Red flags: every feature is “must-have,” success is undefined, and the project has no release boundary. Mitigation: define a critical workflow and a launch threshold.

Red flags: nobody owns stages, exceptions happen outside the system, and process reality differs from documentation. Mitigation: model actual state and recovery paths first.

Red flags: sources of truth conflict, required data is inaccessible, or records are incomplete. Mitigation: define authoritative sources and validation rules early.

Red flags: undocumented APIs, rate limits, weak webhooks or systems that cannot expose required state. Mitigation: prototype the hardest integration before building around it.

Red flags: vague prompts, no evidence, no confidence/fallback model, autonomous high-impact actions. Mitigation: bound AI, ground it, validate it and escalate uncertainty.

Red flags: shared credentials, exposed API keys, broad admin roles, no environment separation. Mitigation: least privilege and secure secrets from day one.

Red flags: users are not involved, new workflow adds steps, or status remains hidden. Mitigation: design around the actual owner’s next action.

Red flags: heavy payloads, slow AI in critical paths, unoptimized images or synchronous chains. Mitigation: measure and isolate expensive operations.

Red flags: no monitoring, no rollback, no owner after launch. Mitigation: define observability, backups, recovery and support before production.