production-ai / readiness-checklist
AI Production Readiness Checklist
An AI system is production-ready when its failure paths are bounded by construction: scoped permissions, a review gate on agent-written code, rehearsed rollback, traces of what agents did, and spend caps that actually bind.
This checklist is the self-serve version of the readiness audit: 37 checks across eight sections. Mark what is honestly true of your system — the unchecked boxes are your findings.
What "ready" means
Readiness is not a vibe of maturity; it is a property you can test. Each check below is phrased as a statement that should be true of the system, not of your intentions. "We trust our people" is not a control. "Merge to main requires a human and branch protection enforces it" is.
The eight sections follow the same order a readiness audit walks: what the agents are and touch (scope), what they may do (permissions), what happens to the code they write (review and merge), what happens when they ship (rollout and rollback), who is watching (observability), what it costs (cost control), what happens when it breaks (incident response), and how the team operates it (process).
The scoring rule
Every unchecked box is a finding. Rank findings by blast radius — what an agent could reach if that guard is missing — and fix the widest ones first. A pilot is ready to widen when every check in sections 1–4 passes and each open item in sections 5–8 has an owner and a date.
Two honest warnings from audits: teams overestimate sections 2 and 3 most (permissions and review are where "we should" quietly stands in for "we did"), and a checklist filled in alone is worth less than one filled in with the person who gets paged.
Get the checklist
Two formats, same content: Markdown (for your repo or wiki) and PDF (for the meeting). Version 1.0, dated, free to use.
Checklist versus audit
The checklist is the map; an audit is the terrain walk. It will tell you that your secrets travel too far — the audit traces exactly which agent can reach which credential through which path, and what to change first. When the unchecked boxes outnumber the evening you have for them: the readiness-audit engagement.
How this methodology holds up in production: the Turbo Rig case study runs these exact categories against one audited week of a governed agent workflow.
Talk it through with someone who runs this stack on his own systems every day.