Is your AI agent ready for deployment?

An agent's memory is part of its attack surface. Agents that retain context across sessions can carry forward information that's stale, misleading, or deliberately tampered with, or what OWASP calls memory poisoning and context manipulation. An agent that "remembers" something false doesn't just make one bad decision; it can act on that false premise in every interaction that follows. Deciding what an agent should and shouldn't retain, and for how long, is as much a design decision as any permission setting.

That's also why human oversight can't be an afterthought. In a system where one agent's output feeds another agent's input, a single wrong decision can spread quickly. This is what OWASP describes as cascading failures. The fix isn't removing autonomy altogether; it's building in checkpoints at the moments where a wrong call would be costly or hard to reverse, so a human can catch it before it propagates further.

Which brings us to the last question: is it actually safe enough to go live? This isn't a one-off checklist item, it's an ongoing assessment against the risks the rest of this framework has laid out. Has autonomy been scoped to the task? Are manipulation and access risks understood and mitigated? Are memory and oversight designed in, not bolted on? If the answer to any of these is "we're not sure" - production probably isn't ready yet.

Three questions before you go live

• What does this agent remember, and could that memory be wrong or manipulated?
• Where are the checkpoints that let a human intervene before an error spreads?
• If we had to defend this system's readiness today, could we?

In three consecutive blogposts we've now covered the questions from the OWASP Top 10 for Agentic Applications – from what you're building to whether it's ready for production.

If your developers and product owners are working through these questions right now, our new course, Building safe AI agents, covers all of them in practical depth.

‍