Authentication and access control
Pass threshold: 90
- Server-side identity verification
- Session expiry and revocation
- Privileged access cannot be self-assigned
Resource 10 · Production standard · v1.0
The Production Readiness Standard
Nine evidence-based checks with a published scoring method for deciding whether software is safe to release and practical to operate.
The working guide
Follow the evidence across the whole system.
A pass is not a feeling. Version 1.0 uses the same evidence states, weights, thresholds, and critical-finding cap on every assessment.
Published scoring method
How evidence becomes a verdict.
- 01Score evidence
Each criterion is Pass = 2, Warning = 1, Fail = 0. An evidence gap receives 0 until it is verified; it is never silently treated as a pass.
- 02Apply weights
Authentication 12%, authorization and isolation 15%, secrets 10%, input handling 10%, transactional integrity 13%, performance 8%, testing 10%, observability 10%, compliance and audit surface 12%.
- 03Apply the critical cap
A confirmed critical failure in identity, isolation, secrets, money movement, or regulated-data evidence caps the overall score at 54 and produces a Hold verdict.
- 04Assign the verdict
Ready requires 85 or more with every check at its threshold. Conditional release is 70–84 with no critical failure. Anything else is Hold.
Authorization and data isolation
Pass threshold: 95
- Every sensitive read and write is authorized
- Tenant boundaries are enforced below the interface
- Negative cross-user and cross-tenant tests exist
Secrets and key management
Pass threshold: 90
- No production-capable secret reaches a client bundle
- Keys have clear owners and rotation paths
- CI blocks committed credentials
Input validation and error handling
Pass threshold: 85
- Untrusted input is validated at the boundary
- Errors fail safely without leaking sensitive detail
- Partial operations have defined recovery behavior
Payments and transactional integrity
Pass threshold: 95
- Money state has an authoritative record
- Webhooks are verified and idempotent
- Reconciliation detects missed or duplicated events
Performance and scalability
Pass threshold: 80
- Critical paths have measurable budgets
- Queries and queues are bounded under expected load
- Capacity assumptions are documented
Automated testing and CI
Pass threshold: 80
- Critical workflows have meaningful automated coverage
- Build, test, and migration checks run consistently
- Failures block release rather than become warnings
Observability and deployment
Pass threshold: 85
- Operators can detect and diagnose critical failures
- Deployment and rollback are repeatable
- Alerts have owners and actionable context
Compliance and audit surface
Pass threshold: 90
- Sensitive data is classified and its residency and egress are known
- Privileged and sensitive actions leave durable audit evidence
- Retention, deletion, and regulated-workflow responsibilities are explicit
Evidence to keep
Leave a record another person can verify.
- 01Repository and architecture evidence
- 02Representative environment and deployment configuration
- 03Critical-workflow test results
- 04Monitoring, rollback, and operator runbooks
Choose the next useful step
Use the guide to define the first accountable decision.
We can review the evidence with your team and turn the gaps into a scoped plan without taking ownership away from you.