Decide what is ready for real use
Separate a convincing preview from an experience people can trust with real accounts, data, and consequences.
Why this matters
Picture two launches. One is a demo with sample data. The other is a pilot where five real clients log in with real records. The second carries consequences — and needs safeguards to match. Readiness depends on what people will do with the product. A polished UI should not silently promise things the system does not do.
What to understand
"Near production" is too vague without the remaining gaps. List them. Name the intended use honestly — a bounded demonstration with clear limits is a demo, limited real use with protection and recovery is a pilot, supported use at agreed scope and scale is production.
Watch for
- Hiding a button treated as enforcement — one client's data leaking into another's.
noindexor a robots rule mistaken for access protection.- Public-looking previews connected to private production services; exports, logs, or copied URLs as exposure paths.
- Feature flags replacing permission checks, or temporary branches with no owner or removal condition.
- A missing server permission check averaged away by good typography and passing lint.
- Deferred risks filed as "accepted" with no authorized person, owner, or decision condition.
Strong default
Verify the boundaries the interface depends on: server permission checks per actor, record, and workspace; untrusted input checked on the server with safe rendering; defined save, conflict, retry, and duplicate behavior; server-side file rules; a noticed-and-repairable recovery path. The Next.js data-security guide shows server boundaries and minimizing data sent to the browser. Ask your agent: "what is the equivalent protection in our stack?"
When this doesn't apply
Do not assume every product needs immediate localization, or that a European user automatically needs another language. Follow your agreed audience and expansion plan — test the inputs your audience uses: text growth, dates, numbers, time zones, and languages.
In practice
| Use | What the claim means |
|---|---|
| Demo | A bounded demonstration with clear simulation and limits. |
| Pilot | Limited real use with appropriate access, data protection, support, and recovery. |
| Production | Supported use at the agreed scope, scale, and operating expectations. |
Decide what is public deliberately. Public content needs intentional metadata, canonical URLs, and indexing behavior. Private content needs access control. Review previews, exported files, analytics, logs, and copied URLs as possible exposure paths.
Rate each relevant area pass, fail, unverified, or not applicable. Record a deferred risk as accepted only when an authorized person actually accepts it. Otherwise label it a proposal, with an owner and the condition that needs a decision.
Verify
Ask your agent to run $readiness for the review. A missing permission check, an unreliable save, or an unowned exposure path fails regardless of polish.
Related skills
Use $readiness for the review and $slice to replace prototype behavior with a real workflow. Continue with deployment and client delivery.
Last updated on