AI agents and automations are the fastest-growing thing we’re asked to help with. A support bot that answers customers, an agent that processes invoices, an n8n flow that reads emails and updates your CRM: they’re easy to build and genuinely useful.
They’re also different from a normal app in one important way: they make decisions you didn’t explicitly program. That changes what “production-ready” means. Here’s what we look at.
1. Guardrails: what goes in, what comes out
AI models follow instructions, including instructions hidden in the content they read. A customer message, an email, or a web page can contain text like “ignore your previous instructions and…”. This is called prompt injection, and there’s no complete fix for it today.
What you can do:
- Check inputs for obvious manipulation attempts.
- Check outputs before they’re shown or acted on, so internal documents, other customers’ data, or your system instructions never reach the user.
- Design assuming injection will sometimes succeed, which is what the next point is about.
2. Give it the least access that works
The most important question isn’t “can someone trick the agent?” but “what’s the worst it can do if they do?”
- An agent answering one customer should only be able to see that customer’s data, not your whole database.
- An agent that reads emails probably shouldn’t also be able to send them.
- Use separate, limited API keys for each agent rather than your admin keys.
3. Keep a human in the loop for anything risky
Let the agent handle the routine work, and route anything with real consequences to a person: refunds above a small amount, deleting data, sending messages to many customers, anything legal or medical.
A good rule: if you’d want a new employee to ask before doing it, the agent should ask too.
4. Cap the costs
AI usage is billed per message, and agents can loop, retry, or be spammed. A single misbehaving automation can spend a month’s budget in a night.
- Rate limits per user and per automation.
- Daily spending caps with alerts well before you hit them.
- Loop protection: a maximum number of steps per run.
5. Make it observable
When a customer says “your bot told me something wrong”, you need to see exactly what happened.
- Log every conversation and every action, including which tools the agent used and what they returned.
- Track failures: timeouts, errors from other services, runs that never finished.
- Watch quality over time, not just whether it’s up.
6. Test it like it’s going to be attacked
Before each change, run a set of test conversations: normal questions, edge cases, and deliberate attempts to break it. Keep adding to the set every time something goes wrong. These are often called evals, and they’re how you stop a prompt tweak from quietly making things worse.
7. Plan for when other services fail
Your automation depends on other services: the AI model, your CRM, email, payment providers. They will go down sometimes. Decide what should happen: retry, queue for later, or alert a person. Make sure a half-finished run can’t leave data in a broken state.
Getting started
You don’t need all of this on day one. But you do need to know which of these matter for your agent, given what it can see and do.
Our free audit covers AI agents and automations as well as apps: a 30-minute call and a short written summary of your top risks. Book yours here.