# Production AI Security & Readiness Checklist

Sanidhyam AI Labs - practical gates before you ship agents, RAG, or automation.

## 1. Scope and ownership
- [ ] Written problem statement (what breaks if this is not fixed in 90 days)
- [ ] Named business owner and engineering owner
- [ ] Success metric defined (deflection %, hours saved, error rate)
- [ ] Explicit out-of-scope list

## 2. Data and permissions
- [ ] Source systems inventory (docs, tickets, CRM, PII stores)
- [ ] ACL / permission model mapped to retrieval or tool access
- [ ] Retention and deletion policy documented
- [ ] No training on customer PII unless explicitly approved

## 3. Model and tool risk
- [ ] Tool allowlist (what the agent may call)
- [ ] Human gate for write actions that change money, access, or customer records
- [ ] Prompt injection and jailbreak test cases
- [ ] Rate limits and cost caps

## 4. Quality before go-live
- [ ] Eval set with golden answers / expected tool traces
- [ ] Low-confidence escalation path tested
- [ ] Citation or audit trail for high-stakes answers
- [ ] Staging demo with real users (not only founders)

## 5. Operations
- [ ] Monitoring / alerting for failures and latency
- [ ] Runbook for model outages and degraded mode
- [ ] Weekly review of false positives / missed escalations
- [ ] Rollback plan

## 6. Commercial readiness
- [ ] Budget band confirmed ($15k-$35k / $25k-$60k / $30k-$75k or custom)
- [ ] Security questionnaire owner identified
- [ ] Vendor / subprocessors list ready for review

---

Need help running this checklist against your stack? Book a scoping call: https://calendly.com/consultation-sanidhyamailabs

Developed by Sanidhyam AI Labs, Ahmedabad.