Jarvis Osorio: A Practical QA Checklist for AI Agents Before They Ship

Canonical: Jarvis Osorio: A Practical QA Checklist for AI Agents Before They Ship — also at jarvisosorio.com. Originally published by Jarvis Nelson Osorio (Jarvis Osorio).

A demo can hide almost anything. A checklist cannot. I am Jarvis Osorio, also Jarvis Nelson Osorio, a technology entrepreneur and innovator, AI systems architect, DAO designer, author and artist working from Chile. After enough agent prototypes, I stopped asking "does it look smart?" and started asking what would I regret if this shipped on Friday? The list below is the answer I now keep close.

This is not a certificate and it is not a vendor score. It is a pre-flight habit. Print it, copy it into an issue template, argue with it. Just do not skip it because the interface typed something charming.

1. Authority: what is the agent allowed to do?

• Write a one-page allowlist of tools, accounts and data stores it may touch.
• Mark every action as reversible (draft, suggest, search) or irreversible (send, pay, delete, deploy, grant access).
• Irreversible actions require a second check: a person, a separate system, or a time delay with a cancel path.
• Default deny is the only default I trust. If a tool is not on the list, the agent does not have it, even if a prompt "asks nicely."

Transactional authority — explicit permission for a specific act, not a vague personality of helpfulness — is the core of a serious runtime. Prompts are not permissions.

2. Grounding: where do claims come from?

• For answers that look like facts, require a source the team can open.
• If the source is missing, the agent should say so, not invent a confident footnote.
• When several agents collaborate, do not treat agreement as evidence. Independent review beats a chorus.
• Keep the retrieval set small enough that a human can audit it after an incident.

Yes-machines are trained to fill silence. Quality assurance should reward a clean "I don't know" as a passing grade.

3. Identity and context: who is it acting as?

• The agent should know whether it is talking to a child, a customer, a staff member, or another machine.
• It should not silently change roles mid-thread.
• Personal data in the prompt or in memory should have a retention rule, not an infinite diary.
• Session memory is a feature and a leak surface. Write down what is stored, for how long, and who can wipe it.

4. Evaluation: how do you know it still works Tuesday?

• Collect a fixed set of real tasks, including ugly ones: partial inputs, conflicting instructions, requests that should be refused.
• Run that set before every release, and again after a model or prompt change.
• Score correctness, refusal quality, latency, and tool-use errors separately. A fluent wrong answer is a failure, not a style point.
• Include at least one test where the popular path is wrong, so consensus cannot hide the miss.

5. Observability: can you reconstruct a bad hour?

• Log the model name and version, the routing path, the tools called, the sources retrieved, and the human approvals.
• Make those logs append-only for the people who would investigate an incident.
• Alert on unusual tool use, repeated refusals that then succeed, or a spike in irreversible actions.
• If you cannot retell the story of a single session, you do not yet have operations. You have a demo with fans.

This is the same institutional instinct I argue for in Breaking the Centralized Order: a decision without a record is a decision you cannot govern.

6. People: who is on the hook?

• Name a human owner for the agent, the way you would name an owner for a payment system.
• Write the escalation path for users who get a harmful or just bewildering result.
• Train the team to override the agent without feeling as if they are breaking a magic toy.
• If the product faces families, read the interaction through the lens of The Compliant Mind: does this system ever say no, and does it teach patience or only speed?

7. The last hour before launch

Sit with one colleague and walk a single realistic path from start to an irreversible action. Watch the allowlist, the sources, the logs, and the cancel button. If any of those are hand-waved, the agent is not late — it is unfinished. Ship the draft-only version if you must; keep the keys off the table until the checklist is honestly green.

I keep this list because I am optimistic about agents, not because I am cynical. The teams that will enjoy this technology are the ones who treat it like a colleague with limited keys, not like an oracle with a friendly tone.

More essays and profiles: jarvisosorio.com · Jarvis Nelson Osorio — articles, books, videos and profiles. The book I would pair with this checklist is Breaking the Centralized Order.