How should security risk assessment be designed for production?

For production, use consistent criteria, include asset value and exposure, document assumptions, distinguish inherent from residual risk, assign owners, and review accepted risks when conditions change. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.