Discuss the controls your project needs before it touches production data.
Identify what data is necessary, where it flows, who may access it, and which external providers process it. Minimize sensitive information in prompts and logs.
Project-specific controls are agreed during discovery; this is not a certification claim.
Define when the system must ask for approval, stop, or escalate. Keep high-impact actions outside the authority of an untested agent.
Approval gates • Scoped permissions • Exception queues
Use representative questions and edge cases to evaluate answer quality. Track failed retrieval, incorrect actions, integration failures, and drift after release.
Test sets • Monitoring • Feedback loops • Rollback plans
Document dependencies and operating procedures. Clarify source-content owners, credential management, incident responsibilities, and support arrangements.
Architecture notes • Runbooks • Change review
