上线前检查门禁Pre-launch Gates for AI Features
Pre-launch Gates for AI Features
用一组「不过就不放行」的条件，把安全要求变成流程里绕不过的门槛。Turns safety requirements into gates that block release until they pass.
门禁项要可判定：有阈值、有证据、有负责人、有不过时的处置。写「输出质量良好」不算一项，写「按本功能评测集跑完，未通过条目已逐条记录并指派」才算。
阈值来自度量：NIST AI 风险管理框架把 MEASURE 与 MANAGE 并列成职能，意思是先有可复核的测量口径与风险处置记录，再谈放行标准；没有测量口径的「安全」不能当依据。
覆盖面按已知风险目录核对：OWASP 大模型应用 Top 10（官方源仓库，2026 版，条目 LLM01 至 LLM10）适合作为逐项确认表——每条缓解措施是否已部署、是否测过、上次测试日期。
常见的六类硬门槛：评测结果与失败样本、越权与工具调用的权限复核、日志与留存配置（含密钥不落日志）、回滚路径演练过一次、降级与关停的决策人署名、以及未覆盖风险的书面豁免。
自动回退条件要写在门禁里：出现哪类信号（拒答率或成本异常、违规输出、投诉量到阈值）时不需要开会就能降级。
教学虚构例子（非真实阈值）：某团队把「评测集通过率不低于既定目标、且高危条目零失败」写进发布流程，并把数字来源与复核日期记在发布单上。阈值本身要按自己的评测集定，示例数字不能套用。
A gate has to be decidable: a threshold, an artefact, an owner, and a stated consequence when it fails. "Output quality is good" is not a gate; "the feature's evaluation set was run, and every failed case is logged and assigned" is.
Thresholds come from measurement. The NIST AI Risk Management Framework puts MEASURE next to MANAGE, which is the same point: an auditable measurement basis and a recorded risk response come first, release criteria second. "Safe" without a measurement method cannot support a go decision.
Check coverage against a known catalogue. The OWASP Top 10 for LLM Applications (official source repository, 2026 edition, LLM01 to LLM10) works as a per-item confirmation sheet: is the mitigation deployed, was it tested, when.
Six gate categories come up repeatedly in practice: evaluation results with failing samples, a re-check of privileges granted to tools, logging and retention settings including whether secrets reach logs, a rollback path rehearsed once, a named owner for degradation and kill decisions, and written waivers for risks left uncovered.
Write automatic fallback conditions into the gate: which signals - refusal-rate or cost anomalies, policy-violating output, complaint volume crossing a line - trigger a downgrade without calling a meeting.
Invented teaching example, not a real threshold: a team puts "pass rate at or above the agreed target on this feature's evaluation set, and zero failures on high-severity cases" into its release flow, and records where the number came from and when it was last reviewed on the release ticket. Set your own thresholds against your own evaluation set; the example figures are not transferable.
门禁的意义不在多，而在不过就不能走。缺了「不过怎么办」这一列，上线前一天一定会被业务压力绕过，而事后没人能说明当时是谁、依据什么放行的。A gate is useful only if failing it stops the release. The column that is usually missing is "what happens if it fails" - and without it, business pressure walks straight through the gate on the last day, and afterwards nobody can say who let it through or on what basis.
上线门禁 · 放行清单