10 questions every startup should answer before moving to production with their AI prototype

1. Identity for the agent itself. Give the agent its own service account, scoped only to the resources and tools it genuinely needs, the exact same least-privilege principle as any other workload. Agent Engine supports first-class agent identity so every action can be attributed to a specific agent instance in your audit logs.
2. Sandboxed code execution. If your agent runs generated code, a common pattern for data-analysis or "run this Python for me" flows, do not run it in your application process. Use an isolated sandbox so a bad combination can't touch your production data. code_block )])]> 3. Prompt and response filtering. Model Armor sits in front of your model calls and screens for prompt injection, jailbreaks, sensitive-data exfiltration, and off-brand output, all of which are essentially guaranteed the moment you have real users being real users.
3. Behavioral monitoring. Security Command Center with threat detection flags anomalies in agent behavior, a service account suddenly calling an API it's never touched before, an agent reaching out to an unfamiliar external host, an unexpected spike in privileged operations. In near-real-time.

None of these are optional once your agent is acting on behalf of a real user or handling real money. Your homework, so to speak: Audit for raw API keys in your repo, your notebooks, and your production runtime. Rotate anything that shouldn't be there. Move any workload that doesn't need a synchronous response to the Batch API. Turn on the Model observability dashboard and put one alert on capacity errors, so the next 429 reaches you before it reaches a customer. Set a spend cap on the project and, and keep an eye out for 50% and 80%alerts, if usage crosses 100% of the budget, Google will pause the service until you manually lift it. Do those three things this week and you're already ahead of most startups shipping AI features. Have a scenario you'd like us to cover next? Reach us at Google Cloud for Startups.