A polished AI demo answers the happy-path question. A production system must also answer: what is this user allowed to know, what can the model do, and how will we know when it is wrong?
Treat context as privileged data
Retrieval should enforce the same authorization rules as the systems that own the source material. Filtering results after retrieval is too late; sensitive context may already have crossed a boundary or influenced an answer.
Give tools narrow authority
An agent should receive the smallest useful set of capabilities. Separate read actions from write actions. Require confirmation for consequential changes. Make every tool call observable and attributable.
Evaluate the whole system
Model benchmarks do not measure your product. Build evaluations from real tasks, edge cases, prohibited disclosures, ambiguous requests, and expected refusal behavior. Track quality, latency, and cost together.
Design the failure state
A trustworthy AI feature can say that it does not know, cite its basis, request missing information, and hand control back to a person. Confidence without a safe failure path is not intelligence; it is operational risk with good typography.