Treat AI-built software in three tiers. A prototype needs isolation and synthetic data. A pilot adds an owner, review and dependency checks. Production adds branch protection, gated releases, monitoring and an incident path. Moving up a tier is a decision with a checklist, not a side effect of success.
Why tiers help
A single rule for all AI-built code is either too heavy for experiments or too light for customer-facing systems. Tiers let people move fast where risk is low and slow down where it is not. The tier is decided by what the software can reach and who depends on it.
The three tiers
| Control | Prototype | Pilot | Production |
|---|---|---|---|
| Data | Synthetic only | Masked or limited real, approved | Real, with access controls |
| Users | The builder and a few teammates | Named test users | Customers |
| Owner | Builder | Named owner | Named owner plus on-call |
| Code review | Optional | Required for risky areas | Required for every change |
| Dependency check | Quick vetting | Scan and lockfile | Scan, policy gate, SBOM |
| Secrets | Dedicated test keys | Secrets manager | Secrets manager, rotation |
| Hosting | Isolated, spend limited | Separate environment | Production environment |
| Monitoring | None needed | Basic logs | Alerts, logs and runbook |
| Lifetime | Expiry date | Fixed pilot window | Ongoing |
Deciding the tier
Ask four questions:
- What data can it read or write?
- Who can reach it, and from where?
- What can it call, such as payments, email or internal systems?
- How long will it live?
Any answer that touches real customers, money or internal systems moves it up. When unsure, choose the higher tier.
Moving up a tier
Prototype to pilot. Name an owner, review login and data access code, vet and pin dependencies, move secrets out of the repo, and set a pilot end date.
Pilot to production. Enable protected branches and required reviews, add automated checks in CI, run a dependency and vulnerability scan, test one user cannot see another's data, set up monitoring and write who gets called when it breaks.
The SSDF from NIST describes practices that can be added to any development life cycle model, which is a useful way to think about the tiers: the same practices, applied with more rigour as risk grows.
Common mistakes
- Skipping the pilot tier because the demo went well.
- Calling something a prototype to avoid review while customers use it.
- Letting a pilot run past its end date with no decision.
Where Safeguard fits
Safeguard provides dependency scanning, reachability analysis, policies and gates, and compliance evidence automation, which map to the pilot and production columns. Autonomous remediation with fix pull requests is off by default, and every category starts on Manual. See your own repository with a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings are prioritised so a small team can act on them.
Quick check
Can a prototype have real users?
A few trusted teammates, yes. Once outsiders or real data are involved, it is a pilot at least.
Sources
Last reviewed: 19 October 2026.
