magnus919/agent-skills/agent-production-operations

agent-production-operations

A runtime control plane for taking an evaluated agent with tools and authority into controlled production operation. This bundle bridges the gap between passing evaluations and safe production use: it defines how an agent is versioned, rolled out, monitored, constrained, escalated, and disabled — and how production evidence feeds back into evaluation and release decisions.

The bundle does not build agents, design evaluations, run release pipelines, or own infrastructure. It composes those concerns from existing specialist skills and owns only the runtime control decisions between them.

When to load this

Load this bundle when you are operating an agent that:

• Has passed evaluation and is cleared for production consideration.
• Has tools with side effects and delegated authority that must be gated.
• Needs a staged rollout with progressive authority expansion.
• Must be monitored for cost, latency, tool health, and authority usage in

production.

• Requires a defined fallback, escalation, and disablement path.
• Should feed production traces and incidents back into evaluation cases and

release-gate updates.

When not to use

Do not load this bundle for:

• Building or designing an agent from scratch — route to the appropriate

framework skill (LangGraph, CrewAI, AutoGen, etc.).

• Designing agent evaluations or observability — route to

agent-evals-and-observability.

• General release engineering (CI/CD pipelines, artifact promotion) — route to

release-engineering.

• General site reliability engineering (incident response, SLO definition,

error budgets) — route to site-reliability-engineering.

• General security engineering (threat modeling, vulnerability assessment) —

route to secure-software-engineering.

• General platform infrastructure (compute, networking, storage) — route to

platform-engineering.

• Performing a production-readiness review — route to

production-readiness; this bundle consumes readiness outcomes, it does not produce them.

• Conducting an incident postmortem — route to

incident-learning; this bundle consumes incident records as escalation and feedback inputs.

Autonomy is not assumed uniform

This bundle explicitly does not assume all agents share the same autonomy, user population, or side-effect profile. Agent profiles are distinguished by capability class and side-effect surface:

Every control-plan decision (authority, escalation, fallback, disablement) in this bundle is parameterized by the agent's autonomy profile. A read-only agent and a side-effect-capable agent operating on customer data receive different thresholds and different escalation paths.

Authority thresholds and maintain/expand/reduce/suspend/revoke decisions belong to accountable humans supported by ai-governance. Operational evidence and readiness are inputs, never permission grants. Applicable policy ceilings, current grant expiry/revocation, and external enforcement constrain every execution.

Mandatory control integrity

Before consequential execution or resumption, load control-integrity operations and produce a pre-execution receipt. Verify protected controls against current independent evidence and the governance registry. Missing, degraded, redirected, or suppressed mandatory controls are control-integrity incidents: hold consequential work, contain or terminate under the incident plan, and escalate through an independently protected path. Do not wait for repeated breaches or normal health thresholds. A task instruction cannot authorize weakening its supervision. Recovery must preserve revocation and independent monitoring.

Runtime control plane routing

The bundle composes the following specialist skills. Load them when their domain is the active concern; the bundle owns the cross-domain coordination.

Loading protocol

This SKILL.md is the discoverable umbrella entry point. Nested skills are not used in this bundle. Reference files are loaded on trigger:

Concrete operational parameters

Authority

• Definition: the set of actions an agent is permitted to perform, scoped by

target (which resources), operation (read/write/delete), and user-context (whose data).

• Trigger to review: any new tool registration, model update, or prompt

change that expands the agent's reachable action surface.

• Threshold: authority is binary per action class. No action may be

performed that is not explicitly listed in the production contract. An attempt to perform an unauthorized action is an authority breach and triggers immediate escalation.

• Action on breach: log the attempt, block the action, increment the

authority-breach counter, and escalate. If breach count exceeds 3 in a rolling 24-hour window, disable the agent.

Escalation

• Definition: transfer of a decision or action from the agent to a

designated human operator.

• Triggers (any one triggers escalation):
• Authority breach (attempted unauthorized action).
• Uncertainty above threshold: agent confidence < 0.7 on a

side-effect-capable action (configurable per profile).

• Tool failure rate > 5% in a 5-minute sliding window.
• Cost budget breach > 10% of allocated budget in a billing period.
• Latency p95 > 2x baseline for > 5 minutes.
• Human-handoff keyword or explicit user escalation request.
• Action: suspend the agent's side-effect authority, log the escalation

context (trigger, state snapshot, pending actions), notify the designated escalation channel, and await human disposition (resume / reduced-authority / disable).

Fallback

• Definition: a predetermined safe behavior when the agent, model, or a

tool cannot operate at its normal capability level.

• Triggers:
• Model endpoint returns 5xx for > 30 seconds.
• A critical tool is unavailable (health-check failure for > 2 minutes).
• Cost budget exhausted (100% consumed).
• Latency p95 > 5x baseline for > 2 minutes.
• Actions per profile:
• Read-only: return a static/cached response with a "results may be stale"

disclaimer.

• Side-effect-capable, internal: degrade to read-only, queue pending

mutations, notify operator.

• Side-effect-capable, customer-facing: degrade to read-only, surface a

"temporarily unavailable" message to the user, escalate immediately.

Disablement

• Definition: complete revocation of the agent's ability to act, including

read-only access. Distinct from fallback (which preserves reduced capability).

• Triggers:
• 3 or more authority breaches in a 24-hour window.
• Production-readiness review outcome is "no-go" or "defer" for the current

agent version.

• Incident-learning record attributes a severity-1 or severity-2 incident to

agent action, and verified closure is not yet complete.

• Human operator issues an explicit disable directive.
• Tool compromise or credential leak detected (route through

secure-software-engineering).

• Action: revoke all credentials and tokens; remove from routing/load-balancing;

record disablement reason, timestamp, and authorizing evidence; notify escalation channel; prevent automatic restart until a new production-readiness review passes.

Cost