Treat the release meeting as a decision about the whole application, including its integrations and information sources. These questions are a starting point for that conversation.

Name the owner

Who approves the use case? Which team can stop the feature, change its permissions, and investigate an unexpected result? Put those names beside the application record.

Trace the information

Draw a simple path from a user request to the data sources and external services involved. Ask which information is needed, where it is retained, and what another user must never be able to retrieve.

Bound the actions

List every tool the application can call. Decide which actions can proceed automatically, which need human approval, and what happens when a tool fails or returns an unexpected result.

Prepare the release decision

Agree misuse scenarios, test accounts, stop conditions, and the evidence the release owner needs. Keep unresolved findings visible and set a review trigger when the model, data source, or integration changes.

TAKE IT INTO YOUR NEXT MEETING

A starting checklist.

  • Named use-case and release owners
  • Data sources and retention decisions
  • Tool permissions and approval boundaries
  • Authorized misuse tests and findings
  • Rollback owner and review triggers
FURTHER READINGOWASP guidance on LLM application risks

This guide provides general planning questions. Adapt them to your environment and agreed assessment requirements.

Back to resources