Skip to content
clawproof
$ ls ./navigation/
$clawproof gate --policy 1.0.0
Free operational checklist

AI agent production readiness checklist

Ten controls for deciding whether an AI agent can act in production. Each check includes a concrete acceptance condition, evidence a reviewer can verify, and the failure pattern it is meant to prevent.

Run the five-minute assessment →Run the gate in CI ↗

No email required · browser answers stay on this device · open-source policy

Coverage score

0 to 100 measures declared control coverage.

Release decision

PASS, REVIEW, or BLOCK follows evidence rules.

Important

A high score cannot cancel a critical failure.

The ten controls

What good looks like, and how to prove it.

  1. 01 · Security

    Tool Permissions & Least Privilege

    Your agent starts with read access. Within a month, it has keys to everything.

    Acceptance condition

    Every tool call is checked at runtime against a reviewed, version-controlled permission policy.

    Evidence to retain

    Permission manifest, denied-call test, and review history.

    Failure signal

    The model can invoke any tool that appears in its prompt or registry.

    Read the implementation guide →
  2. 02 · Quality

    Logging & Audit Trails

    When something breaks, can you trace what happened, why, and who approved it?

    Acceptance condition

    One trace identifier reconstructs input, retrieval, model output, tool calls, and approvals end to end.

    Evidence to retain

    Redacted trace, retention policy, and tamper-evidence configuration.

    Failure signal

    An incident report depends on memory, screenshots, or incomplete provider logs.

    Read the implementation guide →
  3. 03 · Security

    Prompt Injection & Data Exfil

    Untrusted content in, secrets out. The attack surface nobody tests.

    Acceptance condition

    Automated adversarial tests prove untrusted content cannot override trusted policy or expand permissions.

    Evidence to retain

    Injection test fixtures, CI result, and outbound destination allowlist.

    Failure signal

    A malicious document or webpage can redirect the agent or choose an arbitrary destination.

    Read the implementation guide →
  4. 04 · Governance

    Human-in-the-Loop & Escalation

    When should an agent stop and ask? Define the boundaries before production.

    Acceptance condition

    Declared risk thresholds pause execution, and timeout or unavailable reviewers produce a safe denial.

    Evidence to retain

    Approval policy, reviewer log, monitored SLA, and timeout test.

    Failure signal

    Human review exists in policy but the action continues when nobody responds.

    Read the implementation guide →
  5. 05 · Operations

    Rollback & Kill Switches

    Can you stop your agent in 30 seconds? If not, you're not production-ready.

    Acceptance condition

    One documented control stops new actions within 30 seconds and has been rehearsed within 90 days.

    Evidence to retain

    Runbook, drill record, elapsed shutdown time, and rollback result.

    Failure signal

    Stopping the agent requires a developer to diagnose or redeploy the system.

    Read the implementation guide →
  6. 06 · Security

    Secrets Management

    API keys in prompts, tokens in logs. Zero secret sprawl or bust.

    Acceptance condition

    Credentials come from a secret manager and automated scanning covers commits, logs, and outputs.

    Evidence to retain

    Secret-store policy, scoped token configuration, and recent scan result.

    Failure signal

    Keys appear in prompts, environment examples, repositories, logs, or model-visible context.

    Read the implementation guide →
  7. 07 · Quality

    Evaluation & Regression Testing

    You upgrade the model. Agent behavior changes. No tests caught it.

    Acceptance condition

    A versioned evaluation suite runs on every prompt, model, and tool change and blocks regressions.

    Evidence to retain

    Representative fixtures, baseline comparison, and CI release result.

    Failure signal

    A new version ships because it looks good in a handful of manual conversations.

    Read the implementation guide →
  8. 08 · Governance

    Data Boundaries & RAG Governance

    Your agent can read everything it retrieves. Can it read everything it should?

    Acceptance condition

    Authorization is enforced at retrieval time and indexed document classes follow a declared policy.

    Evidence to retain

    Retrieval ACL configuration, corpus policy, and cross-tenant isolation test.

    Failure signal

    The source UI hides data, but the agent retrieval layer can still return it.

    Read the implementation guide →
  9. 09 · Operations

    Cost Controls & Rate Limiting

    A runaway loop at 3AM. No spending cap. Monday morning surprise.

    Acceptance condition

    Independent hard caps and per-user rate limits stop execution before provider billing becomes unbounded.

    Evidence to retain

    Budget policy, circuit-breaker test, and alert delivery record.

    Failure signal

    Cost monitoring sends an alert but cannot stop a runaway loop.

    Read the implementation guide →
  10. 10 · Quality

    Multi-Agent Coordination

    Two agents, one resource, zero coordination. Race conditions aren't just for code.

    Acceptance condition

    Shared writes are coordinated, message provenance is explicit, and loops terminate at bounded limits.

    Evidence to retain

    Message schema, conflict test, idempotency keys, and loop-limit test.

    Failure signal

    Peer-agent output is treated as user authority or concurrent agents overwrite each other.

    Read the implementation guide →
Deterministic release policy

Turn the checklist into a CI decision.

PASS

Every answer is yes and every answer has an evidence reference.

REVIEW

Any answer is partial, no, unknown, omitted, or affirmative without evidence.

BLOCK

Any critical control is explicitly answered no, regardless of total score.

git clone https://github.com/lexbeam-software/clawproof-checks.git
cd clawproof-checks
cp examples/gate-review.json clawproof-gate.json
./bin/clawproof gate clawproof-gate.json --format markdown --target my-agent

# exit 0 PASS · exit 2 REVIEW · exit 3 BLOCK · exit 4 INVALID

The CLI is deterministic, uses only the Python standard library, and makes no network calls.

Questions teams ask

Score carefully. Decide separately.

Is a high score enough to release an AI agent?

No. Coverage score and release decision are separate. One explicitly failed critical control produces BLOCK even if the total score is high.

What counts as evidence?

Use a durable reference that a reviewer can verify, such as a policy file, test result, trace, runbook, configuration, or drill record. A yes answer without evidence requires REVIEW.

Does Clawproof certify that an agent is safe?

No. The gate evaluates declared answers and evidence references. It does not inspect or certify a production environment.

Score your agent →Inspect the open-source implementation