Engineering · Architecture

From Prompt to Production: The Infrastructure Most Agent Demos Leave Out

What separates a convincing demonstration from software that can carry real work: identity, permissions, state, testing, evidence, approvals, and recovery.

Author
Quaspar Research
Published
September 21, 2026
Last reviewed
Last reviewed September 21, 2026
Reading time
10 min read
Article contents

The demo boundary

Most demonstrations run a single happy path with clean inputs, a live human operator, and no consequence for a wrong action. That is a legitimate way to explore feasibility, and a poor basis for an operating decision.

The questions that decide production readiness are rarely about the model. They are about what the software is allowed to do, what happens when a system is unavailable, and who can stop it.

Demonstration versus production

DemonstrationProduction
One clean scenarioA defined population of real cases, including exceptions
A person watching every runMonitoring, alerting, and a named owner
Shared or broad credentialsA scoped identity with least-privilege access
No consequence for failureRollback, compensating actions, and incident handling
Output judged by impressionOutcomes measured against a baseline
No record requiredReconstructable evidence of inputs, actions, approvals, and results

The layer a demo usually skips

  • Identity and authentication for the software itself
  • Authorization scoped to specific systems and actions
  • Durable workflow state across long-running work
  • Tool and integration error handling
  • Explicit exception states with owners
  • Approval gates before consequential actions
  • Execution traces and evidence retention
  • Evaluation against a fixed test set
  • Controlled rollout and a kill switch
  • Rollback and recovery procedures

A realistic path to authority

This is Quaspar's perspective on sequencing, not an industry standard.

  1. 01Define the workflow, its boundaries, and its failure modes
  2. 02Build against a test environment with representative cases
  3. 03Simulate exceptions deliberately, not only the normal path
  4. 04Run in observation mode and compare proposals to real outcomes
  5. 05Measure against a baseline the organization already trusts
  6. 06Review results with the accountable team
  7. 07Grant narrow authority for a subset of cases
  8. 08Monitor, expand, or withdraw authority based on evidence

Illustrative; adapt to your organization's risk and governance requirements.

Why this matters more in healthcare and life sciences

In these environments an incorrect action can affect coverage, care timing, records, or regulated evidence. The cost of an unrecoverable mistake is not symmetric with the benefit of a slightly faster run, which is why authority should be earned incrementally and always be revocable.

Sources

Authoritative references

Rules, standards, and guidance can change. The links below were reviewed on September 21, 2026.

  1. 1National Institute of Standards and Technology. AI Risk Management Framework
  2. 2OWASP GenAI Security Project. LLM01: Prompt Injection
  3. 3Assistant Secretary for Technology Policy / Office of the National Coordinator. Application Programming Interfaces in Health IT