# IProductionProfileCheck

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.iproductionprofilecheck/
> Summary: IProductionProfileCheck: Answers one production decision while the host starts, for RequireProductionProfile.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

Answers one production decision while the host starts, for
`RequireProductionProfile`.

```csharp
public interface IProductionProfileCheck
```

## Remarks

Checks are registered with `TryAddEnumerable` and are only resolved
when an application actually called `RequireProductionProfile`, so
contributing one costs a host that never calls it nothing.

**More than one check may carry the same
[IProductionProfileCheck.Risk](/api/tracon.iproductionprofilecheck/#Tracon_IProductionProfileCheck_Risk), and the strictest answer wins.** That is how a
package refines a decision the core cannot see the whole of: the core reads
which [ITenantContext](/api/tracon.itenantcontext/) is bound, the HTTP package adds whether
tenant resolution is switched on, and a deployment that satisfies only one
of the two is still reported as permissive.

A check is a COMPOSITION question, not a security proof. It reports that a
feature is switched on; it says nothing about whether the policy behind it
is right.

**Lifetime:** registered as a singleton and resolved once,
while the host starts. It is never resolved again, so it holds no state
between calls and needs no thread safety of its own.

**Tenant mode:** tenant-independent. The gate runs before the
first request, so there is no ambient tenant to read and the question it
answers is about the deployment rather than about one tenant's data.

**Delivery:** no delivery guarantee applies. This is not a
delivery seam; [IProductionProfileCheck.Evaluate](/api/tracon.iproductionprofilecheck/#Tracon_IProductionProfileCheck_Evaluate_System_IServiceProvider_) is called once per host start, and a
host that never calls `RequireProductionProfile` never calls it at
all.

## Properties

### <a id="Tracon_IProductionProfileCheck_Risk"></a> Risk

Gets the decision this check answers.

```csharp
TraconProductionRisk Risk { get; }
```

#### Property Value

 [TraconProductionRisk](/api/tracon.traconproductionrisk/)

## Methods

### <a id="Tracon_IProductionProfileCheck_Evaluate_System_IServiceProvider_"></a> Evaluate\(IServiceProvider\)

Answers the decision.

```csharp
ProductionProfileResult Evaluate(IServiceProvider services)
```

#### Parameters

`services` [IServiceProvider](https://learn.microsoft.com/dotnet/api/system.iserviceprovider)

A SCOPED service provider, so a check may resolve a scoped service. It
is valid only for the duration of the call.

#### Returns

 [ProductionProfileResult](/api/tracon.productionprofileresult/)

What the check found.

#### Remarks

Runs once, while the host starts. An exception thrown here stops the
host and names this check: a gate that fails open is worse than no gate.