Find the risks that can derail a build before they become expensive.
Most software failures are not caused by one bad screen. They come from unclear ownership, unstable scope, inaccessible data, brittle integrations, weak AI boundaries, adoption gaps or missing recovery paths.
Scope risk
Red flags: every feature is “must-have,” success is undefined, and the project has no release boundary. Mitigation: define a critical workflow and a launch threshold.
Workflow risk
Red flags: nobody owns stages, exceptions happen outside the system, and process reality differs from documentation. Mitigation: model actual state and recovery paths first.
Data risk
Red flags: sources of truth conflict, required data is inaccessible, or records are incomplete. Mitigation: define authoritative sources and validation rules early.
Integration risk
Red flags: undocumented APIs, rate limits, weak webhooks or systems that cannot expose required state. Mitigation: prototype the hardest integration before building around it.
AI risk
Red flags: vague prompts, no evidence, no confidence/fallback model, autonomous high-impact actions. Mitigation: bound AI, ground it, validate it and escalate uncertainty.
Security risk
Red flags: shared credentials, exposed API keys, broad admin roles, no environment separation. Mitigation: least privilege and secure secrets from day one.
Adoption risk
Red flags: users are not involved, new workflow adds steps, or status remains hidden. Mitigation: design around the actual owner’s next action.
Performance risk
Red flags: heavy payloads, slow AI in critical paths, unoptimized images or synchronous chains. Mitigation: measure and isolate expensive operations.
Operations risk
Red flags: no monitoring, no rollback, no owner after launch. Mitigation: define observability, backups, recovery and support before production.
Accept
Known, reversible and inexpensive risk can remain with monitoring.
Reduce
Change architecture, scope or workflow to reduce probability or impact.
Prototype
Test the uncertain component before scaling the project around it.
Block launch
Security, data integrity, irreversible automation or compliance-critical gaps should stop production.
Found a high-risk area?
Use the Project Planner and describe the risk explicitly. Discovery should attack the risky assumption first.