The Agent Production Checklist

40 questions your architecture must answer before agents touch production. This is the method I use in Architecture Second Opinion sessions, published in full. No email gate. Quote it, link it, run it against your own system.

How to use it: read each question and try to answer it in one sentence, today, without investigating. Count the ones you cannot. Each of those is a risk you are shipping, whether you name it or not. In my experience the expensive incidents hide behind the questions that get answered with "I'd have to check".

Credentials and blast radius

1. Can any agent read a credential that outlives its current task?
2. If this agent were fully compromised right now, can you name exactly what it can reach, without investigating first?
3. Do agents hold real secrets, or short-lived scoped tokens issued per call by a broker?
4. Can you revoke one agent's access without rotating a credential that other things share?
5. Does every outbound call from an agent pass through a chokepoint you control, or can it call anywhere on the internet?
6. Are an agent's permissions scoped to its current task, or the union of everything it might ever need?
7. What stops a prompt-injected agent from exfiltrating the credentials it does hold?
8. Can you list which secrets each agent was granted last month, and how long would producing that list take?

Memory and state

9. When the agent's memory and your database disagree, which one is the source of truth, and does the code know that?
10. Can you delete one person's data from agent memory on request, and prove the deletion happened?
11. Does memory grow without bound, or is there consolidation and expiry with semantics someone can state?
12. Can a poisoned memory entry, stored today and recalled next month, steer future actions? What validates recall?
13. Is content that crosses from one agent to another treated as untrusted input?
14. After a restore from backup, are agent memories and system state consistent with each other?
15. Which memories are load-bearing for correctness, and are those typed and validated rather than free text?
16. Can two concurrent agent instances corrupt shared state through races or lost updates?

Audit and observability

17. Can you reconstruct, step by step, why an agent took a specific action last Tuesday?
18. Would you detect it if someone deleted or edited an entry in the agent action log?
19. Do you log the inputs that drove each action, or only the action?
20. Does each agent instance have its own identity in your logs, or does everything appear as one service account?
21. What alert fires when an agent's behavior turns anomalous in rate, scope, or cost, and who receives it?
22. Can a security or compliance reviewer read the audit trail without an engineer sitting next to them?
23. How long are agent decision traces retained, and does that number come from your regulator or from a default?
24. When the model provider silently updates the model, will your logs show you the before and after?

Failure modes and scale

25. When the model API is down for an hour, does your system queue, degrade, or cascade?
26. What bounds an agent loop: retries, sub-agent spawning, recursion? Is the budget enforced by the system or by hope?
27. Is every irreversible action (delete, send, pay, deploy) gated by a check the agent cannot talk its way past?
28. What is the agent's worst-case spend per hour, and what mechanism enforces that ceiling?
29. Do you have a kill switch that stops all agents in under a minute, and have you tested it?
30. When output quality drifts, what measures it before your customers do?
31. If a fleet of agents retries in sync, do they take down your own downstream services?
32. Can you replay a failed agent run faithfully enough to debug it?

Humans and operations

33. Which decisions require a human, and is that enforced by the system or by convention?
34. When an agent damages something in production, is it written down who owns that incident?
35. Can support see what an agent did to a customer's account by the time the complaint arrives?
36. Is there an environment where agents act on production-shaped data with non-production consequences?
37. What is the process when a customer says "your AI did something wrong"?
38. Are agent instructions and prompts versioned, reviewed, and rolled back like code?
39. If your agent framework or model vendor disappeared tomorrow, what is the migration path?
40. Does anyone re-review agent permissions and prompts on a schedule, or only at launch?

What to do with your score

Zero unanswerable questions is rare and usually means the system is not in production yet. A handful is normal; which handful matters more than how many. If the gaps cluster in one section, that section is where your incident is waiting.

If you want a second pair of eyes on the answers, that is exactly what the session is for.

This checklist is free to share and quote with a link back. It grows out of building mintkey and mint-mory and out of review sessions; it will keep evolving.