Audit an AI prompt and its workflow before real users depend on it

Contract gate: one job, one owner, and explicit exclusions

Attach the user and decision, starting inputs, output or action, exclusions, risk class, model and provider, owner, reviewer, terminal state, and rollback version. PASS means the workflow has one coherent job and separates drafting from consequential action. REVIEW means a low-risk style boundary needs clarification. STOP means the system is expected to do whatever the user asks, operate outside qualified review, or publish, spend, delete, or communicate without authorized control. Record expected volume, latency, cost, and data sensitivity. A prompt file without this contract cannot be approved because reviewers cannot tell which behavior is a defect.

Evidence: Anthropic; National Institute of Standards and Technology

Context gate: provenance and trust are visible

Inventory governing instructions, user data, retrieved documents, conversation state, tool outputs, examples, and external content. PASS requires source labels, allowed use, access control, freshness, and a missing-evidence path. REVIEW covers a nonessential stale example scheduled for removal. STOP covers secrets, unnecessary personal data, untrusted instructions treated as policy, inaccessible source claims, or context truncation that removes a safety requirement. Verify that logs do not duplicate sensitive content. Delimiters and admonitions can help the model parse text but are not enforcement. Data and authority boundaries must exist in surrounding systems.

Evidence: OpenAI; National Institute of Standards and Technology

Instruction-and-schema gate: ambiguity fails visibly

Diff system, developer, template, examples, and user instructions. Check priority, task sequence, evidence rule, uncertainty, forbidden inferences, escalation, and no-answer behavior. Validate structured fields, enums, lengths, source IDs, and review-required states. PASS means representative reviewers interpret the contract consistently and invalid output fails closed. REVIEW covers a redundant instruction with no observed conflict. STOP covers contradictory goals, invented evidence encouraged by a required field, free-form commands consumed downstream, or silent repair that changes meaning. Provider documentation and prompt patterns are inputs to testing, not certificates that the design works on this task.

Evidence: OpenAI; Vanderbilt University researchers

Tool-and-authority gate: capability is narrower than intent

List tools, parameters, credentials, network destinations, file scopes, action classes, retry, timeout, and spend or iteration limits. PASS means least privilege, external validation, idempotency where needed, and human approval bound to exact consequential parameters. REVIEW covers an unused read-only tool scheduled for removal before broader rollout. STOP covers open shell or code execution without isolation, broad account credentials, hidden external communication, destructive access, unbounded loops, or approval after action. Test manipulated tool output and unavailable tools. A prompt saying ask first cannot replace an enforcement point that prevents the call.

Evidence: Anthropic; National Institute of Standards and Technology

Evaluation-and-recovery gate: failure cases were rehearsed

Attach baseline, representative and holdout cases, missing data, conflicting evidence, adversarial input, tool refusal, timeout, duplicate event, and reviewer rejection. PASS means required properties, automatic checks, human rubric, stop control, rollback, and manual continuation work. REVIEW covers a low-consequence rare case with a safe abstention and owner. STOP covers testing only a demonstration, no reproducible version, retry storms, a kill switch nobody can operate, or a metric that ignores user harm. Include cost and latency bounds. Freeze prompt, context rules, model, tools, schema, and evaluator together so results remain interpretable.

Evidence: OpenAI; Anthropic

Release ruling: approve a bounded version and watch real failures

The next action is to run this record on one internal workflow and resolve all STOP findings before user exposure. Every REVIEW item needs an owner, date, safe fallback, and reason it cannot change the current decision. Release to limited volume, monitor schema failures, escalations, tool denials, repeated actions, human overrides, cost, latency, and incident reports, then compare with the baseline. Limits remain: test sets are incomplete, model behavior drifts, vendor guidance changes, and users create new contexts. Re-audit after model, prompt, retrieval, tool, permission, schema, evaluator, or purpose changes. Affiliate-linked platforms remain subject to the same evidence, control, and disclosure requirements.