[Blog](https://cohesivity.ai/blog) Foundational Published Jun 21, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/shouryamaan.webp)![](https://cohesivity.ai/authors/arag.webp)[Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) and [Arag](https://www.linkedin.com/in/aragagrawal/) # What Does It Take to Run an AI Agent in Production? [Read as Markdown](https://cohesivity.ai/blog/running-ai-agents-in-production.md) Request Agent run Checkpoint Ready Running an AI agent in production requires scoped access, bounded execution, safe writes, durable recovery, isolated code execution, end-to-end traces, repeatable evaluations, and a tested way to stop the system. A successful supervised demo proves very little about those controls. Production begins when the agent can encounter inputs you did not write while nobody watches every step. The release gate should test the paths that fail, repeat, or require permission. ## Establish identity before autonomy Give each agent, deployment, or session a credential that identifies the caller and limits its tenant, resources, and actions. Enforce those limits in the service that owns the data. A tool description and a system prompt are context for the model, not authorization for the backend. [OWASP's Excessive Agency guidance](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) recommends minimizing tool functionality, permissions, and autonomy. Apply that in order: remove tools the workflow does not need, narrow the credentials behind the remaining tools, then add approval before high-impact actions. The [AI agent security guide](https://cohesivity.ai/blog/ai-agent-security-identity-permissions-secrets-audit-logs) covers credential scope, secret handling, and audit attribution in more detail. ## Bound the run in code Set server-enforced limits for wall-clock time, model spend, tool calls, repeated attempts, concurrent runs, and output size. Use narrower limits for tools that write or spend money. Stop repeated authorization and validation failures instead of retrying them. A model can request another step after the budget is exhausted. The runtime must refuse it. This is also why a global rate limit is insufficient: it may slow a runaway workflow without capping the total damage from that workflow. ## Make every external effect recoverable Every retryable write needs one logical operation ID or idempotency key. Store the result server-side and return it when the same operation is retried. When the client times out, check the operation record before repeating the effect. Checkpoint after a confirmed external effect. If the process fails after sending an email or creating a deployment, a recovered workflow should resume after that step instead of replaying it. [Temporal's durable execution documentation](https://docs.temporal.io/encyclopedia/durable-execution) explains how persisted workflow state survives process failure. The application still needs idempotent activities because a worker can fail after an external service accepts a request. ## Isolate generated or untrusted code Run agent-generated code outside the application process. The sandbox should define: - which filesystem paths exist and persist; - which hosts and protocols the process can reach; - which secrets are injected and for how long; - CPU, memory, process, and wall-clock limits; - artifact and log retention after the run ends. Containerization alone does not answer those questions. The [sandboxing guide for AI agents](https://cohesivity.ai/blog/sandboxing-ai-agents-secure-code-execution) turns each boundary into a test. ## Trace decisions through their effects Record one trace across the user request, model calls, retrieved context, tool selection, policy decision, tool execution, and downstream API work. Include stable tenant, agent, run, tool-call, and operation identifiers. Exclude credentials and sensitive tool output. [OpenTelemetry's GenAI conventions](https://opentelemetry.io/docs/specs/semconv/gen-ai/) define fields for model, agent, and tool activity. Use them as a base, then add the product identifiers needed to answer who changed which resource. ## Evaluate behavior before each change ships Freeze a small set of representative tasks. Include expected tool choices, prohibited actions, approval points, recovery cases, and acceptance criteria. Run the set after changing the model, system prompt, tool descriptions, permissions, retry policy, or memory behavior. Repeat the cases where model variance matters. A single successful run is an example, not a rate. The [agent evaluation guide](https://cohesivity.ai/blog/ai-agent-evaluations-testing-before-production) explains how to combine deterministic assertions with model-judged output. ## Define the human interruption path The system should be able to pause before a consequential action and show the reviewer the exact resource, action, scope, and expected effect. It also needs an operator path that works when the agent is confused or unavailable: 1. Stop new runs. 2. Interrupt the current run. 3. Revoke the affected credential. 4. Find every resource and operation the run touched. 5. Restore, compensate, or escalate completed effects. Practice this path in an isolated environment. A runbook nobody has executed is still a hypothesis. ## Use a release gate, not a readiness score | Gate | Evidence required | | --------- | --------------------------------------------------- | | Access | Scoped credential and downstream authorization test | | Writes | Idempotency and unknown-outcome recovery test | | Autonomy | Server-enforced run limits and approval policy | | Execution | Sandbox boundary and cleanup test | | Recovery | Checkpoint resume and credential revocation test | | Diagnosis | Complete trace for one success and one failure | | Behavior | Repeatable evaluation set with forbidden actions | A combined score can hide one missing control. Treat each row as pass or fail for the workflow being released. The prompt below produces that gate for the highest-risk workflow without inviting production into the test. or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+project+and+identify+the+AI+agent+workflow+with+the+broadest+permissions+or+largest+external+effect.+Do+not+access+production.+Build+a+release-gate+checklist+covering+caller+identity%2C+downstream+authorization%2C+idempotency%2C+approval%2C+run+limits%2C+sandbox+boundaries%2C+checkpoints%2C+unknown-outcome+recovery%2C+trace+fields%2C+evaluation+cases%2C+credential+revocation%2C+and+emergency+stop.+Run+only+static+checks+unless+I+approve+an+isolated+test.+If+a+live+test+needs+backend+resources%2C+prepare+a+disposable+Cohesivity+tenant+using+npx+%40cohesivity%2Finit+and+list+the+exact+resources+before+provisioning+them.+Return+failed+gates+first. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+project+and+identify+the+AI+agent+workflow+with+the+broadest+permissions+or+largest+external+effect.+Do+not+access+production.+Build+a+release-gate+checklist+covering+caller+identity%2C+downstream+authorization%2C+idempotency%2C+approval%2C+run+limits%2C+sandbox+boundaries%2C+checkpoints%2C+unknown-outcome+recovery%2C+trace+fields%2C+evaluation+cases%2C+credential+revocation%2C+and+emergency+stop.+Run+only+static+checks+unless+I+approve+an+isolated+test.+If+a+live+test+needs+backend+resources%2C+prepare+a+disposable+Cohesivity+tenant+using+npx+%40cohesivity%2Finit+and+list+the+exact+resources+before+provisioning+them.+Return+failed+gates+first. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+project+and+identify+the+AI+agent+workflow+with+the+broadest+permissions+or+largest+external+effect.+Do+not+access+production.+Build+a+release-gate+checklist+covering+caller+identity%2C+downstream+authorization%2C+idempotency%2C+approval%2C+run+limits%2C+sandbox+boundaries%2C+checkpoints%2C+unknown-outcome+recovery%2C+trace+fields%2C+evaluation+cases%2C+credential+revocation%2C+and+emergency+stop.+Run+only+static+checks+unless+I+approve+an+isolated+test.+If+a+live+test+needs+backend+resources%2C+prepare+a+disposable+Cohesivity+tenant+using+npx+%40cohesivity%2Finit+and+list+the+exact+resources+before+provisioning+them.+Return+failed+gates+first. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+project+and+identify+the+AI+agent+workflow+with+the+broadest+permissions+or+largest+external+effect.+Do+not+access+production.+Build+a+release-gate+checklist+covering+caller+identity%2C+downstream+authorization%2C+idempotency%2C+approval%2C+run+limits%2C+sandbox+boundaries%2C+checkpoints%2C+unknown-outcome+recovery%2C+trace+fields%2C+evaluation+cases%2C+credential+revocation%2C+and+emergency+stop.+Run+only+static+checks+unless+I+approve+an+isolated+test.+If+a+live+test+needs+backend+resources%2C+prepare+a+disposable+Cohesivity+tenant+using+npx+%40cohesivity%2Finit+and+list+the+exact+resources+before+provisioning+them.+Return+failed+gates+first. "Send to OpenCode")