# AI Agent Production Readiness Checklist

Source: https://contextosai.com/resources/ai-agent-production-readiness-checklist
Updated: 2026-07-11

Score every item as **proven**, **partial**, **missing**, or **not applicable**. A claim is proven only when it links to a test, policy, trace, dashboard, runbook, or recorded exercise.

## Task and outcome contract

- [ ] Supported intents and out-of-scope requests are explicit.
- [ ] Inputs, outputs, evidence requirements, and allowed outcomes have schemas.
- [ ] Success, partial success, abstention, escalation, and failure are distinguishable.
- [ ] Time, cost, token, retry, and action budgets are enforced.

## Context and evidence

- [ ] Context sources, versions, freshness, and provenance are recorded.
- [ ] Retrieved content is evidence, never executable authority.
- [ ] Token allocation and truncation are deterministic and tested.
- [ ] Conflicting or missing evidence produces a visible verdict or escalation.

## Tools, identity, and authorization

- [ ] Only tools resolved for the current task and principal are model-visible.
- [ ] Tool calls carry user delegation and agent workload identity.
- [ ] Arguments, object scope, data class, and outbound disclosure are externally enforced.
- [ ] Side effects have approval modes, idempotency, and reversal or compensation paths.

## Verification and evaluation

- [ ] Plans are checked before high-impact execution and observations afterward.
- [ ] Golden sets cover normal, boundary, adversarial, and known-failure cases.
- [ ] Policy, utility, safety, latency, and cost have release thresholds.
- [ ] Runtime changes run regression evaluation before release.

## Trace, replay, and audit

- [ ] Run, trace, session, decision, tool, and policy identifiers correlate.
- [ ] Model, prompt, context, policy, tool, and evaluator versions are pinned.
- [ ] Requests, results, approvals, evidence, and mutations are recorded.
- [ ] Critical decisions can be replayed against a pinned environment.

## Security and failure containment

- [ ] Prompt injection cannot grant authority, expose tools, or bypass policy.
- [ ] Secrets are excluded or explicitly redacted from prompts and traces.
- [ ] Timeouts, retries, circuit breakers, limits, and dependency failures are typed.
- [ ] Kill switch, authority downgrade, and safe fallback are tested.

## Memory and learning

- [ ] Working state is separate from durable memory and authoritative knowledge.
- [ ] Memory writes have provenance, consent, sensitivity, retention, and review state.
- [ ] Contradictions and revocations are handled before recall.
- [ ] Corrections become evaluated, reviewed release candidates.

## Rollout and operations

- [ ] Rollout moves through offline, shadow, internal, low-risk, and monitored stages.
- [ ] Dashboards expose quality, denials, escalations, latency, cost, and unsafe actions.
- [ ] Owners and response procedures exist for agent, policy, tool, data, and security incidents.
- [ ] Rollback criteria, on-call access, and evidence-preserving incident review are rehearsed.