A Pre-Deployment Checklist for AI Agents with Tool Access

An AI agent joins probabilistic interpretation to real authority. Reviewing model behavior without reviewing identity, tools, memory, and recovery leaves the highest-impact paths unexamined. We propose the MAI-SAFE checklist: Mandate, Authority, Inputs, Safe actions, Audit and memory, Failure evaluation, and Exit operations. It is intended to support a go, conditional-go, or no-go decision for one defined agent and environment.

MAI-SAFE is an original checklist based on published risk and application-security guidance. It is not empirical research, a certification scheme, or evidence that an agent meeting every item is safe. Teams should retain evidence and rationale rather than treating checkboxes as assurance.

Mandate: Is the objective narrow, observable, and owned? Are prohibited outcomes and affected parties documented? Authority: Does each session receive a short-lived, task-specific identity? Are tools, resources, spend, duration, and delegation bounded? Does the final resource enforce authorization?

Inputs: Are external instructions untrusted? Does retrieved content carry source and freshness metadata? Are tenant boundaries enforced at retrieval? Safe actions: Are parameters typed and server-validated? Are irreversible or unusual sequences independently approved? Are rate limits, rollback, and compensation defined?

Audit and memory: Can reviewers connect requester, mandate, versions, sources, tool calls, approvals, results, and state changes? Is memory partitioned, minimized, expirable, and protected from unreviewed writes? Failure evaluation: Do tests include indirect injection, goal conflict, unavailable tools, partial completion, poisoned memory, excessive loops, cross-tenant access, approval fatigue, and policy bypass? Are stop conditions specified before execution?

Exit operations: Can operators revoke identity, stop runs, quarantine memory, disable one tool, reconcile partial changes, and restore a manual process? Are ownership and change triggers explicit? Release remains blocked when required evidence is missing for an unacceptable consequence.

Start with a sandbox and synthetic accounts. Create a matrix showing read, propose, write, approve, and administer authority. Select tests by credible consequence and use an independent evidence reviewer. Move to read-only production access before reversible writes. Permission expansion, a new tool, changed model or prompt, memory redesign, or new data class should reopen affected sections.

The release record should contain diagrams, evaluation cases, evidence locations, unresolved assumptions, residual-risk acceptance, rollback results, and assessed versions. A concise decision log is more useful than a context-free score.

The checklist is deliberately technology-neutral and may omit domain-specific safety, privacy, legal, financial, or engineering obligations. It has not been validated against incident frequency or compared experimentally with other methods. Passing tests demonstrates only observed behavior under recorded conditions. Model variability, provider changes, novel attack paths, collusion across tools, and differences between test and production remain. Human approval can also fail through misunderstanding or fatigue. Independent domain review and continuous change management may be necessary.

NIST AI RMF provides risk-governance structure; NIST’s Generative AI Profile describes generative-AI risks and actions; OWASP’s agentic guidance identifies threats involving goals, tools, identity, memory, and multi-agent systems. MAI-SAFE’s name, ordering, release record, and decision procedure are our proposed synthesis and are not official extensions of those publications.