| name | validator-expert |
| description | Validate production readiness of Vertex AI Agent Engine deployments across
security, monitoring, performance, compliance, and best practices. Generates
weighted scores (0-100%) with actionable remediation plans. Use when asked to
validate a deployment, run a production readiness check, audit security posture,
or verify compliance for Vertex AI agents. Trigger with "validate deployment",
"production readiness", "security audit", "compliance check", "is this agent
ready for prod", "check my ADK agent", "review before deploy", or
"production readiness check". Make sure to use this skill whenever validating
ADK agents for Agent Engine.
|
| allowed-tools | Read,Grep,Glob,Bash(gcloud:*),Bash(python:*),Bash(pylint:*),Bash(flake8:*),Bash(mypy:*),Bash(bandit:*),Bash(pytest:*) |
| version | 2.1.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatible-with | claude-code, codex, openclaw |
| tags | ["vertex-ai","security","compliance","validation","production-readiness","gcp"] |
| model | inherit |
| effort | high |
| argument-hint | [project-id] |
Validator Expert
Current State
!gcloud config get-value project 2>/dev/null || echo 'no active project'
!gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null || echo 'not authenticated'
Overview
Validate production readiness of Vertex AI Agent Engine deployments by executing weighted checks across five categories: security (30 points), monitoring (20 points), performance (25 points), compliance (15 points), and best practices (10 points). This skill produces a 0-100% composite score with pass/fail per check and prioritized remediation recommendations.
Prerequisites
gcloud CLI authenticated with roles/aiplatform.viewer, roles/iam.securityReviewer, and roles/monitoring.viewer- Access to the target Google Cloud project and Vertex AI Agent Engine deployment
- Cloud Monitoring API and Cloud Logging API enabled in the project
- Knowledge of the deployment's expected SLOs (latency targets, error rate thresholds)
- Read-only access to IAM policies, VPC-SC configurations, and service account bindings
Instructions
- Retrieve the deployment configuration using the Python SDK (
vertexai.Client().agent_engines.get(name)) or REST API (GET https://{LOCATION}-aiplatform.googleapis.com/v1/projects/{PROJECT}/locations/{LOCATION}/reasoningEngines/{ID}) and parse model, scaling, and feature settings
- Run the security validation suite (see security checklist):
- Check if Agent Identity is enabled (recommended over service accounts for 2025+ deployments)
- If using service accounts, verify IAM roles follow least-privilege (
roles/aiplatform.expressUser, not roles/aiplatform.admin)
- Confirm VPC Service Controls perimeter is active and correctly scoped
- Check encryption at rest (CMEK or Google-managed) and in-transit (TLS 1.3)
- Scan configuration files and environment variables for hardcoded secrets
- Validate Model Armor is enabled with
roles/modelarmor.user granted
- Check Memory Bank IAM Conditions for multi-tenant agents
- Run the monitoring validation suite:
- Verify Cloud Monitoring dashboards exist with required panels (request count, error rate, latency)
- Confirm alerting policies cover error rate spikes, latency SLO breaches, and cost thresholds
- Check token usage tracking is enabled with per-model granularity
