# AI Agent Deployment Checklist **Organisation:** [ORGANISATION NAME] **Agent name / ID:** [AGENT NAME] **Agent owner:** [NAME / ROLE] **Reviewed by:** [SECURITY OWNER] **Date:** [DATE] **Version:** 1.0 --- ## Purpose AI agents can take autonomous actions across your systems, sending emails, calling APIs, reading databases, and executing code. Without a structured deployment checklist you are flying blind. Use this checklist to ensure every AI agent your organisation deploys is secure, governed, and auditable before it touches production. Work through each section before go-live. Items should be completed and evidenced, not just acknowledged. Record the owner and evidence link for each item. --- ## 01. Pre-deployment Security Assessment Before any agent touches production data, your security team must sign off on the threat surface. This is the foundation everything else rests on. - [ ] **Threat model completed** — Document attack vectors specific to the agent's role: data exfiltration, prompt injection, privilege escalation, and lateral movement. - [ ] **Data classification review** — Identify every data source the agent will access and classify it: public, internal, confidential, or regulated (PII, PHI, PCI). - [ ] **Vendor security posture verified** — Confirm the underlying LLM provider holds SOC 2 Type II, ISO 27001, or equivalent. Review their subprocessor list and data retention policies. - [ ] **Authentication model defined** — Decide how the agent authenticates to systems: service account, OAuth token, API key, or certificate. No shared credentials with human users. - [ ] **Network exposure scoped** — Determine which network segments the agent can reach. Apply zero-trust micro-segmentation; the agent should only reach what it needs. - [ ] **Regulatory compliance review** — Confirm the deployment complies with applicable regulations: APRA CPS 234, GDPR, HIPAA, EU AI Act, or NIST AI RMF as relevant. --- ## 02. Data Access & Permissions Scoping AI agents are remarkably effective at accessing data they should not have. Lock permissions down before deployment, not after an incident. - [ ] **Least-privilege applied** — Grant only the minimum permissions the agent needs for its defined tasks. Review and remove any inherited or default permissions. - [ ] **PII & sensitive data boundaries set** — Explicitly block the agent from fields containing PII, financial data, or health records unless strictly required by the use case. - [ ] **External API access whitelisted** — Enumerate every external API the agent can call. Block all others at the network or policy layer. Review the list quarterly. - [ ] **Read vs write permissions separated** — Default to read-only for all data sources. Write permissions require explicit justification, a secondary approval, and audit logging. - [ ] **Data retention policy defined** — Specify how long agent session data, tool call logs, and outputs are retained, where they are stored, and how they are deleted. --- ## 03. API & Integration Security Most AI agent breaches come through the integrations, not the model itself. Every API connection is a potential attack surface. - [ ] **API keys in secrets manager** — All credentials stored in a secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault). No hardcoded keys in code or config files. - [ ] **Rate limiting configured** — Apply rate limits on all API calls made by the agent. Abnormal call volume is often the first signal of a compromised or runaway agent. - [ ] **Webhook signatures validated** — If the agent receives webhooks, validate HMAC signatures on every inbound request. Reject unauthenticated payloads silently. - [ ] **Dependency vulnerability scan** — Run SAST/SCA on agent code and its dependencies before deployment. Block deployment if critical CVEs are unpatched. - [ ] **Secrets rotation schedule** — Set a maximum credential lifetime (90 days recommended). Automate rotation and test that the agent handles rotation gracefully without downtime. --- ## 04. Agent Behaviour Boundaries & Guardrails Guardrails separate a useful AI agent from a liability. Define exactly what the agent can and cannot do, and enforce it technically, not just via policy. - [ ] **Output filtering implemented** — Scan every agent output for PII, profanity, and off-topic content before it reaches users or downstream systems. Use a dedicated filtering layer, not just prompting. - [ ] **Prompt injection controls active** — Implement input sanitisation for all user-supplied data fed to the agent. Test with adversarial inputs before go-live. Never trust user input. - [ ] **Hallucination mitigation strategy** — Define how the agent signals uncertainty. For high-stakes outputs (financial, legal, medical), require a human review step before action is taken. - [ ] **Action scope limits enforced** — Use tool-calling restrictions to prevent the agent from taking actions outside its defined scope. Prefer explicit allow-lists over block-lists. - [ ] **Human-in-the-loop triggers defined** — Specify conditions that pause the agent and escalate to a human: high-value transactions, ambiguous instructions, confidence below threshold, or novel situations. - [ ] **Refusal logic tested** — Verify the agent refuses out-of-scope requests, harmful prompts, and role-play attempts. Document tested edge cases and expected refusal responses. --- ## 05. Monitoring & Audit Logging You cannot govern what you cannot see. Full audit trails are non-negotiable for AI agents, both for security and for regulatory compliance. - [ ] **Session logging enabled** — Log every agent session: inputs, tool calls, outputs, latency, token counts, and user identifiers. Store logs in a tamper-evident system. - [ ] **Anomaly detection configured** — Set up automated alerts for unusual behaviour: excessive API calls, access to unexpected data sources, output volume spikes, or error rate increases. - [ ] **Alert thresholds defined** — Agree alert thresholds with your security team before go-live. Avoid alert fatigue by calibrating sensitivity against baseline behaviour. - [ ] **Log retention policy enforced** — Retain agent logs for a minimum of 12 months (or as required by applicable regulations). Ensure logs are accessible for forensic investigation. - [ ] **SIEM integration tested** — Forward agent logs to your SIEM. Confirm that critical events (auth failures, scope violations, data exfiltration signals) trigger real-time alerts. --- ## 06. Incident Response Planning When (not if) an AI agent behaves unexpectedly, you need a rehearsed response. Improvising during an incident is expensive and often makes it worse. - [ ] **Kill switch tested** — Confirm you can disable the agent in under 60 seconds. Test the kill switch monthly. The agent should fail closed, doing nothing, when disabled. - [ ] **Escalation path documented** — Define who is notified when an incident is detected: agent owner, security team, CISO, board (for material incidents). Publish the path. - [ ] **Containment playbook written** — Document step-by-step containment actions for the most likely incident types: data leak, runaway actions, prompt injection, and service abuse. - [ ] **User notification process defined** — Know in advance how and when to notify affected users. Check regulatory notification timeframes (GDPR: 72 hours; Australian Privacy Act: as soon as practicable). - [ ] **Post-incident review scheduled** — Commit to a blameless post-incident review within 5 business days of any significant event. Review findings feed back into this checklist. --- ## 07. User Communication & Training The humans who interact with AI agents need to understand what they are interacting with, how to use it responsibly, and what to do if something goes wrong. - [ ] **Acceptable use guidelines published** — Publish clear guidelines on what users can and cannot ask the agent to do. Include examples of appropriate and inappropriate use cases. - [ ] **Privacy notice updated** — Update your privacy notice to disclose AI agent usage, data processing, and any third-party model providers. Obtain consent where required. - [ ] **Feedback & reporting channel live** — Give users a simple way to report concerning agent behaviour. Review reports weekly. Close the loop with users who report valid issues. - [ ] **Awareness training delivered** — Train all users who interact with the agent before go-live. Cover what it can do, what it cannot do, how to spot errors, and how to escalate concerns. --- ## 08. Post-deployment Review Schedule AI agents are not set-and-forget deployments. The model, the threat landscape, and your organisation's requirements all change. Build review cycles in from day one. - [ ] **30-day review completed** — At 30 days post-deployment, review logs, user feedback, incident reports, and performance metrics. Adjust guardrails and permissions based on real usage patterns. - [ ] **Quarterly security audit scheduled** — Schedule a quarterly audit covering permission review, dependency updates, threat model refresh, and penetration test of agent interfaces. - [ ] **Model update policy defined** — Define who approves model version updates, what testing is required before updates, and how you will validate behaviour has not changed unacceptably. - [ ] **Governance board sign-off process** — For high-risk agent deployments, require governance board review annually. Include AI risk register updates and attestation by the accountable executive. --- ## Sign-off | Role | Name | Decision | Date | |------|------|----------|------| | Agent owner | [NAME] | Approve / Reject | [DATE] | | Security owner | [NAME] | Approve / Reject | [DATE] | | Data protection / privacy | [NAME] | Approve / Reject | [DATE] | | Accountable executive | [NAME] | Approve / Reject | [DATE] | --- *This template is provided free by Aona AI. Customise it to your organisation. See `/resources/templates` for related security, risk, and governance templates.*