The gap between a working prototype and a production AI SaaS product is a 20-item checklist. Each item is individually simple. Missing any one of them creates a production incident. Here is the complete checklist, prioritised by impact.
Infrastructure (Items 1-5)
(1) Automated deployments: CI/CD pipeline that deploys on merge to main. Manual deployments do not scale. (2) Environment parity: staging environment that mirrors production. If staging does not exist, you are testing in production. (3) Database backups: automated daily backups with point-in-time recovery. If you do not have backups, you do not have a production system. (4) SSL/TLS: HTTPS everywhere. Non-negotiable. (5) CDN: static assets served from a CDN. Reduces latency and server load.
Security (Items 6-10)
(6) Authentication: production-grade auth (Auth0, Clerk, or NextAuth). Not a custom implementation. (7) Rate limiting: per-user and per-endpoint rate limits. Prevents abuse and cost overruns. (8) Input validation: validate and sanitise all user input. Prevents injection attacks. (9) CORS: restrict cross-origin requests to your domain. (10) Secrets management: environment variables for all secrets. Never commit secrets to code.
Warning
Items 6-10 are not optional. If any of them is missing, you have a security vulnerability, not a production system.
AI-Specific (Items 11-15)
(11) Model fallback: if the primary model fails, route to a backup. No single point of failure. (12) Confidence thresholds: reject low-confidence responses before they reach users. (13) Prompt injection defence: input sanitisation and system prompt hardening. (14) Response validation: check outputs for hallucinations and format compliance. (15) Cost monitoring: track inference costs per user and per feature. Set alerts on anomalies.
Operations (Items 16-20)
(16) Error tracking: Sentry or equivalent. Know when errors happen. (17) Logging: structured logging with correlation IDs. Debug issues across services. (18) Health checks: endpoint that reports system health. Required for load balancers and monitoring. (19) On-call process: who gets paged when something breaks at 3am? If the answer is 'nobody,' you are not ready for production. (20) Incident runbook: documented steps for the 5 most common failures. When the on-call engineer is paged at 3am, they need clear instructions, not a codebase to debug.
Conclusion
The 20-item checklist is not exhaustive, but it covers the items that cause the most production incidents. Each item is individually simple. The compound effect of having all 20 in place is a system that is reliable, secure, and operable.
Key Takeaways
- Infrastructure: CI/CD, staging, backups, SSL, CDN — the five basics
- Security: auth, rate limiting, input validation, CORS, secrets management — non-negotiable
- AI-specific: model fallback, confidence thresholds, prompt injection, response validation, cost monitoring
- Operations: error tracking, logging, health checks, on-call process, incident runbook
- Each item is simple; missing any one creates a production incident