1 · DATA CORRECTNESS

The foundation. Every agent incident is a data incident wearing a costume.

Can you name the single source of truth for each entity your agents reason about?
If two systems disagree about a customer, your agent will confidently pick one. You need to know which — before it does. Do you know the freshness SLA of every dataset your agents read?
An agent acting on yesterday's inventory or last quarter's pricing fails silently. Stale data is the quietest incident you'll ever have. Can you trace any agent answer back to the exact source rows it used?
"The model said so" isn't an audit trail. Lineage is the difference between a demo and a system.

2 · PERMISSIONS & ACCESS

Your access-control gaps are now agent blast radius.

Do agents inherit the invoking user's permissions — with no parallel permission model?
A second permissions system is a second set of holes. There should be exactly one source of truth for who can see what. Have you mapped exactly what each agent role can read — and what it must never touch?
Agents don't know what "sensitive" means. If it can read it, assume it can leak it. Is there an off-policy detector and a kill switch that works in production?
The question isn't whether an agent goes off-script. It's how fast you stop it.

3 · GOVERNANCE

Someone has to own the answers. "The agent" isn't a someone.

Is there a named owner for "is the data actually correct"?
The team that owns data correctness just became the team that owns agent safety. Make sure it's the same team. Are all agent actions logged, attributable to a user, and retained?
When something goes wrong, "the agent did it" needs a who, a what, and a when. Is there a review gate before a new agent capability reaches production?
Agents compound. Each new skill multiplies the blast radius of the last one.

4 · EVALUATION

Benchmarks measure models. Evals measure your system.

Do you have evals for agent behavior — not just model benchmarks?
A model scoring 90% on a benchmark can still fail your actual workflow 40% of the time. Do you test agents against adversarial and edge-case inputs before shipping?
Your users will find the weird inputs. Better you than them. Can you measure your agents' real failure rate in production right now?
If you can't measure it, you can't know when it gets worse.

5 · OPERATIONS

Agents degrade silently. Plan for the 3 a.m. version of that.

Is there monitoring and alerting on agent behavior drift — not just uptime?
Uptime dashboards won't catch a model that started hallucinating discounts. Can you disable or roll back an agent in minutes, without a deploy?
Incidents don't wait for your release train. Do you have a compliance story for data your agents touch (DSARs, retention, residency)?
Regulators don't care that "the agent" handled it. You do.