A Production Readiness Checklist

Ten checks

Are inputs typed and identifiers supplied by your backend? Do prompts reference existing variables and instruct grounded answers? Is retrieval tested with real and unanswerable questions? Is routing accuracy measured? Is arithmetic and parsing done in code nodes, and extraction validated? Are secrets in secure settings, tools least-privilege, and risky actions gated? Are API keys server-side and per integration? Are DSL exports versioned? Are logs, cost and feedback monitored? Is there a rollback plan?

The checklist

Use it before each launch.

[ ] typed start inputs; trusted IDs from backend
[ ] prompts render correctly; grounded-answer instructions
[ ] retrieval tested (hit testing, unanswerable questions, threshold)
[ ] routing accuracy measured on labelled messages
[ ] code nodes for maths/parsing; extraction validated
[ ] secrets in env/secret settings; least-privilege tools; approvals
[ ] API keys server-side, one per integration
[ ] DSL exported to git; release notes
[ ] logs, cost per run, user feedback monitored
[ ] rollback: previous DSL ready to re-import

Start with one narrow app

Launch one well-tested workflow for a single use case before building a large multi-purpose assistant.

Quick check: Which item belongs on a Dify launch checklist?

• Arithmetic done by the LLM
• API key embedded in the web page
• Routing accuracy measured on labelled messages
• No test inputs