In 2025, a researcher embedded a prompt injection in a code file. When an AI agent opened it, the agent read .env credentials and sent them over the network using commands that were on the agent's allowlist. No confirmation prompt fired. No safety check triggered. The credentials were gone. CVE-2025-55284. That agent was running locally. Imagine it had access to your production database. This is the gap between "my agent works" and "my agent is safe to deploy." Every framework helps you build agents. None of them solve what happens when agents touch real data, real users, and real consequences. This guide is about the second part. What production actually requires, which frameworks handle what, and how to ship agents that will not embarrass you at your next security review. Or, if you just want agents running safely today: skip to the fast path .…