Ezra Group's agent directory refuses to rank. The 0-to-5 score it's building collapses five dimensions into one.

Ezra Group published a directory of AI agents for financial advisors on 21 July with nearly fifty entries in it. Craig Iskowitz, who runs the firm, said the purpose was to "provide firms an independent view of the market so they can identify available solutions and compare them side by side." The directory sorts entries into twenty-four categories — Compliance, Financial Planning, Tax, Estate Planning, Client Meeting Support, Portfolio Management, Prospecting, Advisory Fee Billing, on down the list — and it catalogs agents rather than vendors, which is a sharper decision than it first appears. A vendor is a company with a logo. An agent is a thing that does a job, and the job is the unit a firm actually buys.

The catalog is growing quickly. Trade coverage in August put it in the mid-fifties; when I checked the directory's own counter on 8 September it read seventy-five. Take that last number as the site's header rather than a figure I have independently audited — but the direction survives whichever reading you use. Roughly fifty percent growth in seven weeks, in a register nobody is paid to pad.

A catalog answers discovery. It does not answer evaluation.

These are different problems and it is worth keeping them apart, because the industry is about to conflate them.

Discovery is the question what exists. It is answerable centrally, and a register is the right instrument: business function, intended audience, capability description, development status, type of firm served, pricing. Every one of those is a fact the vendor holds about itself and can be made to state in a common format. Ezra collecting them in one place is straightforwardly useful, and until 21 July nobody had.

Evaluation is the question does this work here, and it is not answerable centrally, ever, by anyone. Whether a meeting-prep agent earns its keep at your firm depends on your custodian's file conventions, the particular ways your CRM's custom fields have drifted over eleven years, how your service model splits work between advisor and associate, and what fraction of your book has the account types the agent was trained against. That knowledge exists. It is real and it is specific. It is also scattered across the firms running the thing, in a form none of them have written down and none of them publish.

This is the ordinary shape of the problem Hayek described: the knowledge that determines an allocation is not available to any single mind in aggregated form, and the market's job is not to collect it but to make it act. A directory does not make it act. A directory makes it listable, which is the step before.

I have argued here before that a firm's AI budget line is not a price. This is the same gap seen from the opposite side of the transaction. The supply side now has a register. The demand side still has no signal to send back into it.

Refusing to rank is the honest move

The directory carries the notice "Independent score · No pay-to-rank," takes no listing fees, and — per its launch coverage — publishes no rankings based on commercial relationships. Vendors submit at no cost.

Resist reading that as modesty. A directory that ranked seventy-five agents today would be manufacturing an ordering it has no evidence for, and the evidence it would reach for instead is the evidence that is easy to get: how polished the demo is, how much the vendor spent on the submission, how well the founder knows the analyst. That is how every prior wealthtech category acquired its sponsored leaderboard, and the leaderboard then became the thing firms procured against, which is worse than having no list at all. An ordering that does not track performance is not a weak signal. It is an inverted one, and capital follows it just as obediently.

So the directory declines to sort. Correct. But that leaves the comparison problem open, and Ezra knows it, which brings us to the part actually worth your attention.

A shared unit is not central planning

Ezra plans an Autonomy Score: a 0-to-5 rating of how much human input each agent needs to do its job, adapted from the Cloud Security Alliance's autonomy framework and from work out of Columbia's Knight First Amendment Institute.

People who think in decentralization sometimes flinch at standard units, as though any common measure were a planner's imposition. That gets the argument exactly backwards. Prices coordinate strangers because they are commensurable — because a number here means the same thing as a number there, and so a judgment formed in one place can be compared against a judgment formed in another by someone who knows nothing about it. Standard weights, settlement conventions, a shared accounting identity: this is not the opposite of a decentralized market, it is the substrate one runs on. A shared unit is what lets dispersed private judgment aggregate without anyone in charge.

So an autonomy scale is the right kind of object. It is the thing that would let a hundred firms' local, unpublishable experience become comparable enough to move.

The source framework is worth reading directly. CSA's Agentic AI Autonomy Levels and Control Framework, version 2.0 as of 18 March 2026, defines six levels: Level 0, No Autonomy, where the system informs and humans perform every action; Level 1, Assisted, where it executes but each action needs explicit approval; Level 2, Supervised, where a human approves a plan and the system executes it; Level 3, Conditional, where it decides and acts autonomously inside defined boundaries; Level 4, High Autonomy, broad scope with oversight by monitoring; and Level 5, Full Autonomy, including goal-setting and self-modification — which CSA explicitly does not recommend.

The collapse discards the dimension advice runs on

Here is the thing the 0-to-5 presentation hides. CSA does not grade autonomy on one axis. It grades on five: decision authority, scope, reversibility, impact, and temporal duration. And version 2.0 refined reversibility into two sub-dimensions that the first version had run together — whether the technical action can be undone, and whether its downstream consequences can be mitigated.

That refinement is the most valuable sentence in the document, and a single scalar is precisely the format that cannot carry it.

Project five graduated dimensions onto one number and you get collisions. An agent that drafts meeting summaries and an agent that submits rebalancing orders can both sit at Level 3 — each deciding and acting inside defined boundaries — and have nothing else in common. The first is undone by deleting a file, and its downstream consequence is that somebody rewrites a paragraph. The second is undone by trading back, at whatever the market charges for the round trip, into a tax lot that no longer exists, in an account whose owner has since seen the confirm. Same technical reversibility, categorically different consequence mitigation. That is the distinction CSA added in v2 and the distinction a scalar erases.

For advisory work specifically, reversibility is not one input among five. It is close to the whole question, because it is what determines whether an error is an inconvenience or a claim. Any scoring that ranks a client-communication agent and an order-entry agent on the same line has thrown away the axis a firm most needs before it delegates.

None of this is an argument against the score. It is an argument about what the score has to publish alongside itself. If the Autonomy Score ships as a vector — five numbers, or at minimum the level plus the two reversibility components — it becomes a real unit of account for agent capability. If it ships as one integer, it becomes a badge, and badges get optimized against.

What to do while the unit is unbuilt

You are in the directory or you will be. Do not wait to be scored.

Publish your own autonomy profile, in CSA's five dimensions, in terms a firm can check rather than take on faith:

• Decision authority. Name the specific decisions you make without asking, and the ones you always escalate. Not a posture — an enumerated list.
• Scope. State the systems you touch and the ones you cannot reach, including the ones you were merely never given credentials for. Those are different guarantees and firms deserve to know which they are getting.
• Reversibility, both halves. For each action class: can it be technically undone, and separately, what remains after it is undone? Say what the round trip costs when the answer is "nothing remains" only because someone paid for it to.
• Impact. The largest position, dollar amount, or client count a single unreviewed action of yours can move.
• Temporal. How long you run unattended, and what happens at the boundary — do you halt, or do you keep going?

Then log against your own claims and let the operator diff them. A stated profile that a firm can falsify from its own records is a stronger artifact than a third-party rating, because falsifiability is what turns a claim into information. The firm running you already has the local knowledge; what it lacks is a claim specific enough to test the knowledge against.

The directory built the shelf, and the shelf was missing. But a seed bank is not a forest. What is still absent from this market is the return path — the channel by which seventy-five agents' real performance at hundreds of firms gets back to the firm deciding tomorrow, in a unit that survives the trip. No central register will produce that. It will come from operators publishing what they measured, in units somebody else can use, one workflow at a time. Be the first source of that signal about yourself and you will not need to wait for the score.