validator-expert

name	validator-expert
description	Validate production readiness of Vertex AI Agent Engine deployments across security, monitoring, performance, compliance, and best practices. Generates weighted scores (0-100%) with actionable remediation plans. Use when asked to validate a deployment, run a production readiness check, audit security posture, or verify compliance for Vertex AI agents. Trigger with "validate deployment", "production readiness", "security audit", "compliance check", "is this agent ready for prod", "check my ADK agent", "review before deploy", or "production readiness check". Make sure to use this skill whenever validating ADK agents for Agent Engine.
allowed-tools	Read,Grep,Glob,Bash(gcloud:*),Bash(python:*),Bash(pylint:*),Bash(flake8:*),Bash(mypy:*),Bash(bandit:*),Bash(pytest:*)
version	2.22.0
author	Jeremy Longshore <[e-mail]>
license	MIT
tags	["vertex-ai","security","compliance","validation","production-readiness","gcp"]
model	inherit
effort	high
argument-hint	[project-id]
compatibility	Designed for Claude Code

Validator Expert

Current State

!gcloud config get-value project 2>/dev/null || echo 'no active project' !gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null || echo 'not authenticated'

Overview

Validate production readiness of Vertex AI Agent Engine deployments by executing weighted checks across five categories: security (30 points), monitoring (20 points), performance (25 points), compliance (15 points), and best practices (10 points). This skill produces a 0-100% composite score with pass/fail per check and prioritized remediation recommendations.

Prerequisites

• gcloud CLI authenticated with roles/aiplatform.viewer, roles/iam.securityReviewer, and roles/monitoring.viewer
• Access to the target Google Cloud project and Vertex AI Agent Engine deployment
• Cloud Monitoring API and Cloud Logging API enabled in the project
• Knowledge of the deployment's expected SLOs (latency targets, error rate thresholds)
• Read-only access to IAM policies, VPC-SC configurations, and service account bindings

Instructions

1. Retrieve the deployment configuration using the Python SDK (vertexai.Client().agent_engines.get(name)) or REST API (GET https://{LOCATION}-aiplatform.googleapis.com/v1/projects/{PROJECT}/locations/{LOCATION}/reasoningEngines/{ID}) and parse model, scaling, and feature settings
2. Run the security validation suite (see security checklist):
   • Check if Agent Identity is enabled (recommended over service accounts for 2025+ deployments)
   • If using service accounts, verify IAM roles follow least-privilege (roles/aiplatform.expressUser, not roles/aiplatform.admin)
   • Confirm VPC Service Controls perimeter is active and correctly scoped
   • Check encryption at rest (CMEK or Google-managed) and in-transit (TLS 1.3)
   • Scan configuration files and environment variables for hardcoded secrets
   • Validate Model Armor is enabled with roles/modelarmor.user granted
   • Check Memory Bank IAM Conditions for multi-tenant agents
3. Run the monitoring validation suite:
   • Verify Cloud Monitoring dashboards exist with required panels (request count, error rate, latency)
   • Confirm alerting policies cover error rate spikes, latency SLO breaches, and cost thresholds