An agent that works in a pilot is not ready for production until seven things are true: it has a named owner, its own identity with scoped access, adversarial testing, logging, a stop and rollback path, a defined autonomy level, and a review date. Pilots hide gaps because a few careful people watch every step.
Why pilots mislead
In a pilot, the builder is also the reviewer, the data is small and the blast radius is a test account. In production, none of that holds. Credentials get broader, inputs get hostile and nobody is watching at 3 a.m. Teams call this the governance gap: the technology moves to production before the controls do.
The seven gates
1. Owner. One named person or team is accountable for behavior, cost and incidents. Not a committee.
2. Identity and access. The agent has its own identity, not a developer's personal login or a shared account. Permissions are the minimum for the task, expire, and can be revoked in one step. See run agent actions as the user, not a shared account for the tradeoffs.
3. Adversarial testing. You have tried to hijack it with hostile content in every place it reads. Tests are repeated, since one pass proves little.
4. Logging. Inputs, tool calls, outputs and approvals are recorded with enough detail to reconstruct an incident, and with sensitive data handled safely.
5. Stop and rollback. You can halt the agent quickly, and you know how to undo what it did. Test the stop, do not assume it works.
6. Autonomy level. The agent has an explicit level: suggest only, act with approval, or act and report. Risky actions stay behind approval.
7. Review date. A date in the calendar to re-check scope, cost, incidents and model version. Agents drift.
How to run the gate review
- Make the gates a one page checklist, with a link to evidence for each.
- Run the review as a short meeting with the owner, someone from security and someone who did not build the agent.
- Record a decision: go, go with conditions, or not yet.
- Re-run when the model, tools or data change materially.
Common failures
- Pilot credentials promoted to production unchanged.
- Logging turned off for performance, then forgotten.
- No answer to "who gets paged".
- The only person who understands the agent leaves.
Where Safeguard fits
Safeguard's agent identity, policies and gates, and asset discovery map onto several of these gates, and compliance and evidence automation keeps the proof for each.
Quick check
Do all agents need all seven gates?
Scale them to risk. A read only agent over public data needs lighter treatment than one that writes to production.
Who should approve the move to production?
The owner, with security review from someone who did not build it.
Last reviewed: 19 October 2026.
