Go-Live Checklist

Security#

• Keep refresh tokens and webhook secrets in a server-side secret manager.
• Verify least-privilege roles, plan features, and permissions.
• Test secret rotation and rollback coordination without using production traffic.
• Minimize PII and send stable hashes where raw values are unnecessary.

Reliability#

• Define timeouts and business fallbacks for assessment failures.
• Use stable transaction, event, and feedback identifiers.
• Retry with bounded exponential backoff and monitor 401, 402, 403, 429, and 5xx rates.
• Confirm clock synchronization for event replay protection.

Decision quality#

• Exercise allow, review, and block paths in staging.
• Send payment failures, successes, refunds, disputes, and chargebacks—not only successful payments.
• Store assessmentId and submit final outcome feedback.
• Begin with shadow or advisory mode if the policy has not been calibrated against your traffic.

Operational evidence#

Log request time, response status, VertexY assessment ID, latency, action, and reason codes. Never log bearer tokens, signing secrets, raw payment credentials, or unnecessary PII.

Go live only when engineering, risk, and the workspace administrator have signed off on fallback behavior and escalation ownership.