What to require before an internal AI app goes to production.
Written for the IT director who is asked to say yes to a working prototype. The champion is usually a domain expert. Your job is to accept an operating environment, not to rebuild the app.
Prerequisites first. Then the platform.
If these items are missing, Low-Ops will not magically make the app supportable. If they are present, the platform is the paved road: deploy, identity, history, recovery.
A named technical owner
Someone in IT or the business who will accept incidents, access reviews and the production handoff. A prototype without an owner is not ready.
Identity before the URL
The app should inherit SSO and roles from the corporate directory. A shared password on a VM is not acceptance.
The network boundary, written down
Where it runs, who can reach it, and whether it can call the public internet. AI apps often need an explicit allow-list for model endpoints.
Secrets and data classification
What data the app reads, where it is stored, and whether prompts or files can leave for a third-party model. Self-hosting the platform does not answer this by itself.
A deploy record and a rollback
You should be able to see who shipped the current version and how to restore the previous one. If that requires a hero, it is not operational.
Limitations of the platform
Low-Ops provisions hosting, SSO, pipelines, backups and an audit trail. It does not review the application’s prompt injection surface, train your model, or certify DORA or GDPR for you.