Direct answer
Audit the paths that can lose data, expose access, duplicate money or state, fail silently, or block future change. Begin with identity, tenant boundaries, data ownership, critical workflows, AI evaluations, integrations, deployment, and recovery. The goal is not to grade code style; it is to decide what can be preserved, what must be repaired, and what cannot safely reach production.
Stop measuring progress by visible screens
AI-assisted tools can build polished interfaces before the underlying system exists. A dashboard may show users, reports, confidence scores, and payments while reading static arrays. An upload form may animate without storing or validating a file. A role selector may exist without server-side authorization.
Those gaps are easy to miss because the product tells a coherent visual story.
Zenveus has seen this pattern in prototype hardening work. One compensation product displayed market benchmarks, AI mapping, scenario comparisons, and equity charts, but the prototype had no persistence, ingestion pipeline, market-data layer, computation engine, multi-user support, or tenant isolation. The interface was useful evidence of the intended product. It was not evidence of a production system.
Trace five critical journeys
Choose the workflows the business cannot afford to get wrong: registration, core value delivery, payment, privileged administration, and data deletion or export. Follow each from interface to database and external providers.
For every step, ask:
- Is the operation real or simulated?
- Which identity and tenant authorize it?
- Where does state live?
- What validates the input and output?
- What happens after timeout, duplicate delivery, or partial completion?
- Which evidence proves the outcome?
- How is the action reversed or reconciled?
This reveals more than reading files in alphabetical order.
Map identity and data before architecture debates
List roles, tenants, sensitive data, system owners, and trust boundaries. Check that authorization is enforced on the server and carried into retrieval, queues, storage, logs, and background jobs.
Then map the data model. Look for duplicated sources of truth, hardcoded business values, missing constraints, destructive updates, absent migrations, and state that exists only in the browser.
Architecture diagrams become useful after they describe the system that actually runs.
Audit the AI as a workflow
Record where AI receives data, what tools it can call, how outputs are validated, which evaluation set exists, when people review, how cost is attributed, and what happens after uncertainty or failure.
Prompt quality matters. It sits behind more basic questions: is the model allowed to see this context, is the evidence current, can the output be trusted enough for this action, and can the team diagnose a bad result?
Inspect the release path
Review environments, secrets, dependency risk, infrastructure as code, backups, monitoring, alerts, CI/CD, test coverage, rollback, and incident ownership. Run the application, tests, and deployment process rather than accepting configuration files as proof.
Look for the seams created by multiple tools: competing state libraries, duplicate API clients, inconsistent error handling, mismatched schemas, and environment-specific shortcuts.
Produce a preservation plan, not a rewrite verdict
Classify findings by consequence and dependency:
- Preserve: sound components that already meet the requirement.
- Repair: contained weaknesses with a clear remediation path.
- Replace: foundations whose assumptions conflict with the product.
- Defer: lower-risk work that should not block launch.
Estimate effort as ranges and state the evidence behind them. A serious audit reduces uncertainty; it does not manufacture precision from an incomplete codebase.
The decision at the end
The audit should answer whether the product can enter a controlled pilot, needs a hardening sprint, requires selective replacement, or should be rebuilt around a different system model.
Funding more features before answering that question compounds uncertainty. A two-week feature can become a six-week migration when it lands on the wrong foundation.
Related Zenveus services: AI Prototype Hardening and Technical Audit