The Production Readiness Gate — Securing Agentic AI in the Enterprise

A pass-or-fail gate across nine control groups. Partial satisfaction is failure.

No agent reaches production without satisfying every item that applies to it. This is a gate, not a scorecard; partial satisfaction is failure. Where a control cannot be met, the exception process in Section 18 applies—routing around the gate does not.

The gate is in two parts. 17.1 is the Level 2 minimum bar, which every agent must clear to reach production. 17.2 is the Level 3 enforced state, gated to higher tiers where the consequences of a control gap scale with the authority granted. Within each, items are grouped by control domain. An item with nothing in its final column applies to every agent, including T0.

17.1 Level 2 — The Minimum Bar #

DISCDiscovery and Inventory

✓	ID	Gate requirement	Applies to
	DISC-1	Registered in the agent registry with a named human owner, before deployment
	DISC-3	Every MCP server the agent reaches is on the approved list	Agents using MCP

AUTHIdentity and Authorization

ID	Gate requirement	Applies to
AUTH-1	Authorization scope documented, minimized, and tied to a business function
AUTH-2	Delegation chain documented for every agent this agent may invoke	Multi-agent deployments
AUTH-3	Deprovisioning criteria and process defined
AUTH-4	Identity planes separated, or the collapse documented with a remediation date	T2 and above

CREDCredentials and Secrets

✓	ID	Gate requirement	Applies to
	CRED-1	Credential lifetime defined and enforced by expiry, not rotation policy alone
	CRED-2	Credentials reachable from the execution context enumerated and bounded to declared scope
	CRED-3	Credentials bound to a named workload identity; no shared static keys
	CRED-5	Revocation tested for every credential type, with measured time-to-effect

ISOExecution Isolation and Network Egress

ID	Gate requirement	Applies to
ISO-1	Egress default-deny with an enumerated allowlist, each entry owned and justified
ISO-2	Trust-tier separation from privileged agents confirmed in the running environment
ISO-3	Runtime isolation verified in the running environment, not asserted in design
ISO-4	Package installation via an internal mirror inside the production VM program	T2 and above

TOOLTool and Action Authorization

ID	Gate requirement	Applies to
TOOL-1	A single enforcement point that every tool call traverses before any side effect
TOOL-2	Tool allowlist enforced outside the model; unknown tools fail closed
TOOL-3	Velocity ceiling configured with thresholds derived from observed behavior
TOOL-4	Blast-radius ceiling declared for records, spend, and systems touched
TOOL-6	Agent-to-agent calls authenticated; token passthrough confirmed absent	Multi-agent deployments
TOOL-7	Decision records emitted to a store outside the agent’s own write scope

DATAData, Memory, and Context Integrity

ID	Gate requirement	Applies to
DATA-1	Provenance recorded for every context element; external content distinguishable
DATA-1	Retrieval entitlement enforced at the data layer, not by post-retrieval filtering
DATA-4	Session isolation tested for cross-principal and cross-tenant bleed	Multi-tenant deployments
DATA-5	Output filtering active on every egress path, including tool outputs
DATA-6	Adversarial retrieval test executed against this agent’s corpus and passed

SUPSupply Chain

ID	Gate requirement	Applies to
SUP-1	Model, tool, and MCP versions pinned with provenance recorded
SUP-2	MCP servers authenticated per OAuth 2.1, tokens audience-bound, descriptions reviewed	Agents using MCP
SUP-3	Third-party assessment complete, or its absence accepted by a named signatory	Third-party agents

OBSObservability and Detection

ID	Gate requirement	Applies to
OBS-1	Action telemetry flowing to central collection with alerting on defined conditions
OBS-2	Expected behavioral profile documented for this agent class	T2 and above
OBS-3	Telemetry correlatable with identity, network, and cloud control-plane logs
OBS-4	Detection tested against a simulated compromise of this specific agent	T2 and above

RESPIncident Response and Forensics

ID	Gate requirement	Applies to
RESP-1	Analysis capability for malicious artifacts named and reachable without external approval
RESP-1	Kill switch tested for this agent, with measured time-to-effect
RESP-4	Evidence preservation configured for the ephemeral runtime
RESP-5	Third-party notification criteria defined with a named decision owner	T2 and above

RETDecommissioning and Retirement

✓	ID	Gate requirement	Applies to
	RET-1	Decommission criteria and retirement owner recorded at registration
	RET-5	Evidentiary retention configured to outlast the agent

GOVHuman Oversight, Governance, and Assurance

ID	Gate requirement	Applies to
GOV-1	Every human-in-the-loop approval point documented, with volume and review time captured	With human approval
GOV-3	If running with reduced guardrails: inventoried, owned, isolation at or above production	Reduced-guardrail environments
GOV-4	Autonomy tier assigned, risk acceptance signed at the tier-appropriate level, review date set

17.2 Level 3 — The Enforced State #