A pre-flight checklist for shipping AI agents into regulated environments. Run it against any agent system that touches production data, customer information, or financial records — before InfoSec runs it against you.
This is the same checklist I run during the first phase of a Discovery engagement, distilled to a self-serve format. Five layers — identity, credential broker, scoped tools, policy gating, audit — with yes/no items per layer and a decision tree for what to fix first when you're short on time. No fluff, no marketing pages padding the page count.
Each layer also includes the questions InfoSec will actually ask in review, and the common gaps that show up in the wild. The intent is that you can read each section and immediately know whether your system would pass or fail.
Enter your email below. The PDF link lands in your inbox immediately. You'll also get a short series of follow-up notes — practical, no pitch — over the next few weeks.
This checklist pairs with the essay Making agent deployments pass security review — the longer piece walks through why each layer exists and how they map to enterprise compliance controls. The checklist is the operational version: skip the prose, score yourself, and find the layer that needs work.