GenAI & Agentic AI · Checklist

AI Agent Guardrail & Red-Team Checklist — before it gets production access.

Scope the agent's autonomy, test its guardrails adversarially, and build in a human approval checkpoint — in that order, before an agentic system touches production systems or data.

Reviewed by Bhawna Narula, Founder & CTO, VVnT SeQuor · Last reviewed October 2026

Mapped to current published standards & statute text

Checklist items, each with a test procedure & evidence example

Stages, organized the way a real implementation unfolds

Free to use. Work through it here, no form needed. To get your readiness score, submit it for expert review below.

Expert review

Get your readiness score

Work through the checklist, then submit it — an expert scores it using Self-Compliance and emails you the result.

Check off at least one item below to unlock

Open "How to verify this" on any item for the exact test procedure & evidence an auditor would want Progress saves only in this browser — nothing is sent anywhere until you submit it for review

0 of 14 items checked off

Browsing:

1.1Documented every tool and system the agent can call, and what each one can actually do
How to verify this →
Test procedureCross-check the documented tool list against the agent's actual tool-calling configuration/manifest for anything undocumented.
Practical example / evidenceTool registry/manifest matched against documentation.
1.2Applied least-privilege to the agent's credentials and tool permissions, not broad service-account access
How to verify this →
Test procedureInspect the agent's service-account/API-key permissions and confirm they're scoped to only what its documented tools need.
Practical example / evidenceIAM policy or credential-scope review for the agent's service account.
1.3Defined which actions the agent can take autonomously vs. which require approval
How to verify this →
Test procedureTrigger a sample high-consequence action in a test environment and confirm it actually pauses for approval rather than executing.
Practical example / evidenceAutonomy-tier policy document plus a test case showing the approval gate firing.

Stage 1 of 5

2.1Input filtering catches malicious or out-of-policy requests before they reach the model
How to verify this →
Test procedureSubmit a set of known malicious/out-of-policy inputs and confirm they're blocked before reaching the model.
Practical example / evidenceInput-filter test results with pass/fail per sample.
2.2Output filtering checks the agent's final action, not just its reasoning text
How to verify this →
Test procedureCraft a case where the agent's reasoning looks benign but its final tool call is harmful; confirm the action-level filter still blocks it.
Practical example / evidenceOutput/action-filter test case and result.
2.3Guardrails apply to content the agent retrieves from tools, not only to the user's original promptA common gap: treating tool output as trusted when it can carry injected instructions.
How to verify this →
Test procedurePlant an adversarial instruction inside a document or API response the agent retrieves, and confirm the guardrail still catches it.
Practical example / evidenceIndirect prompt-injection test case and result.

Stage 2 of 5

3.1Prompt injection via tool outputs or retrieved documents
How to verify this →
Test procedureHave a red-team tester embed hidden instructions in a webpage, document or tool response the agent is likely to retrieve.
Practical example / evidenceRed-team report documenting the injection attempt and the agent's response.
3.2Attempted privilege escalation — getting the agent to use a tool beyond its intended scope
How to verify this →
Test procedureHave a red-team tester attempt to coax the agent into calling a tool or parameter outside its documented scope.
Practical example / evidenceRed-team report with the escalation attempt and outcome.
3.3Attempted data exfiltration through a seemingly benign multi-step request
How to verify this →
Test procedureHave a red-team tester construct a multi-step request designed to leak sensitive data through an indirect path.
Practical example / evidenceRed-team report documenting the exfiltration attempt and whether it succeeded.
3.4Agent behavior under ambiguous or contradictory instructions
How to verify this →
Test procedureFeed the agent intentionally ambiguous or self-contradictory instructions and record how it resolves or flags the conflict.
Practical example / evidenceTest transcript showing the agent's handling of the ambiguous case.

Stage 3 of 5

4.1High-consequence or hard-to-reverse actions require explicit human approval before execution
How to verify this →
Test procedureAttempt a high-consequence action (e.g. a payment, a deletion) in a test environment and confirm execution halts pending approval.
Practical example / evidenceApproval-gate configuration and a test run demonstrating the halt.
4.2Approval UI shows enough context for a human to make an informed decision quickly
How to verify this →
Test procedureHave someone unfamiliar with the specific request review the approval screen and confirm they can decide correctly without extra digging.
Practical example / evidenceScreenshot of the approval UI with a reviewer's usability note.

Stage 4 of 5

5.1Agent actions are logged with enough detail to reconstruct what happened and why
How to verify this →
Test procedurePick a past agent action and attempt to fully reconstruct its reasoning, tool calls and outcome from the logs alone.
Practical example / evidenceLog export for a sampled action, reviewed for completeness.
5.2A tested kill-switch exists to immediately halt or disable the agent in production
How to verify this →
Test procedureTrigger the kill-switch in a staging environment and time how long it takes for the agent to actually stop acting.
Practical example / evidenceKill-switch test log with time-to-halt recorded.

Stage 5 of 5

Frequently asked questions

Where should human approval checkpoints go?

At points that are high-consequence, hard to reverse, or legally sensitive — financial transactions, data deletion, external communications — rather than at every single step, which defeats the purpose of agentic automation.

Is red-teaming a one-time pre-launch activity?

No — model updates, new tools and new user populations all change the attack surface. Red-teaming should recur, especially after any change to the agent's tools, permissions or underlying model.

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

AI Agent Guardrail & Red-Team Checklist — before it gets production access.

Get your readiness score

Scope of agent autonomy & tool access

Guardrail design

Red-team scenarios

Human approval checkpoints

Monitoring & kill-switch

Frequently asked questions

Related reading

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

AI Agent Guardrail & Red-Team Checklist — before it gets production access.

Get your readiness score

Scope of agent autonomy & tool access

Guardrail design

Red-team scenarios

Human approval checkpoints

Monitoring & kill-switch

Frequently asked questions

Related reading

Red-Teaming Your AI Agents: A Practical Guide to Adversarial Testing Before Launch

Agentic AI in the Enterprise: Where Human Approval Still Belongs