The AI platform capability checklist.

Retrieval systems

• Retrieval quality
• Groundedness
• Corpus coverage
• Authorization correctness
• Latency

Agent systems

• Task completion
• Path quality
• Tool-call accuracy
• Policy compliance
• Human intervention rate
• Cost per resolution
• Time to resolution

Trajectory signals a final-answer score misses

• Context selected
• Tools used
• Policies applied
• Latency accumulated
• Cost incurred

Changes that must trigger a regression run

• Model
• Prompt
• Tool
• Context pipeline
• Policy

Graders, cheapest first

• Deterministic checks for anything mechanically verifiable
• LLM judges, calibrated against human labels before their scores are trusted
• Human review on high-stakes categories and on a periodic sample
• Chance-corrected agreement reported for every judge in use

Conditions for a number worth acting on

• Sample large enough to detect the size of change the business cares about
• Detection threshold stated before the run, not chosen after it
• Candidate compared against the current production version on identical cases
• Paired comparison, analyzing only the cases where the versions disagree
• Failures classified by type rather than counted

The eval set as an asset

• Built from real production interactions, including the ones that went badly
• Owned, versioned, and refreshed on a cadence
• Every production failure added back as a permanent case
• Watched for decay as the input distribution moves

Online signals offline evaluation cannot supply

• Live quality proxies on real traffic
• Drift between production inputs and the eval set
• Escalation, abandonment, and human-intervention rates
• Segment-level regressions hidden by an aggregate score

Ingestion

• Approved sources
• Parsers per source type
• Chunking or representation strategy
• Classification
• Validation before content becomes retrievable

Freshness

• Source-specific update expectations
• Failed-sync monitoring
• Supersession rules
• Age visible at retrieval time

Authorization

• Enforced during retrieval, not after content reaches the model
• Uses the requesting user's or workload's entitlement
• Never carried in a prompt

Provenance

• Source identifiers
• Versions
• Timestamps
• Transformation history carried into traces
• User-visible citations where appropriate

Deletion — every surface that can return the content

• Source system
• Indexes
• Caches
• Derived representations and summaries
• Retained evaluation and trace data

Registration and ownership — one registry entry per capability

• What the agent or tool does
• Who owns it
• Which data and systems it reaches
• Who responds when it fails

Approval — risk-based review before exposure

• Authentication
• Authorization
• Input validation
• Side effects
• Human-confirmation requirements

Versioning

• Stable contracts
• Compatibility checks
• Evaluation evidence
• Staged adoption when descriptions, schemas, models, or behavior change

Capability-change review — renewed approval when

• A read-only tool gains write access
• An agent gains another tool
• An inter-agent connection changes the reachable trust boundary

Retirement

• Revoking credentials
• Removing discovery metadata
• Migrating dependents
• Retaining audit history needed to explain earlier actions

Boundary decisions the platform still owns after MCP-style discovery

• Which server
• Which tool
• Which agent
• Which user
• Which task

Workload identity

• Distinct identity per agent, not a shared service account
• Short-lived credentials scoped to the task in front of it

Delegation must preserve

• Who initiated the work
• The purpose that was approved
• The resources in scope
• The moment that authority expires
• Enforcement by the tool at execution time, not assumed from the call arriving

Memory obligations

• Scope
• Retention
• Correction
• Audit

Platform property — handed to teams as settled ground

• The delegation contract
• The credential lifetime
• The tenant isolation boundary
• Retention and revocation rules

Traditional signals — necessary, never sufficient

• Latency
• Errors
• Saturation
• Uptime

Spans in one transaction trace

• Gateway
• Retrieval and memory operations
• Model calls
• Agent handoffs
• Policy decisions
• Tool executions
• Outcome delivered to the user

A quality or policy failure must resolve to the exact

• Model
• Prompt
• Context source
• Memory
• Tool version
• Authorization decision
• Rollout

Routing dimensions — decided from task properties before the call

• Task complexity
• Blast radius if the output is wrong
• Verifiability by machine rather than by person
• Context breadth
• Reversibility
• Modality
• Latency target
• Data residency
• Cost

Attributes every model and tool call carries

• Business identity: product surface, workflow, task type
• Agent and version, including prompt version and configuration
• Tenant or customer, where the system is multi-tenant
• Model, with token counts split by input, output, reasoning, and cached read
• Trajectory position: step index, recursion depth, parent invocation
• Terminal outcome: resolved, escalated, abandoned, failed, budget-truncated

Denominators that make spend legible

• Cost per resolved unit of work, not per invocation or per token
• Failed and abandoned trajectories allocated across the successes
• Cost computed at ingestion and stored on the span, so historical comparisons survive a repricing
• Reviewer minutes counted alongside inference for human-in-the-loop workloads

Reduction levers, cheapest and least invasive first

• Prompt caching, with stable content ordered ahead of variable content
• Batch processing for latency-tolerant work
• Context and tool-payload budgeting
• Tier routing on task properties
• Quantization and self-hosting

Why no universal savings percentage exists

• Workload mix
• Model pricing
• Cacheability
• Prompt size
• Retry behavior
• The quality threshold the business will hold

Runtime-enforced limits per invocation

• Wall-clock time
• Tokens
• Monetary cost
• Tool calls
• Recursion and sub-agent depth
• Parallel work

Behavior when a limit is reached

• Escalate to a person or a higher tier
• Degrade to a bounded response
• Never continue silently, and never leave the decision to the model
• Truncation recorded as its own terminal outcome and watched as a rate

Constraints that invalidate the obvious design

• Prompt caches are model-scoped, so escalating a failed attempt reprocesses the context at full price
• A router that is itself a model call sits on the critical path of every request
• Per-call cost falls by construction when work moves to a cheaper tier, so it cannot be the measure of success

Attack-surface map — the prerequisite deliverable

• Input and context paths a third party can influence
• Prompt construction and templating
• Tools and MCP servers, with publisher and pinned version
• Identity and delegation carried on each call
• Memory and state persisting past the request
• Agent-to-agent communication
• Output handling — rendered, executed, or forwarded onward
• Runtime boundaries enforced by code

Injection testing

• Direct: system-prompt extraction, role reassignment, encoded payloads
• Indirect: adversarial content planted in the retrieval corpus
• Payloads designed to trigger unauthorized tool calls
• Transliterated and mixed-language payloads that pass keyword filters

Data leakage scenarios

• System prompt extraction
• Cross-user and cross-tenant context bleed
• Verbatim reproduction of corpus documents
• Memory, trace, and tool-log recovery across sessions
• Secrets reaching model context through tool responses or errors

Testing cadence — beyond a single pre-launch pentest

• Pre-launch red team against a production-mirroring environment
• Automated regression suite on every model, prompt, tool, permission, or memory change
• Periodic human adversarial review of the suite, production logs, and near-misses

The durable boundary is deterministic

• Authorization at the tool and data layer
• Narrow capabilities and sandboxing
• Schema validation and egress controls
• An approval step a compromised model cannot bypass

Independently deployable and reversible versions of

• Prompts
• Models
• Retrieval configurations
• Policies
• Tools
• Agent graphs
• Memory-writing behavior

Release mechanics

• Shadow evaluation where the workload allows it
• Staged exposure
• Cohort or tenant isolation
• Automatic rollback thresholds
• A known last-good configuration

Kill switches — each usable without taking down unrelated products

• An agent
• A tool capability
• A model route
• A memory writer

What makes a rollback path real rather than assumed

• Every component above has a version identifier that appears in traces
• Reverting one component does not require reverting the others
• The last-good configuration is stored, not reconstructed from memory during an incident
• Switches are exercised on a schedule for consequential systems
• The exercise is timed, because a control nobody has used has an unknown recovery time

The paved road provides

• Approved models and tools
• Risk-tier templates
• Automated evaluation and security gates
• Standard evidence packages
• Clear exception handling
• Audit data generated by the delivery workflow

Risk-tiered approvals

• A summarization tool and an autonomous system taking external action do not get the same review

Continuous testing — tied to context and impact, not completed once at launch

• Safety
• Security
• Bias
• Robustness
• Policy

Auditability

• Who changed what
• Under which approval
• When it reached users
• What measurable impact followed

Incident ownership — clear authority to

• Contain
• Roll back
• Investigate
• Notify
• Correct downstream data