AI-assisted tools can shorten the distance between an idea and a working interface. That is useful. It also makes it easy to reach the demo stage before anyone has answered the operational questions that production software creates.
1. Ownership and access
- The organization controls the source repository, domain, hosting, database, storage, email, and third-party accounts.
- At least two appropriate people can recover critical accounts without relying on one developer's personal login.
- Licenses, generated assets, and third-party dependencies have terms the organization can identify and follow.
2. Secrets and configuration
API keys, database credentials, signing secrets, and privileged tokens must not be committed to source code or exposed to the browser. Separate development and production configuration, restrict permissions, and have a rotation plan if a secret is exposed.
3. Authentication and authorization
Authentication answers who the user is. Authorization decides what that user may do. Test access on the server, including direct requests that bypass the visible interface. Roles and ownership checks should not depend on editable browser storage.
4. Data handling
- Know what personal or sensitive data is collected and why.
- Validate inputs and enforce permissions where data is read or changed.
- Define retention, deletion, export, and recovery expectations.
- Avoid placing real customer data into prompts or tools without an approved data-handling basis.
5. Failure behavior
Production systems need predictable behavior when dependencies time out, payments fail, email is delayed, an AI response is malformed, or a user submits the same action twice. Error handling should protect data and tell operators enough to investigate without exposing sensitive details to users.
6. Backups and recovery
A backup claim is not a recovery plan. Confirm what is backed up, how often, how long copies are retained, who can restore them, and whether a restore has been tested. Source control does not back up production databases or uploaded files.
7. Observability and operations
Someone should be able to see application errors, failed jobs, resource pressure, and important service interruptions. Assign responsibility for alerts, dependency updates, security reports, and incident decisions.
8. Accessibility and task testing
Test real workflows with keyboard navigation, visible focus, appropriate names and instructions, responsive layouts, and meaningful error recovery. Generated markup can look polished while remaining difficult to operate.
9. Repeatable deployment
The team should know which version is running, how changes reach production, how database changes are applied, and how to roll back or stabilize a failed release. A deployment that only one person can reproduce is a continuity risk.
Production-ready does not mean no risk. It means the risks are understood, tested, observable, and assigned to people who can respond.
