AI-agent hosting checklist: 15 questions before production
A practical checklist for reviewing the security, persistence, recovery, observability, and cost of an AI-agent runtime.
Moving a coding agent off a laptop solves only one problem: the laptop no longer supplies the uptime. Before putting agents into production workflows, review the runtime as you would any system that can read source code, execute commands, and call external services.
Use these questions during a proof of concept and record the answer, owner, and evidence for each one.
Lifecycle and state
1. What ends a run?
Document idle limits, maximum duration, manual stop behavior, provider maintenance, and what happens when billing or authentication fails.
2. What survives a disconnect?
Separate the network connection, shell, agent process, filesystem, and external services. They may have different lifecycles.
3. What survives a host restart?
Do not assume a persistent filesystem means an active process resumes. Test restart behavior and add process supervision where required.
4. How is work checkpointed?
Require agents to create reviewable Git commits, patches, or pull requests at sensible boundaries. Long transcripts are not a recovery mechanism.
Access and isolation
5. What is the isolation boundary?
Identify whether tasks share a container host, microVM, virtual machine, or dedicated server. Confirm what is isolated: process, filesystem, network, and credentials.
6. How do secrets enter the environment?
Use a secret manager or scoped environment injection. Do not place long-lived credentials in prompts, repositories, shell history, or generated notes.
7. Can outbound network access be restricted?
An agent that can run arbitrary commands can also make arbitrary network requests unless policy prevents it. Decide which package registries, APIs, and deployment targets are necessary.
8. How is human access revoked?
Test offboarding, token rotation, SSH-key removal, and session invalidation. Access should not depend on remembering every machine manually.
Parallel work and review
9. Does each agent have an isolated worktree?
Multiple agents should not edit the same checkout. Use one worktree and branch per task, with an owner and a clear merge order.
10. Are ports and databases isolated?
Assign predictable port ranges, database schemas, or disposable databases. File isolation alone does not prevent runtime collisions.
11. Which actions require approval?
Define boundaries for dependency installation, pushing branches, merging, deploying, database migration, and external communication.
12. Can reviewers reconstruct the run?
Keep command logs, test output, diffs, and links to source tasks. The final pull request should explain both what changed and what was verified.
Operations and cost
13. Who patches and backs up the host?
For a raw VPS, the answer is your team. For managed infrastructure, confirm the provider's responsibility and what remains yours.
14. How are failed or stuck agents detected?
Use timeouts, heartbeat or status signals, resource monitoring, and clear escalation paths. "Runs in the cloud" does not mean "finishes successfully."
15. What does a representative month cost?
Include compute, retained storage, network traffic, concurrency, model usage, and engineering maintenance. Compare a bursty week and a continuously active week.
A minimal production baseline
Before allowing write access to an important repository, require:
- scoped repository credentials,
- protected default branches,
- a separate worktree per agent,
- automated tests and a human merge review,
- a documented stop procedure,
- logs and resource monitoring,
- backups for non-Git state,
- tested credential revocation.
Matrix OS provides a persistent computer and browser workspace for terminal agents. It can reduce environment setup, but the same branch protections, credential scope, approvals, and recovery practices still apply.
For platform selection, see How to choose hosting for AI coding agents. For parallel repository isolation, see Git worktrees for AI coding agents.
FAQs
Is persistence the same as reliability?
No. Persistence describes retained state or lifecycle. Reliability also requires monitoring, recovery, checkpointing, and controlled failure modes.
Should agents receive production credentials?
Only when the workflow genuinely requires them, and then with the narrowest possible scope, approval gates, short lifetimes, and audit logs.
Is one shared agent machine safe for a team?
It can be, but isolation must be explicit. Separate Unix users or stronger runtime boundaries may be appropriate when repositories, customers, or trust levels differ.