# AI Agent Deployment Checklist

**Agent:** _______________  **Date:** _______

## 1. Is this the right task for an agent?

- [ ] The task has **many steps**
- [ ] It has a **clear, verifiable success criterion**
- [ ] The cost of a mistake is tolerable and correctable
- [ ] The steps **vary** — if they are always the same, write a script instead
- [ ] It is tedious, high-volume work a person is glad to hand over

**Ruled out if any of these are true:**

- [ ] There is no clear definition of "done"
- [ ] Actions are irreversible
- [ ] It needs judgement where accountability matters

## 2. The reliability arithmetic

| Steps | Success rate at 95% per step |
|---|---|
| 5 | 77% |
| 10 | 60% |
| 20 | 36% |

- [ ] Expected chain length estimated: ______ steps
- [ ] Resulting completion rate acceptable to the business
- [ ] If not: chain shortened, or per-step reliability raised. **There is no third option**

## 3. Tools — the most important section

- [ ] Complete list written down
- [ ] **Each tool is specific**, not general (`get_customer_orders`, never `run_query`)
- [ ] Read-only unless writing is genuinely required
- [ ] Each tool reviewed: could it be used for an unintended purpose?
- [ ] **Tool chaining assessed** — read + send is an exfiltration path even if neither is dangerous alone
- [ ] **No component holds both broad read and broad write access**

## 4. Permissions

- [ ] Runs with the **requesting user's permissions**, not a service account
- [ ] Cannot reach systems beyond its declared tools
- [ ] Permission checks happen at the tool, not in the prompt

## 5. Gates and caps

- [ ] **Human approval before anything destructive**
- [ ] **Human approval before anything financial**
- [ ] **Human approval before anything outbound** (email, message, publication)
- [ ] Approval cannot be bypassed by rephrasing the task
- [ ] **Maximum steps per task** — enforced, verified by triggering it
- [ ] **Maximum time per task** — enforced
- [ ] **Maximum spend per task** — enforced

## 6. Observability

- [ ] Every decision logged: what it chose and why
- [ ] Every tool call logged with actor, arguments, result
- [ ] Full trajectory retrievable for any given run
- [ ] Stored memory / context can be **inspected and cleared**
- [ ] Incomplete tasks surfaced, never reported as complete

## 7. Failure behaviour verified

- [ ] Tool failure → retries sensibly or reports. Does not give up silently
- [ ] Impossible task → stops and says so
- [ ] Ambiguous instruction → asks or states its assumption
- [ ] Interruption → leaves consistent state

## 8. Security

- [ ] Goal hijacking tested — hostile instructions in retrieved content
- [ ] Memory poisoning tested
- [ ] Permission boundary tested
- [ ] Findings converted to permanent regression cases

## 9. Rollout

- [ ] **Read-only first** — proposes actions rather than taking them
- [ ] Run in parallel with the current process before switching
- [ ] Write access added **one tool at a time**
- [ ] Metrics from day one: completion rate, steps, cost per completed task, failure behaviour

## 10. Ownership

- [ ] Named owner accountable for its behaviour
- [ ] Named person who can switch it off
- [ ] Written statement of what it does and does **not** decide
- [ ] **AI disclosure in place** where it interacts with people (EU AI Act Art. 50, in force since 2 Aug 2026)

## Sign-off

| | Name | Date |
|---|---|---|
| Built by | | |
| Security review | | |
| Approved to act on production systems by | | |