Define one clear goal & scope. State a single objective — task-based, process-based, or goal-based. Tight scope is the cheapest control available; resist creep now rather than guardrailing it later.

Classify the autonomy level, L1–L5. Cruise control → adaptive assist → supervised autopilot → geofenced self-driving → full autonomy. Pick the lowest level that still does the job; escalate only with justification.

Determine regulated-environment applicability. Clinical, financial, safety-critical, legal? Cap autonomy per the current org's regulated cap and keep a human in the loop on any critical LLM decision there.

Request a formal risk assessment before rollout. Use the current org's risk gate. No such gate yet? Note it as a real gap, not a skip — before pilot, not after.

Check what rules already bind this work. AI usage policy, data handling policy, HIPAA/GDPR or industry-specific rules relevant to the data the agent touches.

Write a clear system prompt. Role, task, output format, available tools — explicit. Prefer a structured output schema over free text where correctness matters. Ground it in versioned sources, not ad hoc inline facts.

Name tools accurately. Tool names often matter more than descriptions for correct selection — treat naming as a first-class design decision.

Assign a clear owner and identity. A named human, reachable, responsible for the agent's lifecycle. Target the org's identity platform where one exists; a named owner in the repo is the floor everywhere else.

Create an Agent Card. A machine-readable descriptor of scope, owner, autonomy level, and known limitations — discoverable without reading all the code.

Verify grounding data is complete and reliable. Stale docs or an incomplete corpus are the most common cause of bad output — rule this out before blaming the model.

Conduct eval-driven testing. Happy path, edge cases, failure cases — defined explicitly, with documented coverage a reviewer can trust without re-deriving it.

Validate accuracy and bias. Measure against real ground truth, not spot checks. Check whether output is systematically worse for some input subpopulation — and re-check after any material change.

Test failure and escalation behavior. When a step fails, does it self-correct within bounds, or escalate to a human? Confirm the guardrails hold under a real failure, not just the success path.

Separate deterministic from probabilistic logic. Cap the LLM parts at a conservative autonomy level in regulated contexts; don't let deterministic business logic quietly become model-decided.

Build in human-in-the-loop checkpoints. Oversight never reaches zero on anything high-stakes. An AI-proposed change is never auto-committed — it needs an explicit human "Apply."

Enable monitoring and call tracing. End-to-end tracing of calls, tokens, cost, and outcome per invocation — reviewable after the fact, not just while watching it run.

Address AI security explicitly. Confidentiality, integrity, availability — including prompt injection by name. Least privilege: restrict the agent to only the tools it actually needs.

Set content-safety and cost controls. Guard against inaccurate output reaching a human as if authoritative. A kill switch and a budget cap, with real spend visibility.

Prepare user guidance. How to use it, its limits, when to escalate, who owns it — part of making the capability safely discoverable, not just usable.

Confirm operator training wherever the agent touches a regulated process — operators need to understand its limits, not just have read a README once.

Register in a shared, discoverable catalog if the current org names one. Skip cleanly if it genuinely has none — don't invent a registry that doesn't exist.

Final sign-off and owner accountability. The named owner records a dated go/no-go, confirming every gate above actually passed. Append new decisions as scope grows — never overwrite an old one.

Know where to get help. Name the specific escalation path — a consult channel, a governance team, an internal community — per the current org.

Kill switch. One flag, checked before rate limiting or budget, in every path that calls the model. Genuinely accessible and actually tested — not just theoretically present.

Rate limit + daily cost budget. Enforced server-side, never client-side. Size the cap to the shared credential actually in use — especially once fire-and-forget jobs remove the natural human throttle.

Agent drift tracking. Detect degrading output quality over time — a rising defect severity or remediation-cycle count — rather than silently absorbing it. Detection triggers a human decision; correction stays a human call.

Memory and amnesia options. Be explicit about what the agent remembers, across turns and sessions, and for how long. No cross-session memory unless it was a deliberate decision with its own retention story.

Traceability / audit trails. Metadata-only records — timestamps, status, cost, tokens, decision outcomes — with a defined retention period. Behavior should be fully reconstructable after the fact.

Cyber security guardrails. Untrusted input treated as data, never instructions. A CSP restricting egress to same-origin. Zero client-side credentials — every privileged call goes through a server-side relay.

Document the full deployment architecture. Models, endpoints, data pipelines, infrastructure, and dependencies — in one place, not scattered across tribal knowledge.