# Agent Production Readiness Checklist

> Companion artifact 7 of 7 — *Agentic AI Governance: Standards and Guardrails*
> R2 Digital LLC · https://ravikrali.github.io/Agentic-AI-Governance/
>
> The gate between "it works in the demo" and "it runs against real customers and real money."
> Scale the required depth to the action risk class, not to how impressive the agent looks.
>
> **A1** informational · **A2** drafts and proposals · **A3** state changes inside an envelope
> · **A4** money, entitlements, external communication, irreversible effects
>
> Legend: **●** required · **○** recommended · **–** not applicable

---

## 1. Identity and accountability

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 1.1 | Agent registered with identity, purpose, tier, data classes and expiry | ● | ● | ● | ● | Registry record | |
| 1.2 | Named accountable owner has explicitly accepted the agent | ● | ● | ● | ● | Ownership attestation | |
| 1.3 | Operations owner identified and holds the kill switch | ● | ● | ● | ● | Runbook | |
| 1.4 | Orphan detection active for owner departure or role change | ● | ● | ● | ● | Registry config | |
| 1.5 | Agent card published and readable by a non-engineer | ● | ● | ● | ● | Repository | |
| 1.6 | Provider or deployer role determined for each applicable regime | ○ | ○ | ● | ● | Legal note | |

## 2. Authorization and entitlement

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 2.1 | Delegated principal scope propagated and re-evaluated on every call | ● | ● | ● | ● | Decision log | |
| 2.2 | Effective authority proven never to exceed the principal's | ● | ● | ● | ● | Test results | |
| 2.3 | Short-lived, audience-restricted credentials only; no standing secrets | ● | ● | ● | ● | Token issuance log | |
| 2.4 | Token audience validated by receivers; no passthrough to downstream APIs | ● | ● | ● | ● | Broker config | |
| 2.5 | Read and write paths separated by identity and grant | ○ | ● | ● | ● | Registry | |
| 2.6 | Confused-deputy scenario reviewed and mitigated | ○ | ○ | ● | ● | Threat model | |

## 3. Deterministic hard limits

*These are the safety boundary. Model-based screening supplements them and does not replace them.*

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 3.1 | Tool allow-list fixed for the task; cannot expand mid-run | ● | ● | ● | ● | Envelope definition | |
| 3.2 | Parameter allow-lists and range validation enforced server-side | ● | ● | ● | ● | Contract tests | |
| 3.3 | Value, quantity and rate caps on every mutating tool | – | ○ | ● | ● | Policy bundle | |
| 3.4 | Tenant, record and data-residency boundaries enforced | ● | ● | ● | ● | Policy bundle | |
| 3.5 | Network egress deny-by-default from the agent runtime | ○ | ● | ● | ● | Network policy | |
| 3.6 | Code execution sandboxed, ephemeral, no production credentials | ● | ● | ● | ● | Runtime config | |
| 3.7 | Step, token, spend and wall-clock budgets bound at task start | ● | ● | ● | ● | Telemetry | |
| 3.8 | Maximum delegation depth and fan-out configured | ○ | ○ | ● | ● | Orchestrator config | |
| 3.9 | Circuit breakers on repeated action and error-rate thresholds | ○ | ● | ● | ● | Config + test | |
| 3.10 | Blast-radius cap per action class | – | ○ | ● | ● | Policy bundle | |

## 4. Reversibility

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 4.1 | Every mutating tool declares an idempotency key | – | ● | ● | ● | Contract tests | |
| 4.2 | Every mutating action has a documented compensating action | – | ● | ● | ● | Tool registry | |
| 4.3 | Automatic rollback bound to each mutating action class | – | ○ | ● | ● | Config | |
| 4.4 | Rollback rehearsed in the target environment | – | ○ | ● | ● | Rehearsal record | |
| 4.5 | Irreversible actions identified and gated behind approval | – | – | ● | ● | Policy bundle | |

## 5. Human control

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 5.1 | Approval threshold defined and enforced by policy, not convention | – | ● | ● | ● | Policy bundle | |
| 5.2 | Approvers see the diff and underlying evidence, not only a summary | – | ● | ● | ● | UI review | |
| 5.3 | Approval record captures what was shown and time to decision | – | ○ | ● | ● | Approval log | |
| 5.4 | Approval requests expire; stale approvals cannot execute | – | ○ | ● | ● | Config | |
| 5.5 | Dual control on the highest risk class | – | – | ○ | ● | Policy bundle | |
| 5.6 | Approval volume per reviewer capped and monitored | – | ○ | ● | ● | Dashboard | |
| 5.7 | Pause, take over and shut down each work within seconds | ● | ● | ● | ● | Drill record | |
| 5.8 | Kill switch tested at per-agent, per-tool and global scope | ● | ● | ● | ● | Test log | |
| 5.9 | Users told an agent is involved and given a route to a person | ○ | ● | ● | ● | UX review | |

## 6. Evidence and observability

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 6.1 | Evidence written before the action; failed logging fails the action | ● | ● | ● | ● | Gateway config | |
| 6.2 | Decision log append-only and tamper-evident | ○ | ● | ● | ● | Store config | |
| 6.3 | Policy bundle version recorded on every decision | ● | ● | ● | ● | Decision log | |
| 6.4 | Traces emitted using the pinned OTel GenAI convention version | ● | ● | ● | ● | Telemetry config | |
| 6.5 | Enterprise telemetry extensions in place for policy decisions, approvals, delegation, memory and outcomes | ○ | ● | ● | ● | Schema | |
| 6.6 | Any run reconstructable end to end from the trace | ● | ● | ● | ● | Replay test | |
| 6.7 | Retention horizon set per data class; deletion path tested | ○ | ● | ● | ● | Retention policy | |
| 6.8 | Cost and token telemetry per agent, task and tenant | ● | ● | ● | ● | Dashboard | |

## 7. Evaluation

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 7.1 | Golden set built from real traces, not only synthetic cases | ● | ● | ● | ● | Eval repo | |
| 7.2 | Thresholds published in the agent card and agreed with the business | ● | ● | ● | ● | Agent card | |
| 7.3 | Eval gate blocks promotion below threshold in CI | ● | ● | ● | ● | Pipeline | |
| 7.4 | Severity-weighted scoring; critical failures cannot be averaged away | ○ | ● | ● | ● | Scorecard | |
| 7.5 | Confidence interval reported on the headline metric | ○ | ○ | ● | ● | Scorecard | |
| 7.6 | Adversarial suite covers injection, tool misuse and memory poisoning | ○ | ● | ● | ● | Red-team report | |
| 7.7 | Independent red team before release | – | – | ○ | ● | Report | |
| 7.8 | Judge model calibrated against human raters; agreement tracked | ○ | ● | ● | ● | Calibration record | |
| 7.9 | Shadow run against live traffic completed and compared | – | ○ | ● | ● | Comparison report | |
| 7.10 | Production sampling configured with alerting on trend breaks | ○ | ● | ● | ● | Job config | |

## 8. Supply chain

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 8.1 | All tools, skills and prompt packs loaded from the private registry | ● | ● | ● | ● | Registry | |
| 8.2 | Artifacts signed and version-pinned; signature verified at load | ● | ● | ● | ● | Verification log | |
| 8.3 | Model versions pinned; upgrades pass the release gate | ● | ● | ● | ● | Gateway config | |
| 8.4 | SBOM produced and stored per release | ○ | ● | ● | ● | Artifact store | |
| 8.5 | Third-party MCP servers reviewed and internally owned | ● | ● | ● | ● | Review record | |

## 9. Resilience

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 9.1 | Behaviour defined for model unavailability, tool timeout, plan loop and wrong answer | ● | ● | ● | ● | Design doc | |
| 9.2 | Policy decision point failure mode is fail-closed | ● | ● | ● | ● | Config + test | |
| 9.3 | Decision caching and staleness window defined and logged | ○ | ○ | ● | ● | Config | |
| 9.4 | Enforcement is distributed; no single point takes the whole platform down | ○ | ● | ● | ● | Architecture review | |
| 9.5 | Control-plane latency SLO defined for this workload and measured | ○ | ● | ● | ● | Dashboard | |
| 9.6 | Model gateway failover tested | ○ | ● | ● | ● | Test record | |
| 9.7 | Change freezes apply to agents as they do to people | ○ | ● | ● | ● | Change policy | |

## 10. Operations and lifecycle

| # | Check | A1 | A2 | A3 | A4 | Evidence | Done |
|---|---|:--:|:--:|:--:|:--:|---|:--:|
| 10.1 | Runbook written and reachable from the alert | ● | ● | ● | ● | Runbook | |
| 10.2 | Alerts route to a person who can act | ● | ● | ● | ● | Routing config | |
| 10.3 | Incident drill run for the worst credible outcome | – | ○ | ● | ● | Drill report | |
| 10.4 | Operator view consolidated — identity, policy, traces, evals, cost | ○ | ● | ● | ● | Console | |
| 10.5 | Expiry date set; re-certification scheduled | ● | ● | ● | ● | Registry | |
| 10.6 | Retirement plan written: notification, revocation, evidence archive | ○ | ● | ● | ● | Agent card | |
| 10.7 | Owner has formally accepted the residual risk | ○ | ● | ● | ● (escalate to risk committee) | Sign-off | |

---

## Go / no-go

| Role | Name | Decision | Date | Conditions |
|---|---|---|---|---|
| Agent owner | | | | |
| Engineering lead | | | | |
| Security architect | | | | |
| Evaluation lead | | | | |
| Risk & compliance partner | | | | |
| Operations owner | | | | |

**Blocking rule:** any unchecked **●** for the agent's risk class blocks release, or is
recorded as a formally accepted, time-limited exception with a named owner and a closure date.