AI Production Readiness Framework

Untrusted input (including model-generated text) shall never authorize privileged tool or side-effect actions without server-side policy—so prompt injection and privilege escalation cannot bypass the control plane.

Customer-facing releases shall run an abuse/jailbreak/injection security suite—with those case classes present—as a blocking gate, or record a time-boxed waiver (owner + expiry ≤30 days) when the gate does not pass.

Customer-facing AI HTTP/RPC APIs shall reject callers that present no valid credentials—so anonymous traffic cannot invoke model, tool, retrieval, or other privileged AI surfaces.

Production MCP and AI service-to-service connections shall authenticate with a named machine identity—so anonymous access and shared long-lived static keys cannot stand in for workload or federated identity.

Administrative access to AI control planes shall require strong authentication including MFA—so operators who can change prompts, tools, models, or deployments cannot rely on password-only or shared credentials.

Privileged AI feature, tool, and retrieval entry points shall enforce authorization server-side—so authenticated callers lacking required permission or scope cannot invoke those surfaces.

Multi-tenant AI data and memory paths shall deny unauthorized cross-tenant reads and writes—proven by an automated attack suite, not by tenant filters in code alone.

Production secrets shall resolve from a secrets manager at runtime and must not appear in repos, prompt registries, or client bundles—proven by secrets-manager wiring plus a fresh secret-scan covering prompts/fixtures, not by CI ${{ secrets.* }} alone.

Logging and tracing pipelines shall redact secret-like patterns—proven by redaction/masking config plus a fresh canary harness that injects API key/bearer/AWS-key patterns and shows 100% redaction in persisted logs/traces, not by filter code alone.

Every production tool invocation shall be authorized server-side by an independent authz decision—proven by coverage of production tool-invocation paths plus automated deny tests at 100%, not by prompt instructions, client-side checks, or model-proposed tool name/args alone.

Production agents and workloads shall have an explicit tool allowlist, and unknown or model-invented tool names shall be rejected at runtime—proven by an inventory of production agents that can invoke tools, 100% allowlist coverage, automated unknown-tool deny tests, and runtime rejection of invented names—not by open MCP "all tools" bindings, prompt-only restrictions, or a deny suite that covers only a subset of agents.

Tools rated write, irreversible, or financial shall require an additional gate beyond base tool authz/allowlist—human approval, dual control, or a policy engine—proven by a complete impact-tiered inventory of production high-impact tools, 100% gate coverage, and automated tests that ungated execution is impossible—not by prompt "ask a human" text, base allowlists, or a bypass suite that covers only a subset of high-impact tools.

Production external AI tools, MCP servers, agent plugins, and high-impact integrations shall be inventoried with version pins, named owners, and recurring review—proven by an inventory covering those surfaces with 0 unpinned “latest”/floating entries, not by CI Action SHA pins or package lockfiles alone.

AI data stores and control planes shall not be publicly reachable without authentication—proven by a current CSPM or network scan plus authenticated edge controls or private-only exposure, not by private-subnet intent alone.

Product domains shall maintain a versioned, owned AI safety policy that includes domain-specific harm categories with refuse-vs-escalate actions for each—so safety filters and human escalation are grounded in explicit policy, not ad-hoc judgment.

In-scope releases shall run an automated safety evaluation suite with numeric thresholds that blocks promote on fail—unless a time-boxed waiver (expiry ≤14 days) with a named owner is recorded.

Where policy or law requires it, in-scope user surfaces shall disclose that the user is interacting with AI—so people are not misled about automated vs human counterparts.

Every production path that sends data to models shall apply a documented classification scheme covering AI payload classes, and every sensitive class shall have written handling rules (allow, redact, block, or equivalent).

Where regulation or policy requires it, users or tenants shall have documented deletion and/or export paths that cover AI memory (conversation, durable, or retrieval-augmented stores) and in-scope AI logs, with a tested completion within a published SLA.

AI memory stores (conversation, durable, and retrieval/vector memory) shall enforce tenant isolation—and user isolation where policy requires it—proven by automated attack tests with zero successful unauthorized reads or writes.

Critical production AI paths shall reference immutable, pinned model identifiers, and shall not use floating aliases such as “latest” (or equivalent provider defaults that can change without a deploy).

Every production prompt shall carry an immutable version identifier and a named owner in a registry (or equivalent versioned store)—with zero unversioned production prompts and zero prompts missing an owner.

Production prompt releases shall go through human (or equivalent) review and link a passing eval artifact before promotion, with promote-without-review-and-eval blocked on the release path.

Every journey marked critical shall have a versioned offline eval suite, and every relevant production change in the last 30 days shall have triggered that suite—or carry a documented waiver ≤14 days.

Production release gates shall require numeric minimum thresholds for at least one quality metric and one safety metric on every critical journey, and shall block deploy in CI when those thresholds are not met.

Every production agent runtime shall enforce finite execution bounds including reasoning/tool iterations, execution duration, and recursive delegation depth where supported. Bounds shall be enforced by runtime or platform controls rather than prompts or model instructions. Exceeding any bound shall terminate or safely abort execution so the agent cannot continue planning or dispatch further side effects after abort. Applies to agent frameworks, orchestration frameworks, workflow engines with agent loops, MCP clients, MCP servers acting autonomously, A2A runtimes, and multi-agent systems. Not applicable to simple chat-completion APIs, single-inference endpoints, embeddings, classifiers, or rerankers without multi-step / tool / delegation autonomy.

Every high-impact action class an AI system or agent can invoke in production (write/irreversible/financial/external-comms/privileged side effects) shall be listed in a versioned inventory and blocked until a human approval gate succeeds. Ungated execution of inventoried classes shall fail closed.

Human approval gates for high-impact actions shall apply on every entry path (UI, API, agent/tool, batch/job)—not only the primary console. Alternate-path bypass tests shall show 0 successful ungated high-impact executions.

Production AI paths must emit distributed traces that connect the parent user/request ID through model spans, tool spans, and the request outcome.

Every journey marked critical must have documented numeric availability and latency-percentile SLO targets in a maintained catalog.

Every production model and tool client call site shall declare a finite timeout and a finite max-retry bound—verified by static analysis or integration test—so hung providers and retry storms cannot cascade.

Every critical user journey that depends on AI shall document degraded behavior when the AI dependency fails, and a failover test shall show a non-AI or safe fallback activates—not a blank error or silent hang.

Production prompt, model, and tool releases must flow through a documented non-prod→prod promotion path, with no production hot-edits lacking a linked change record.

Production systems shall retain at least N prior production versions of each in-scope artifact type (prompts and/or model pins) per policy (minimum N=2) and prove a restore dry-run that loads the immediate prior version in staging or a prod-adjacent environment.

Production systems shall complete ≥1 successful rollback (drill or real incident) in the last 90 days with measured time-to-restore ≤ documented RTO.

Production AI systems must maintain incident playbooks for abuse, data leakage, bad agent/tool actions, and provider outage—each with a named owner and a review date within the last 12 months.

On-call must be able to pause agents, disable tools, and roll back prompts or models, proven by a drill in the last 90 days completed within documented time budgets.

Production AI workloads shall enforce finite hard spend ceilings and/or request rate limits (provider, gateway, or application) that deny or throttle when exceeded—not soft dashboards or prompt-only budgets alone.

Production AI clients shall enforce finite retry/backoff and loop budgets so forced failures cannot amplify completions without bound—covering HTTP/SDK clients and agent loops, not prompt-only “try again” guidance.