Production AI Security & Readiness Checklist

# Production AI Security & Readiness Checklist Sanidhyam AI Labs - practical gates before you ship agents, RAG, or automation. ## 1. Scope and ownership - [ ] Written problem statement (what breaks if this is not fixed in 90 days) - [ ] Named business owner and engineering owner - [ ] Success metric defined (deflection %, hours saved, error rate) - [ ] Explicit out-of-scope list ## 2. Data and permissions - [ ] Source systems inventory (docs, tickets, CRM, PII stores) - [ ] ACL / permission model mapped to retrieval or tool access - [ ] Retention and deletion policy documented - [ ] No training on customer PII unless explicitly approved ## 3. Model and tool risk - [ ] Tool allowlist (what the agent may call) - [ ] Human gate for write actions that change money, access, or customer records - [ ] Prompt injection and jailbreak test cases - [ ] Rate limits and cost caps ## 4. Quality before go-live - [ ] Eval set with golden answers / expected tool traces - [ ] Low-confidence escalation path tested - [ ] Citation or audit trail for high-stakes answers - [ ] Staging demo with real users (not only founders) ## 5. Operations - [ ] Monitoring / alerting for failures and latency - [ ] Runbook for model outages and degraded mode - [ ] Weekly review of false positives / missed escalations - [ ] Rollback plan ## 6. Commercial readiness - [ ] Budget band confirmed ($15k-$35k / $25k-$60k / $30k-$75k or custom) - [ ] Security questionnaire owner identified - [ ] Vendor / subprocessors list ready for review --- Need help running this checklist against your stack? Book a scoping call: https://calendly.com/consultation-sanidhyamailabs Developed by Sanidhyam AI Labs, Ahmedabad.