The Agentic AI Deployment Checklist

An agent that worked in the pilot can still wire money, delete records or leak data once it runs with real permissions. This checklist covers the nine control areas to settle before go-live, with the red flags, the controls, and the question to ask for each.

What's inside

1. 01Picking the first use case. Rate each action by whether it can be undone and how much one bad run can break.
2. 02Identity & permissions. The agent's own account vs acting for a user, read-only first, approval for money and data moves.
3. 03Tools & MCP servers. How to vet what the agent can call before it calls it.
4. 04Prompt injection & exfiltration. The 'lethal trifecta' test and the controls that break it.
5. 05Logging & audit trail. What to record on every run so an incident can be reconstructed.
6. 06Evaluation & rollout. Task success, red-teaming, four rollout stages and a kill switch that works from outside the agent.
7. 07Cost guardrails & incidents. Step, token and spend caps, loop detection, and a stop-contain-undo playbook.

Plus: 12 questions for your agent vendor, a 50-point go-live checklist, and a map to OWASP, NIST and the MCP spec.