A gap appears consistently across enterprise engagements: an impressive AI agent demo does not automatically translate into a reliable production deployment. Demos succeed on the happy path with an experienced operator at the controls. Production requires reliability against edge cases, adequate observability, an audit trail for compliance, and predictable operating costs.
For decision-makers evaluating vendor proposals or assessing internal capability, a framework grounded in industry standards helps separate claims from substance. This piece sets out seven production-grade criteria with reference to the NIST AI Risk Management Framework, ISO/IEC 42001 (AI Management System), and the EU AI Act for international regulatory context.
Why Industry Standards Matter as an Anchor
Three primary references anchor this discussion.
The NIST AI Risk Management Framework (NIST AI RMF 1.0), released in January 2023, is a voluntary framework for managing the risks of AI systems. It is structured around four core functions: Govern, Map, Measure, and Manage. The majority of technical guidance for operationalizing AI derives from the Manage function.
ISO/IEC 42001:2023 is the first standard for an Artificial Intelligence Management System (AIMS). It provides requirements for organizations that develop or deploy AI systems, structured similarly to ISO/IEC 27001 for information security. For Indonesian enterprises already holding ISO 27001 certification, ISO/IEC 42001 is a relatively natural extension.
The EU AI Act is being phased in from 2024 with full implementation by 2026–2027. Although its geographic scope is the European Union, it affects Indonesian AI vendors serving multinational clients or transacting with European entities. The Act's risk-based categorization — unacceptable, high, limited, minimal — has become a reference for internal classification at many global organizations.
The seven criteria below are drawn from the intersection of these three standards, adjusted for the operational context of enterprise Indonesia.
Criterion 1 — Step-Level Observability
Definition. Every step the agent executes — LLM call, tool invocation, retrieval query, decision branch — is instrumented with structured logging, distributed tracing, and queryable metrics.
Why it matters. Without step-level observability, root cause analysis of failures becomes infeasible. An agent that fails in production without observability appears as a black box — the engineering team cannot determine whether the issue originates from retrieval quality, prompt construction, model behavior, or a tool error.
Anti-patterns observed. Logging only at the high-level input-output level. No correlation ID linking a single user request to all sub-operations. Metrics covering only total latency with no per-step breakdown.
Success metrics. Every request has a complete trace, visualizable from user input to final output. P95 latency, error rate, and cost per step are queryable over 7-day and 30-day windows. Mean time to root cause for production incidents is under 30 minutes.
Standard reference. NIST AI RMF Manage 4.1 (Post-deployment AI system monitoring plans are implemented).
Criterion 2 — Audit Trail for Every Decision
Definition. Every material agent output — particularly those affecting a user, transaction, or data record — has an audit trail containing the input, retrieved context, prompt used, model version, and output, with timestamp and correlation ID.
Why it matters. Indonesia's Personal Data Protection Law (UU No. 27/2022) and sector regulations — OJK for banking, BPJS for healthcare, BSSN for critical infrastructure — require organizations to explain the basis for decisions when challenged by data subjects. Without an audit trail, this obligation cannot be met.
Anti-patterns observed. Audit trails that store only the final input and output. No retention of retrieved context or the actual prompt used. Model version not tracked, making output history non-reproducible when models are upgraded.
Success metrics. Audit trail available for 100 percent of decisions classified as material. Retention period aligned with sector regulatory obligations — minimum five years for banking, ten years for healthcare in Indonesia. Reproducibility test passes — output can be replayed from the audit trail.
Standard reference. ISO/IEC 42001 clause 8.4 (AI system operation records). NIST AI RMF Govern 6.1 (Policies and procedures for transparent AI system operation).
What separates a demo from production is not model sophistication — it is the discipline of auditable engineering.
Criterion 3 — Fail-Safe and Graceful Degradation
Definition. The agent has defined behavior for failure scenarios: model unavailability, retrieval miss, low-confidence output, tool error, rate limiting. The system does not crash and does not produce misleading output when conditions are non-ideal.
Why it matters. Production traffic has a different distribution from demo datasets. Edge cases that rarely appear in demos will emerge routinely in production. Without fail-safe logic, these failures surface as incorrect output delivered to users — or as outages that affect service reliability.
Anti-patterns observed. Agents that hallucinate immediately on retrieval miss. No fallback to a human handler for low-confidence cases. Retry logic without exponential backoff that exacerbates situations under upstream throttling.
Success metrics. No 5xx errors reach the user — always a graceful fallback message. Confidence threshold enforced with a defined fallback path. Circuit breaker active for upstream dependencies. Chaos testing passes for key failure scenarios.
Standard reference. NIST AI RMF Manage 2.3 (AI risks not previously addressed). ISO/IEC 42001 clause 8.5 (AI system incident response).
Criterion 4 — Cost Governance and Predictability
Definition. Cost per request, per user, and per feature can be tracked in real time with alerts on anomalies. Budget guardrails are active to prevent cost spikes from infinite loops, prompt injection, or abuse.
Why it matters. Generative AI workloads have a cost profile fundamentally different from traditional workloads. Variation in prompt length, retrieval context size, and number of tool calls produces significant cost variance per request. Without governance, monthly costs can spike by hundreds of percent with no correlation to business volume.
Anti-patterns observed. Cost tracking only at the model provider account level, with no breakdown per feature or per user. No hard limits for runaway scenarios. Prompt injection triggering excessive tool calls goes undetected.
Success metrics. P95 cost per request stable within ±20 percent month-over-month. Automatic alerts when cost per user or per feature exceeds threshold. Hard limit active for requests exceeding the step budget. Monthly cost forecast accurate to ±10 percent.
Standard reference. NIST AI RMF Manage 3.1 (AI risks and benefits from third-party AI components are managed).
Criterion 5 — Security Boundary and Privilege Containment
Definition. The agent operates within a clearly defined security boundary: data access scoped to the requesting user, callable tools governed by an allowlist, output sanitization active, and prompt injection mitigation implemented.
Why it matters. An agent with access to internal tools and data becomes a new attack surface. A successful prompt injection can result in data exfiltration, privilege escalation, or unintended tool execution. For clients in regulated sectors, a weak security boundary becomes a compliance blocker.
Anti-patterns observed. Agents with tool access broader than the task requires. No user-level authorization check prior to tool invocation. LLM output used directly as input to a system call without validation.
Success metrics. Internal penetration test for prompt injection scenarios passes. Tool allowlist enforced per agent role. Per-tool authorization check with user context. Output sanitization active for high-risk patterns — markdown injection, URL injection, code injection.
Standard reference. NIST AI RMF Govern 1.4 (Legal and regulatory requirements involving AI). EU AI Act Article 15 (Accuracy, robustness, and cybersecurity for high-risk AI systems).
Criterion 6 — Human-in-the-Loop for High-Stakes Decisions
Definition. Decisions with material impact — particularly those that are irreversible, financially significant, or that affect the rights of data subjects — include a human review gate before or after execution for correction.
Why it matters. Fully autonomous agentic AI across all decision types is an anti-pattern for the enterprise. Every major model provider — Anthropic, OpenAI, Google — recommends human-in-the-loop patterns for high-stakes use cases. Indonesia's UU PDP and sector regulations also require data subjects to have the right to request explanations and to request human intervention.
Anti-patterns observed. Claims of "fully autonomous" for use cases that genuinely require review. Approval flows that are theater — nominally present, but reviewers lack the tools or context to conduct a real review. Override loops that do not feed back into improvement.
Success metrics. Risk-based classification for each decision type. Review SLA defined — synchronous for high-risk, async for medium-risk. Review tooling provides sufficient context: input, retrieval, reasoning, suggested output. Override rate tracked and fed back into model improvement.
Standard reference. NIST AI RMF Manage 4.2 (Mechanisms for human-AI interaction and oversight). EU AI Act Article 14 (Human oversight for high-risk AI systems). ISO/IEC 42001 clause 8.3 (AI system development controls including human oversight).
Criterion 7 — Model and Prompt Versioning
Definition. Every deployment has an immutable version for the model (provider, model name, version, parameters), the prompt (template, variables, system prompt), and agent behavior (tool list, routing logic). Rollback to a prior version is possible without a code change.
Why it matters. AI models evolve rapidly. Providers perform model upgrades with behavioral impacts that are not always documented. Without versioning, organizations cannot run valid A/B tests, cannot reproduce output history, and cannot roll back when an upgrade causes regression.
Anti-patterns observed. Prompts as literal strings in code, changed without version tracking. Model selection hardcoded as "latest", which silently changes when the provider releases a new model. No A/B testing infrastructure for validating changes.
Success metrics. Every deployment has an immutable version ID. Audit trail stores the version ID per request. Rollback exercise passes in tabletop review. A/B testing active for prompt or model changes with a statistical significance threshold.
Standard reference. ISO/IEC 42001 clause 8.2 (AI system change control). NIST AI RMF Manage 1.4 (Strategies to minimize impact of negative residual risks).
Applying the Seven-Criteria Framework in Vendor Selection
The seven criteria above provide structure for AI vendor evaluation that goes beyond the demo.
For procurement, the framework can be converted into an evaluation checklist submitted to prospective vendors. Typical questions: "Show us the observability dashboard you provide for a production deployment." "Show us an example audit trail entry for a decision from your client portfolio." "Describe the agent's fail-safe behavior when the model provider is down."
For internal capability, the framework can serve as a gate review before any agent is permitted to deploy to production. Each criterion is assigned an owner, acceptance criteria, and evidence collected before go-live.
For audit and compliance, the framework serves as a mapping tool against sector regulations. OJK, BSSN, and Kominfo each have their own regulatory frameworks, and the majority can be mapped to these seven criteria.
Closing
Production-grade is not a checkbox. The seven criteria interact with one another — strong observability aids cost governance, audit trails support human review, fail-safe logic shapes the security boundary. Decision-makers who view these criteria as an integrated system will find a more realistic path to production than those who treat them piecemeal.
For Indonesian enterprises building internal standards for AI agent delivery, begin by mapping these seven criteria against existing risk management frameworks. For those in vendor selection, use this framework as an evaluation structure that goes beyond the demo. For those already running deployments that are incomplete, a gap analysis against these seven criteria becomes the roadmap priority.
The engineering and solution architecture team at PT Widigital Tri Buana implements all seven production-grade criteria as part of every enterprise engagement in Indonesia. Each engagement includes an evaluation framework that clients can independently audit.
References
- National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST, 2023.
- International Organization for Standardization. ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. ISO, 2023.
- European Union. Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence (AI Act). Official Journal of the European Union, 2024.
- McKinsey & Company. Implementing Generative AI with Speed and Safety. McKinsey Quarterly, 2024.
- BCG. Scaling AI Pays Off, No Matter the Investment. Boston Consulting Group, 2024.
Topics