Reliability

Know how Agent data can be recovered before you depend on it

AI Team treats reliability as proof, not intent. Production data controls, backups, restore drills, tenant isolation tests, storage policy, connection pooling, monitoring, and incident paths must be proven before high-volume Agent operations.

Launch evidence gate

Production readiness is tracked as evidence so reliability gaps are visible before clients depend on live Agents.

Database migrations, Data API grants, isolation behavior, Storage policies, backups, restore drills, advisor review, and connection pooling each need evidence.
10 Supabase operations areas currently block public launch until production proof is collected.
CI validates the contract and schema posture; secure operations environments collect runtime proof once credentials are available.

Tenant isolation proof

The database layer must prove who can read what before any Agent operates against client data.

RLS tests cover public Agent-template reads, organization boundaries, credential column denials, service-role-only tables, billing mirrors, and operator audit visibility.
The Supabase Data API exposure manifest classifies every public table, helper function, role grant, service-role-only table, and sensitive column denial.
Runtime launch requires the pgTAP RLS test suite and Supabase advisor review to pass against a production-equivalent database.

Backup and restore readiness

Backups are not trusted until AI Team restores from them and verifies the recovered environment.

Postgres schema, critical data, roles, grants, RLS policies, functions, and operational ledgers need backup and export evidence.
Private client files and generated reports need separate Storage object backup and restore procedures.
Restore drills record recovery time, recovery point, missing object classes, failures, and remediation owners.

Storage and file boundaries

Files are classified before upload so public assets, private client files, operator evidence, and generated reports do not share vague storage rules.

public-media: public storage for Brand, blog, catalog, Open Graph, and public marketing assets.
private-client-files: private storage for Client-provided files needed for scoped Agent workflows.
operator-only-files: private storage for QA evidence, incident attachments, implementation notes, and internal review artifacts.
generated-reports: private storage for Client-visible generated reports after approval and retention classification.

Runtime resilience

Reliability includes database connections, run visibility, webhook replay, cost controls, and incident paths, not just a healthy homepage.

Web, API, worker, migration, and operator jobs must use the right Supabase direct or pooled connection mode.
Environment checks, Sentry, request IDs, public status snapshots, and protected operator incident actions create a minimum operational evidence trail.
Webhook replay, backup restore, incident handling, and credential revocation drills need named owners before launch.

Public reliability limits

AI Team should be specific about controls without implying formal certifications or uptime commitments before those contracts exist.

The public site can describe backup, restore, monitoring, and incident readiness, but formal SLAs belong in approved commercial terms.
High-risk or custom Agent workflows may require additional recovery, audit, retention, or support terms before deployment.
Reliability claims should stay tied to verified evidence, not broad platform promises.

Next step

Need data recovery needs checked before go-live?

Start setup so AI Team can confirm recovery needs, connected systems, file handling, provider dependencies, incident paths, approval rules, and go-live evidence for the Agent.

Start setup Contact AI Team

Launch evidence gate

Production readiness is tracked as evidence so reliability gaps are visible before clients depend on live Agents.

Database migrations, Data API grants, isolation behavior, Storage policies, backups, restore drills, advisor review, and connection pooling each need evidence.

10 Supabase operations areas currently block public launch until production proof is collected.

CI validates the contract and schema posture; secure operations environments collect runtime proof once credentials are available.

Tenant isolation proof

The database layer must prove who can read what before any Agent operates against client data.

RLS tests cover public Agent-template reads, organization boundaries, credential column denials, service-role-only tables, billing mirrors, and operator audit visibility.

The Supabase Data API exposure manifest classifies every public table, helper function, role grant, service-role-only table, and sensitive column denial.

Runtime launch requires the pgTAP RLS test suite and Supabase advisor review to pass against a production-equivalent database.

Backup and restore readiness

Backups are not trusted until AI Team restores from them and verifies the recovered environment.

Postgres schema, critical data, roles, grants, RLS policies, functions, and operational ledgers need backup and export evidence.

Private client files and generated reports need separate Storage object backup and restore procedures.

Restore drills record recovery time, recovery point, missing object classes, failures, and remediation owners.

Storage and file boundaries

Files are classified before upload so public assets, private client files, operator evidence, and generated reports do not share vague storage rules.

public-media: public storage for Brand, blog, catalog, Open Graph, and public marketing assets.

private-client-files: private storage for Client-provided files needed for scoped Agent workflows.

operator-only-files: private storage for QA evidence, incident attachments, implementation notes, and internal review artifacts.

generated-reports: private storage for Client-visible generated reports after approval and retention classification.

Runtime resilience

Reliability includes database connections, run visibility, webhook replay, cost controls, and incident paths, not just a healthy homepage.

Web, API, worker, migration, and operator jobs must use the right Supabase direct or pooled connection mode.

Environment checks, Sentry, request IDs, public status snapshots, and protected operator incident actions create a minimum operational evidence trail.

Webhook replay, backup restore, incident handling, and credential revocation drills need named owners before launch.

Public reliability limits

AI Team should be specific about controls without implying formal certifications or uptime commitments before those contracts exist.

The public site can describe backup, restore, monitoring, and incident readiness, but formal SLAs belong in approved commercial terms.

High-risk or custom Agent workflows may require additional recovery, audit, retention, or support terms before deployment.

Reliability claims should stay tied to verified evidence, not broad platform promises.