AI Agent Deployment Checklist

Agent: _______________ Date: _______

1. Is this the right task for an agent?#

• [ ] The task has many steps
• [ ] It has a clear, verifiable success criterion
• [ ] The cost of a mistake is tolerable and correctable
• [ ] The steps vary — if they are always the same, write a script instead
• [ ] It is tedious, high-volume work a person is glad to hand over

Ruled out if any of these are true:

• [ ] There is no clear definition of "done"
• [ ] Actions are irreversible
• [ ] It needs judgement where accountability matters

2. The reliability arithmetic#

• [ ] Expected chain length estimated: ______ steps
• [ ] Resulting completion rate acceptable to the business
• [ ] If not: chain shortened, or per-step reliability raised. There is no third option

3. Tools — the most important section#

• [ ] Complete list written down
• [ ] Each tool is specific, not general (get_customer_orders, never run_query)
• [ ] Read-only unless writing is genuinely required
• [ ] Each tool reviewed: could it be used for an unintended purpose?
• [ ] Tool chaining assessed — read + send is an exfiltration path even if neither is dangerous alone
• [ ] No component holds both broad read and broad write access

4. Permissions#

• [ ] Runs with the requesting user's permissions, not a service account
• [ ] Cannot reach systems beyond its declared tools
• [ ] Permission checks happen at the tool, not in the prompt

5. Gates and caps#

• [ ] Human approval before anything destructive
• [ ] Human approval before anything financial
• [ ] Human approval before anything outbound (email, message, publication)
• [ ] Approval cannot be bypassed by rephrasing the task
• [ ] Maximum steps per task — enforced, verified by triggering it
• [ ] Maximum time per task — enforced
• [ ] Maximum spend per task — enforced

6. Observability#

• [ ] Every decision logged: what it chose and why
• [ ] Every tool call logged with actor, arguments, result
• [ ] Full trajectory retrievable for any given run
• [ ] Stored memory / context can be inspected and cleared
• [ ] Incomplete tasks surfaced, never reported as complete

7. Failure behaviour verified#

• [ ] Tool failure → retries sensibly or reports. Does not give up silently
• [ ] Impossible task → stops and says so
• [ ] Ambiguous instruction → asks or states its assumption
• [ ] Interruption → leaves consistent state

8. Security#

• [ ] Goal hijacking tested — hostile instructions in retrieved content
• [ ] Memory poisoning tested
• [ ] Permission boundary tested
• [ ] Findings converted to permanent regression cases

9. Rollout#

• [ ] Read-only first — proposes actions rather than taking them
• [ ] Run in parallel with the current process before switching
• [ ] Write access added one tool at a time
• [ ] Metrics from day one: completion rate, steps, cost per completed task, failure behaviour

10. Ownership#

• [ ] Named owner accountable for its behaviour
• [ ] Named person who can switch it off
• [ ] Written statement of what it does and does not decide
• [ ] AI disclosure in place where it interacts with people (EU AI Act Art. 50, in force since 2 Aug 2026)

Sign-off#

Back to AI Agents