Agents · 5 min read
What “production-grade” actually means for an AI agent.
Six things you should be able to point at, in writing, before you let an agent touch a system of record. We use this list ourselves.
The phrase “production-grade” is used so often that it has stopped meaning anything. Here is what we mean when we use it — six artefacts that should exist, in writing, before an agent goes live.
- 01
A named business owner
Someone in the business accepts accountability for the outcome and operating risk — not the vendor.
- 02
Documented process & approvals
The workflow, human approvals and exception paths are written down, reviewed and versioned.
- 03
Approved data & access
Sources, access rights, retention and permitted use are signed off before any model touches them.
- 04
Defined & tested targets
Accuracy, safety, reliability, latency and cost targets are specified and measured against evaluation sets.
- 05
Least privilege by default
Agent permissions, scopes and transaction limits follow least privilege — and are reviewed regularly.
- 06
Operational controls
Monitoring, logging, incident response, rollback and shutdown controls are in place before go-live.
- 07✓Applied to every engagement — including our own.
Financial baseline
A baseline and benefits-measurement plan are agreed before launch — so success can be evidenced.
If any of the seven cannot be produced on demand, the agent is not production-grade — it is a demo with a deployment date.
We apply the same seven gates to every engagement we take, and to every internal agent we run ourselves. That is the only credible posture for an AI-native company — and the only one your risk committee will accept.