A completed workflow can still leak a resignation on a shared calendar. Scale AI Research's BARC-Bench puts that soft-boundary failure mode on a numbered ladder: 110 tasks, nine simulated workspaces, five attempts each, and pass^k safety that tops out at 72.7% for the strongest configuration tested.
Benign admin workflows get framed as safe to delegate
The claim under test says frontier workplace agents can be safely delegated benign admin workflows because they already complete complex multi-step tasks. In that framing, high task-completion on calendars, tickets, documents, and HR-adjacent flows is treated as sufficient evidence for autonomous handoff. Soft boundaries (privacy of personnel changes, need-to-know on shared surfaces, unstated norms about who sees what) are assumed to travel with general capability.
Sales and internal rollout language often collapses "the agent finished the ticket" into "the agent respected workplace norms we never wrote down." BARC-Bench is built to separate those sentences.
Scale AI Research posts BARC across nine workspaces
The claim shows up in workplace-agent pitches, copilot admin demos, and procurement narratives that equate complex-task completion with safe delegation. Counter-source: Kangkang Li, Kelvin Luu, Lily Ma, Tu Trinh, Ying Liu, Mohamed Elfeki, and co-authors at Scale AI Research, "BARC-Bench: Benign Asks, Risky Consequences," arXiv:2610.32024.
BARC-Bench collects 110 tasks across nine simulated workspace environments. Task instructions from users are intentionally underspecified on safety boundaries. Evaluation judges agent behaviour against boundaries established by workspace records, implicit environmental context, and unstated social norms. A running example in the paper: an agent asked to schedule off-boarding discussions must arrange the meeting without prematurely revealing an employee's resignation through a shared calendar invitation.
Four model configurations run on OpenCode plus AgentEnv: GPT-6 Astra, Claude-Fable 5.1, Gemini 3.8-Flash, and DeepSeek V4-Pro. Each task gets five attempts.
pass^k safety leaves Astra at 72.7% across five attempts
The paper emphasises pass^k safety: the share of tasks completed safely on all five attempts. GPT-6 Astra lands at 72.7%, Claude-Fable 5.1 at 37.3%, Gemini 3.8-Flash at 23.6%, and DeepSeek V4-Pro at 9.1%. Even the strongest configuration produces a safety violation on 27.3% of tasks. Measuring whether any one of five attempts is safe (pass@k) lifts Gemini and DeepSeek to 46.4% and 51.8%. That gap is the methodological stake. A single clean trajectory can hide a policy that fails most of the time, and for delegation risk consistency across repeated draws matters more than a best-of-five showcase.
Tasks are framed as ordinary workplace requests with unsafe openings left available. Boundaries come from records and norms inside the simulated workspaces rather than from an explicit "never reveal X" line in the user prompt. That design matches how real admin asks arrive: underspecified, socially loaded, and attached to shared tools that broadcast side effects.
Results are tied to OpenCode + AgentEnv and the four named configurations. Other IDEs, memory modules, or enterprise policy middleware could move the numbers. The paper's asymmetric risk statement still stands on the reported cells: models frequently complete complex workflows while still breaching unstated boundaries on a material share of repeated attempts. Astra's 72.7% pass^k is the best published cell here and still leaves more than one task in four with at least one unsafe attempt in five. Fable, Gemini, and DeepSeek sit far lower on the same protocol. Procurement decks that quote a single successful demo trajectory are closer to pass@k marketing than to the pass^k bar the authors treat as the consistency signal.
Soft boundaries would need five-of-five compliance
Safe delegation of benign admin workflows would require consistent respect for unstated workplace boundaries across repeated attempts, the pass^k bar BARC uses. Complex-task completion alone would need to predict that consistency. On the reported frontier configurations, Astra still violates on more than a quarter of tasks under pass^k, and weaker configurations fall far lower. pass@k inflation would need to be irrelevant for operational risk; the Gemini and DeepSeek lifts show why best-of-five remains misleading for ship decisions. Enterprise policy packs would need to close the soft-boundary gap on their own evidence; BARC's published cells leave that closure unshown for the four configs.
Overstated for consistent soft-boundary safety
Verdict: overstated as a blanket warrant for safe autonomous delegation of benign workplace admin workflows. Supported only as a capability observation that frontier agents often complete complex multi-step office tasks in simulation. Overstated for consistent soft-boundary safety under underspecified asks, where pass^k on BARC tops out at 72.7% and leaves a 27.3% violation share on the strongest tested configuration.
Require pass^k before handing off calendar and HR tools
"We treat complex-task completion and soft-boundary safety as separate gates. For admin workflows that can leak personnel status on shared calendars, channels, or tickets, we require pass^k-style repeated-attempt safety on a BARC-like suite (or an internal twin) before removing human approval. We report pass@k only as a diagnostic, never as the ship criterion for boundary-sensitive tools."
Pull the BARC paper, re-run or re-score the 110-task suite under the same five-attempt protocol if you have harness access, and report pass^k beside pass@k for the checkpoint you will ship. Map your own high-risk admin flows (off-boarding, access revocation, compensation changes, medical leave) onto equivalent shared-surface side effects and require the same five-of-five bar before removing a human approver. Whether a buyer's policy middleware raises Astra-class pass^k above the published 72.7% on that buyer's own HR and calendar surfaces remains unsettled until measured in situ.