Checklist

The pre-launch safety checklist for software and AI agents

42 checks, each drawn from real outages, breaches and AI-agent failures. Tick what your system already does and you’ll see exactly where the gaps are.

Duplicate action after an ambiguous result

A request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.

0/3 in place

Every request that moves money or changes state carries a unique idempotency key
A timeout is treated as “unknown”, not as “failed”
Before retrying a consequential action, the system checks what actually happened

See it happen, with real incidents Idempotency key

Privileged action without an enforceable approval gate

Limits and approvals live in a prompt, a UI checkbox or a convention instead of code the automation cannot bypass.

0/3 in place

Limits and approval thresholds are enforced in backend code, never only in a prompt or the UI
Actions above a risk threshold need an approval the automation cannot create for itself
The agent can propose a high-impact action, but a separate step with its own check executes it

See it happen, with real incidents Kill switch Least privilege Human-in-the-loop approval

Cross-tenant access through a caller-controlled identifier

The server trusts an account, tenant or object ID sent by the client, so changing a number reveals someone else's data.

0/3 in place

Every data access is checked against the signed-in user’s identity on the server
Queries are scoped to the caller’s tenant by default, not by a parameter the client sends
Tests deliberately try to read another tenant’s objects and must fail

See it happen, with real incidents Insecure direct object reference (IDOR)

Indirect prompt injection changes agent behavior

An email, web page, issue or ticket that the AI reads contains instructions, and the agent follows them with its tools.

0/3 in place

Text from outside is passed to the model as data and never merged with its instructions
An assistant that reads untrusted content only has the tools and access that task needs
Anything that sends data out or changes state needs a person to confirm it

See it happen, with real incidents Prompt injection Model Context Protocol (MCP)

Destructive operation without verified recovery

A delete, cleanup or teardown runs against the wrong target, and the backups that should save the day turn out not to work.

0/3 in place

Production resources have deletion protection that a script can’t switch off
Destructive commands show what they will touch and need the target confirmed by name
Backups are restored on a schedule to prove they work, and kept somewhere a single admin can’t delete

See it happen, with real incidents Restore testing

Retry amplification and runaway resource consumption

Retries, loops or an expensive input multiply load until a partial failure becomes a full outage or a runaway bill.

0/3 in place

Clients retry with exponential backoff and random jitter, and give up after a small budget
Circuit breakers stop calls to a struggling dependency and fail fast
Expensive work has limits on cost, time and concurrency

See it happen, with real incidents Exponential backoff with jitter Circuit breaker

Partial success leaves systems out of sync

A multi-step workflow half-completes, or events arrive out of order, and two systems now disagree about what happened.

0/3 in place

Every step in a multi-step workflow has a matching undo that runs if a later step fails
Events carry versions or timestamps, so stale ones are ignored
A scheduled job reconciles the systems and flags any disagreement

See it happen, with real incidents Reconciliation

Automation acts on stale state or authorization

A background job or automation acts on a plan, permission or record that changed after it was read.

0/3 in place

Before acting, a job re-reads the record and checks it hasn’t changed (a version or compare-and-set check)
Only one automation can own a given change at a time
Permissions are checked at the moment of action, not when the job was planned

See it happen, with real incidents Optimistic concurrency control

Audit trail missing actor, target or decision

After something goes wrong nobody can tell who or what took the action, on which object, or why.

0/3 in place

Every person, service and AI agent acts under its own identity
Each consequential action logs who did it, to what, and why
Audit logs are append-only and kept where the actors they record can’t edit them

See it happen, with real incidents Audit trail

AI action exceeds its intended scope

An AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.

0/3 in place

Agents get the narrowest permissions their task needs, and never production access by default
Every tool validates its arguments against a strict schema before acting
Answers about money, policy or legal terms must cite approved text or go to a person

See it happen, with real incidents Least privilege Model Context Protocol (MCP)

Global change without a staged rollout

A configuration, content or code change reaches every server at once, so one bad value takes everything down together.

0/3 in place

Every change, including config and content, rolls out in stages starting with a small canary
Health checks stop the rollout and roll back automatically
New configuration is validated, size and shape included, before anything loads it

See it happen, with real incidents Canary release Kill switch Blast radius

Weak or phishable authentication on a privileged path

A password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.

0/3 in place

Privileged access requires phishing-resistant MFA, such as passkeys or security keys
Help-desk resets for privileged accounts need verified identity, not just a convincing call
Remote access and contractor accounts follow the same login rules as everyone else

See it happen, with real incidents Phishing-resistant MFA

Known vulnerability left unremediated

A patch or fix exists, but the vulnerable component keeps running because nobody knew it was there or owned the fix.

0/3 in place

Every running component and dependency is in an inventory, such as an SBOM, with an owner
Known exploited vulnerabilities get a patch deadline measured in days
Systems nobody owns are found and either adopted or shut down

See it happen, with real incidents Software bill of materials (SBOM)Known Exploited Vulnerabilities (KEV)

Insufficient segmentation lets a foothold spread

One compromised account, vendor or network segment reaches management planes, backups and everything else.

0/3 in place

Networks are segmented, so each account and vendor can reach only what it needs
Management tools and backups sit in separate zones with separate credentials
At least one backup copy is immutable or offline, out of reach of an attacker with admin rights

See it happen, with real incidents Network segmentation Blast radius