An AI-built MVP is production ready when it passes seven gates: security, reliability, data integrity, billing, support, legal, and measurement. Each gate has a small number of binary checks — no scores, no judgement calls. If every check passes, you can put the product in front of strangers who pay. If any fail, you know exactly what to fix and in what order.
Use this as a literal checklist. Work down it in order; the gates are sequenced by risk.
Gate 1 — Security
- Row-level security enabled on every table holding user data, with policies scoped to the authenticated user rather than `true`.
- Every mutation checks ownership on the server, not in the client.
- Every input validated server-side: type, range, ownership, and allowed state transition.
- No service keys, admin tokens or third-party secrets in client code; anything ever exposed has been rotated.
- Rate limits on signup, password reset, public forms and any endpoint calling a paid model.
- A hard monthly spend cap set with every AI provider.
- File storage private by default, with signed URLs, MIME checks and size limits.
- AI features treat user and retrieved content as untrusted: scoped tools, no secrets in system prompts, output sanitised before rendering.
Gate 2 — Reliability
- Error tracking installed and receiving events from both client and server.
- Structured logs with a request identifier you can trace end to end.
- Uptime monitoring on the primary journey, not just the homepage.
- Alerts routed somewhere a human actually reads within the hour.
- Every async job and third-party call has a timeout and a retry policy.
- The UI has a defined loading, empty, error and offline state for every data-backed view.
- A rollback path: you can revert a bad release in minutes without a rebuild.
Gate 3 — Data integrity
- One canonical table per concept; duplicates created during build sessions consolidated.
- Foreign keys and not-null constraints reflect the real rules, so bad data cannot be written.
- Automated backups running, and a restore actually tested at least once.
- Migrations are versioned and repeatable, not applied by hand.
- Personal data is inventoried: you can list what you hold, where, and for how long.
- A deletion path exists that genuinely removes a customer's data on request.
Gate 4 — Billing and commercial
- Signup, trial, and conversion to paid all work end to end with a real card.
- Failed payment retry and dunning email configured.
- Plan upgrade, downgrade, proration and cancellation behave correctly.
- Refunds are possible without engineering work.
- Invoices and receipts are accessible to the customer.
- Pricing maps to a value metric the customer recognises, and is on the site in plain numbers.
- Access is revoked correctly when a subscription ends.
Gate 5 — Support and operations
- A monitored support address, with an owner and a stated response time.
- Transactional email sends from a verified domain with SPF, DKIM and DMARC configured.
- An onboarding path that reaches first value without a call.
- A written runbook for the three most likely incidents.
- A change log or release note habit, so customers see progress.
Gate 6 — Legal and trust
- Privacy policy naming your sub-processors, including AI providers.
- Terms of service covering acceptable use, liability and termination.
- Cookie and analytics consent handled where required.
- A stated position on whether customer data is used for model training.
- A real business identity on the site: who you are, where you are, how to contact you.
Gate 7 — Measurement
- Activation defined as a specific event, and instrumented.
- Week-one and week-four retention measurable per cohort.
- Revenue, churn and refunds visible in one place.
- A funnel from landing page to first value, with drop-off visible per step.
- A weekly review slot in the calendar where those numbers are actually read.
How to use the checklist
Do not attempt all seven gates in parallel. Run gate one to completion first — it is the only one where a failure can end the company rather than annoy a customer. Then reliability, then data, then billing. Gates five to seven can run alongside your first paying cohort.
For a typical AI-built single-journey product, gates one to four take two to four weeks of focused work. That is the true cost of the last mile, and budgeting for it up front is what separates founders who launch from founders who keep polishing a demo.
What this looked like in practice
This checklist is the compressed version of the release gates I used running product at Just Eat and Sage, rewritten for a two-person startup with an AI-built codebase. The enterprise version had more signatures. The failure modes were identical.
If you want help running it, that is the core of an MVP development engagement, and the standing responsibility of an AI product assurance lead.
Frequently asked questions
- What does production ready mean for an MVP?
- It means the product behaves safely and predictably when driven by strangers: authorisation enforced server-side, failures detected within minutes, data recoverable, billing complete through cancellation and refund, and a support path that exists.
- How long does a production readiness pass take?
- Two to four weeks for a typical single-journey AI-built product. Security is one to three days, observability about a day, and the balance goes on data model consolidation, error states and the billing lifecycle.
- Which gate should I do first?
- Security. It is the only gate where a failure can end the company rather than merely frustrate a customer, and it is usually the fastest to close.
- Do I need all seven gates before charging money?
- You need gates one to four. Support, legal and measurement can be closed alongside your first paying cohort, provided a real human is reachable and a privacy policy exists.