It works on your machine.
Make it ready for everyone.
Turn an AI-built prototype into a cloud-ready solution with a risk-tiered plan, actionable GitHub issues, and a human production review. Keep the creativity. Add the guardrails.
Already have a publication plan? Choose a change / re-assessment, control exception, or decommission request. These forms route to manual governance review rather than creating duplicate plans.
Your path to publication
Tell us what you built
Describe the app's purpose and AI behavior. Identify its repository, owners, data, audience, integrations, hosting, requested date, and dev/test/prod environment. Read the guide and attest to safe submission and completing the controls. A maintainer allowlists the target and authorizes processing.
Work the issues
The toolkit creates one tracking issue and a set of control issues in your solution repository. Each explains why, what to do, evidence to collect, and how Copilot can help.
Show the evidence
Close required controls as completed, with evidence. Ask a maintainer to comment /validate on the original request. Fix reported gaps.
Get a human decision
A clean automated report earns ready-for-review, not deployment permission. Governance reviews evidence and decides whether to apply approved-for-production.
Risk changes the work, not the accountability
| Tier | Typical signals | What changes |
|---|---|---|
| Low | Internal, public/internal data, small team, read-only integrations, no runtime AI. | Core controls across ownership, security, delivery, and operations. |
| Moderate | Confidential data, organization-wide/public audience, business-system writes, or runtime LLM APIs. | Add recovery/capacity exercises; runtime AI adds its own control. |
| High | External exposure, PII/PHI/PCI/regulated data, or privileged integrations. | Add independent security/privacy review and explicit residual-risk acceptance. |
The highest matching tier wins. “AI helped write the code” is different from “the deployed app calls an LLM.” Every tier still requires secure identity, secret handling, and a reviewed deployment path.
What this toolkit does not promise
A checklist is not a penetration test, compliance certification, or automatic cloud deployment. Repository checks cannot prove your cloud identity, network, logging, or data protections are correct. Keep production environments protected independently of GitHub issue labels.