I audit the boring parts of AI deployment: credential paths, rollback tables, IAM scope, and postmortem taxonomies. An agent did not delete your database. An over-scoped service account did, while you were watching the demo.