Your AI Is "In Production." That Doesn't Mean It's Production-Ready.

StackRail has published the AI Production Readiness Framework (APRF), a vendor-neutral, gated methodology for determining whether an AI application is safe to operate in production. Unlike maturity scores, APRF uses mandatory pass/fail checks that block releases if any fail, and capability is measured by the weakest pillar rather than an average. The framework covers eight domains including security, safety, data, model lifecycle, agents, reliability, cost, and governance.

Stop shipping LLM features like landing pages. APRF is a gated, machine-readable production readiness framework—with code, YAML gates, and CI you can wire up this week. Most teams ship an LLM feature the same way they ship a landing page: merge the PR, watch the demo, celebrate. Then reality shows up. None of those failures look like "the model wasn't smart enough." They look like production systems without production gates. This post is the developer cut of that argument—plus the parts you can implement: allowlists, approval gates, YAML policy, CI, and a machine-readable attestation. Canonical version lives on StackRail: Your AI Is "In Production." That Doesn't Mean It's Production-Ready. https://stackrail.io/articles/ai-in-production-not-production-ready/ NIST AI RMF tells you how to think about risk. ISO/IEC 42001 tells you how to manage an AI system. SOC 2 tells auditors how to trust your company . Useful. Necessary. Incomplete for the engineer on call. The question that actually decides whether you sleep at night is simpler: Can this AI application safely operate in production? That's the question behind the AI Production Readiness Framework APRF — a vendor-neutral working draft published by StackRail https://stackrail.io/aprf/ . It's not a certification. It's not a partner network. It's not a 0–100 "readiness score" you put in a board deck. It's a gated methodology: mandatory checks either pass or they block you. Recommended controls never average into the gate. If you've ever been sold an "AI maturity score," you already know the failure mode: APRF forbids that trade. vanity score = mean all controls ❌ averages away a missing kill switch gate result = ALL mandatory checks.pass ✅ one fail = blocked capability = min pillar levels ✅ weakest pillar wins Mandatory checks are pass/fail . Failures are blockers . Capability attainment is the minimum across pillars — not a mean. You never publish a single overall percentage. If that sounds strict: good. Production is strict. +---------------------------+ +----------------------------------+ | Demo Path | | APRF Path | +---------------------------+ +----------------------------------+ +---------------+ +----------------------+ | Prompt works | | Pin APRF version | +-------+-------+ +----------+-----------+ | | v v +---------------+ +----------------------+ | Merge PR | | Run mandatory checks | +-------+-------+ +----------+-----------+ | | v v +-------------------------+ +----------------------+ | Ship in production | | All gates pass? | +-------------------------+ +-----+-----------+----+ | | No | | Yes | | v v +----------------+ +----------------+ | Block release | | Attest & ship | +----------------+ +--------+-------+ | v +----------------+ | Observe & drill| +----------------+ | Piece | What you get | |---|---| | 8 domains | Security, safety, data, model lifecycle, agents, reliability, cost, governance | | 27 pillars | Focused control areas under those domains | | Core Profile | 40 gates for Tier‑2 customer-facing AI | | Regulated Profile | 61 gates for Tier‑3 / regulated systems | | Lenses | Extra mandatories for RAG, Agents, Voice, Coding agents | | Spec + attestation | Machine-readable JSON + downloadable self-attestation | | Crosswalks | NIST AI RMF, ISO 42001, OWASP LLM Top 10, SOC 2, AWS WA, SLSA — informative only | Machine-readable source of truth: https://stackrail.io/aprf/spec/ https://stackrail.io/aprf/spec/ APRF doesn't congratulate you. It asks Core + Agents lens territory : | Gate | Requirement paraphrased | Artifact you should have | |---|---|---| TOL-M1 | Tool calls authorized server-side, not by model output alone | Gateway authz tests + deny logs | TOL-M2 | Per-agent tool allowlist; unknown tools denied | Allowlist config + negative tests | TOL-M3 | High-impact tools behind approval / dual control / policy | Impact inventory + bypass tests | HUM-M1 | High-impact actions inventoried and gated | Gate wiring evidence | AGN- / cost gates | Step budgets, kill switch, spend ceilings | Configs, drills, billing alerts | If you can't demonstrate those with artifacts , you don't get a soft yellow score. You get gate fail . User │ │ Natural language goal ▼ Agent Runtime │ │ proposed tool + args ▼ Tool Gateway │ ├─ Validate allowlist ├─ Validate JSON Schema │ ├── Invalid? │ └──► DENY logged │ └── Valid │ ├── High-impact? │ │ │ ├── Yes → Request approval │ │ │ │ │ ├── Denied → Stop │ │ └── Approved → Execute tool │ │ │ └── No → Execute with scoped credentials │ ▼ Tool CRM / Shell / Deploy │ ▼ Sanitized result │ ▼ Agent Runtime You don't need to "adopt APRF" as a religion on day one. Wire the same ideas into your stack. js import { z } from "zod"; const tools = { search docs: { impact: "read", schema: z.object { query: z.string .min 1 .max 500 } , run: async { query }: { query: string } = searchDocs query , }, update crm contact: { impact: "write", schema: z.object { contactId: z.string .uuid , fields: z.record z.string .max 200 .refine f = Object.keys f .length <= 10, "too many fields", , } , run: async args: { contactId: string; fields: Record<string, string } = updateCrm args , }, } as const; type ToolName = keyof typeof tools; export async function invokeTool name: string, rawArgs: unknown, ctx: { agentId: string; approvalToken?: string }, { const allowlist = await loadAllowlist ctx.agentId ; // e.g. "search docs" if allowlist.includes name as ToolName || name in tools { await audit { event: "tool deny", reason: "not allowlisted", name, ctx } ; throw new Error "TOOL DENIED" ; } const tool = tools name as ToolName ; const args = tool.schema.parse rawArgs ; // throws → no side effects if tool.impact == "read" { await requireApproval { tool: name, args, token: ctx.approvalToken } ; } return tool.run args as never ; } The failure mode to kill: UI has "Approve", but the agent HTTP path calls the tool directly. HIGH IMPACT = {"update crm contact", "refund order", "shell exec"} def execute tool agent id: str, name: str, args: dict, approval id: str | None : if name not in allowlist for agent id : raise PermissionError "not allowlisted" if name in HIGH IMPACT: decision = approvals.get approval id if not decision or decision.status = "approved": audit "ungated attempt", agent id=agent id, tool=name raise PermissionError "approval required" if decision.tool = name or decision.args hash = hash args args : raise PermissionError "approval mismatch" return TOOLS name args Bypass test you should actually run in CI: Expect 403 / TOOL DENIED — never a CRM write curl -sS -X POST "$GATEWAY/tools/update crm contact" \ -H "Authorization: Bearer $AGENT TOKEN" \ -d '{"contactId":"...","fields":{"email":"attacker@example.com"}}' \ | grep -E 'approval required|TOOL DENIED|403' Pin the framework version and declare which gates you claim for this service: aprf/policy.yaml aprfVersion: "0.10.0" profileId: aprf-profile-core criticality: 2 lenses: agents adds agent-specific mandatories system: name: support-assistant description: Customer chat with RAG + CRM tools gates: Map check IDs → how CI proves them TOL-M1: evidence: tests/gateway/authz deny.test.ts TOL-M2: evidence: config/agents/ /tools.allowlist.json TOL-M3: evidence: tests/gateway/high impact requires approval.test.ts HUM-M1: evidence: docs/high-impact-actions.md COST-M1: example: spend ceiling / DoW controls evidence: infra/budgets/openai.tf Recommended checks can live here but MUST NOT influence gate pass/fail recommended: OBS-R2: evidence: dashboards/agent-traces.json .github/workflows/aprf-gates.yml name: APRF gates on: pull request: push: branches: main jobs: gates: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Pin & fetch APRF spec run: | curl -fsSL https://stackrail.io/aprf/spec/ -o aprf-spec.json jq -e '.version == "0.10.0"' aprf-spec.json - name: Unit / contract tests for tool gateway run: npm test -- tests/gateway - name: Policy evidence exists for every mandatory gate run: | python scripts/check aprf evidence.py \ --policy aprf/policy.yaml \ --spec aprf-spec.json - name: Negative: unknown tool is denied run: npm test -- tests/gateway/unknown tool denied.test.ts Evidence checker sketch: python scripts/check aprf evidence.py import json, sys, pathlib, yaml policy = yaml.safe load open "aprf/policy.yaml" spec = json.load open "aprf-spec.json" Resolve Core + lenses mandatory IDs from the pinned spec in real code. Here we only verify declared gate evidence paths exist. missing = for check id, meta in policy "gates" .items : path = pathlib.Path meta "evidence" if not path.exists : missing.append f"{check id} → {path}" if missing: print "APRF gate evidence missing:" print "\n".join missing sys.exit 1 print f"OK: {len policy 'gates' } gate evidence paths present aprf {policy 'aprfVersion' } " Self-attestation is not certification. It is a reproducible artifact for PRs, change tickets, and audits. Minimal shape see attestation schema 0.6 https://stackrail.io/aprf/attestation-schema/0.6/ and samples https://stackrail.io/aprf/samples/ : { "$schema": "https://stackrail.io/aprf/attestation-schema/0.6", "type": "aprf-self-attestation", "aprfVersion": "0.10.0", "certificationLevel": "self-attestation", "assessedAt": "2026-07-25T12:00:00.000Z", "subject": { "organization": "Your Co", "systemName": "support-assistant" }, "assessor": { "name": "platform-oncall", "role": "Platform engineer" }, "input": { "criticality": 2, "profileId": "aprf-profile-core", "lensIds": "agents" , "outcomes": { "checkId": "TOL-M1", "passed": true, "evidenceRef": "tests/gateway/authz deny.test.ts" }, { "checkId": "TOL-M2", "passed": true, "evidenceRef": "config/agents/support/tools.allowlist.json" }, { "checkId": "TOL-M3", "passed": false, "evidenceRef": "MISSING: approval bypass tests" } }, "result": { "gate": "fail", "blockers": "TOL-M3" }, "statement": "Self-attestation against APRF Core + agents lens; not third-party certification.", "disclaimer": "Crosswalks to NIST/ISO/SOC2 are informative alignment only." } One failed mandatory → gate fail . No averaging. No "87% ready." We published a Core / Regulated self-assessment with optional lenses. Download the attestation JSON when you're done. Anyone looking for a badge that says "we're compliant with everything." APRF won't pretend. That's the point. APRF is a working draft. Publisher today: StackRail. Intended long-term steward: a neutral working group via public RFCs. Contribute: stackrail.io/aprf/rfc https://stackrail.io/aprf/rfc/ . Originally published on StackRail set as canonical above .