after an injected fault, and adherence to the data boundary;
- oversight requirement: which human check is mandatory, and at which step;
- cost envelope: tokens, latency and human interventions per completed task.
Pass criteria should be registered before the run, and results reported with intervals. Small scenario sets produce wide intervals. A single number from thirty cases is not a tier.
Sandboxes are only useful if they emit comparable artifacts
The sandbox provision is the right instrument for a field without settled metrics, but a sandbox is a container, not a method. Results become comparable only when each run produces the same artifacts: a versioned scenario set, an environment snapshot, a telemetry schema recording tool calls, state transitions and human overrides, an adjudication protocol with a published failure taxonomy, and a machine-readable report per run. With those, a sandbox run after a model update becomes a regression test. Without them it produces a demonstration, and demonstrations are selected, whether deliberately or not. The distinguishing question is simple: could a second team, given the same artifacts, reproduce the pass rate? If not, the tier rests on the tester's judgement rather than on the system's behaviour.
Data boundaries reshape the evaluation loop
The negative list, trusted data spaces and risk monitoring are usually read as compliance items. They are also engineering constraints on the evaluation pipeline. Agent memory writes carry provenance; retention limits require that provenance to be enforceable and deletable; deletion has to propagate through retrieval indexes, not just the primary store. At the same time, reproducibility wants traces retained long enough to replay. These pull in opposite directions. The workable resolution is not to retain everything but to design replayable artifacts that do not need raw records: scenarios regenerated from a schema, redacted transcripts, hashed references with originals held inside the trusted space. If data cannot leave a trusted space at all, the harness must run inside it, which means the evaluation tooling has to be portable and its configuration attested. Otherwise cross-company comparison collapses.
Edge and embodied systems are graded by degradation
Edge intelligence and embodied deployment add a dimension that terminal grading only partly covers: behaviour under constraint. A logistics robot or a store agent operates inside a latency budget and a safety envelope. The interesting measurements are what happens when the network drops, when the model is unavailable, when confidence is low, and when a human must take over mid-task. Stop semantics matter more than average accuracy. A system that completes ninety-five percent of tasks and cannot stop cleanly on the other five is not a higher tier; it is a different risk class. Tiers built on completion rates alone will reward exactly this failure.
The document's own language is cautious, and correctly so: prudently, within controllable limits, pilot first. That caution implies staged evidence, and staged evidence needs a published format. The artifact that would make the regime work is unglamorous: a versioned harness, a failure taxonomy, and a report schema shared across sandboxes so results can be compared rather than described. Whether the negative list and the sandbox pilots arrive with methods attached is the thing to watch. Governance written before the measuring instrument exists is not wrong; it is a placeholder. The tiers become real on the day the test sets are published.