AI Prototype Production Gate Research Note

AI Prototype Production Gate Research Note

A preview becomes a production candidate only when the team can show evidence for what the system does, who owns it, how it fails, and how it is operated. The gate should record an owner, test method, result, exception, and approval for every material requirement.

NIST SP 800-218 organizes secure software development around preparing the organization, protecting software, producing well-secured software, and responding to vulnerabilities. OWASP ASVS provides a testable basis for web-application controls. WCAG 2.2 provides technology-neutral accessibility success criteria. These sources support a verification program. They do not certify an application merely because a builder says it ran a scan.

The production gate needs requirements reconciliation, domain review, architecture ownership, source and dependency inventory, data classification, migration and deletion behavior, authentication, authorization, secrets handling, threat modeling, functional tests, accessibility tests, performance limits, logging, monitoring, backup, restore, incident response, cost controls, privacy review, legal review, release approval, and rollback.

The test environment must use representative but non-sensitive data. High-risk workflows need negative tests. A property manager should not be able to see another customer's submissions. A deleted record should follow the stated retention policy. A failed payment or API call should not leave an ambiguous transaction. A restore drill should prove that the backup can be used.

Vendor tools can help. Base44 currently documents security scans and permission controls. Lovable documents project and workspace security surfaces. Replit documents secrets, publishing types, logs, metrics, and checkpoints. Firebase documents App Check, Firestore rule review, and explicit testing. Those are platform capabilities. The application owner still needs evidence that the particular configuration and generated code satisfy the project's requirements.

For a regulated or financially consequential product, the gate also needs the appropriate subject-matter, privacy, compliance, and legal review. E098's generated insurance forms, codes, and carrier flows are demonstrations. They are not evidence of filing compliance, carrier authority, rating accuracy, binding authority, or safe handling of policyholder information.

The final release record should make holds visible. An unresolved critical control is not converted into acceptance by checking a box or noting that the prototype looked convincing.