Readiness Checklist

Run this against one agent. Every unchecked box is either work you owe, or a risk you have accepted in writing.

REGISTER

Agent identity and version recorded
Business and technical owners assigned, and different from the approver for high risk
Intended use documented, and prohibited use documented explicitly
Risk tier assigned, with written reasons

AI-BOM

Model, prompts, tools, data sources and memory configuration recorded with versions
Permissions and declared tool side effects recorded
Credentials and assumable identities listed
Change triggers defined before they are needed

EVALUATE

Expected and adversarial trajectories run
Multi-turn behavior tested, not just single responses
Tool-call evidence preserved alongside text
Findings grouped by failure type, with severity assigned
Harness version, juror model and seed recorded with the run

CONTEXT

All seven criteria assessed; the two non-scoring criteria excluded from the axis
Trust boundaries explicit; untrusted content isolated from instruction
Grounding requirements and tool schemas reviewed
Memory write path governed, with correction and forgetting rules

COMPLY

Applicable obligations mapped to testable controls
Controls owned, measurable, and tested in the running system
Evidence linked to each control
Missing evidence visible, and distinct from pass

GOVERN

Policy version defined; thresholds explicit
Hard-block rules written
Required approvers assigned, with separation of duties
Exception process documented, scoped and time-bounded

RELEASE

All four axes visible independently
Hard blockers checked before classification
PASS, REVIEW or BLOCK recorded with the rule that produced it
Authorized scope stated
Decision reconstructable months later

ASSURE

Freshness policy defined on both time and material change
Baseline run retained for comparison
Material-change triggers monitored
Revocation and rollback path tested, and timed
Production failures fed back into the regression suite