BHANUJBHANUJ
v1.0.3

Production Readiness

Use this checklist before relying on BHANUJ governance records and decisions in a production workflow.

Identity and Tenant Scope

  • Use a production OIDC identity provider and validate issuer, audience, and token-signing configuration.
  • Bootstrap organizations, projects, memberships, and least-privilege roles before onboarding producers or operators.
  • Verify tenant context is resolved for REST, MCP, Studio, jobs, policy reads, decisions, and graph queries.
  • Use stable actor, request, and correlation identifiers for operational investigation.

Durable Stores and Secrets

  • Use a durable approved repository backend; do not use in-memory repositories for production governance state.
  • Back up relational governance state and immutable dataset/object artifacts, and test restoration.
  • Choose and operate graph persistence deliberately if ontology lineage is required.
  • Store credentials as secret references. Confirm API and worker processes can resolve them without logging secret values.
  • Set retention, archival, and access expectations for audit records, replay evidence, and dataset artifacts.

Workers and Operations

  • Run workers separately from the API and monitor heartbeats, queued work, retries, cancellation, and failure reasons.
  • Send structured logs and health signals to your existing operations platform; alert on worker staleness and durable backlog.
  • Set provider timeouts, rate limits, and cost controls appropriate for your model and evaluator connections.
  • Test a failed provider call, cancelled experiment, replay, and decision review before production rollout.
  • Use supported plugin entry points for organization-specific extensions rather than modifying core behavior.

Go-Live Checklist

Validate the complete evidence path

Before a downstream process relies on a decision, run a representative change through asset registration, evaluation, policy, decision review, audit lookup, and lineage inspection in the intended tenant scope.
  • Confirm an operator can explain one approved and one blocked decision from persisted evidence.
  • Confirm backups and recovery for every store holding governance evidence.
  • Confirm production secrets are available only to the authorized runtime processes.
  • Document the system that consumes decisions and the human escalation path for proposed or blocked outcomes.

Use Deployment, Security, and Observability for implementation detail.