This is module 03, the gap between a demo that works and a system you can run on a Tuesday at 3am. Most AI projects die here, not in the modelling. The prototype impresses everyone in a meeting, then meets real traffic, real attackers, real invoices, and real questions from your finance team, and nobody owns the answers. The pages below are ordered the way the decisions actually arrive: you pick where the model runs, you find out what it is doing, you stop it doing harm, you defend it, and then you pay for it.
- After this module you can choose between a managed API, cloud-hosted open weights, and self-hosting, and defend the choice with cost, latency, and control arguments rather than preference.
- After this module you can specify what your team must instrument before launch, and reject a launch plan that has no tracing or online evals.
- After this module you can challenge an engineer who says "we validate the output" by asking what happens when the check fails and who gets paged.
- After this module you can explain prompt injection to a security reviewer or an executive, using a concrete attack rather than an abstraction.
- After this module you can size an inference bill, name the levers that move it, and tell a plausible saving from a fantasy one.
| # | Page | Time | What you get |
|---|---|---|---|
| 1 | Deployment options | 20 minutes | Managed API vs cloud-hosted open weights vs self-hosting, scored honestly. |
| 2 | Observability and monitoring | 20 minutes | Tracing, online evals, drift, alerting, and what a good dashboard shows. |
| 3 | Guardrails and safety | 20 minutes | Input and output checks, policy layers, and graceful degradation. |
| 4 | Security for AI systems | 25 minutes | Prompt injection with worked attacks, and the OWASP LLM Top 10 for managers. |
| 5 | Cost management | 20 minutes | The levers, caching, routing, and a worked example of cutting a bill. |
About 1 hour 45 minutes for the full module.
Read deployment options and security properly, because both produce decisions that are expensive to reverse once code and contracts exist. Skim observability, guardrails, and cost on the first pass and come back to whichever one your current system is weakest at. The useful first action at work is small: open your live AI feature, ask your team to show you one real request end to end, and see how far they get before they are guessing.
Next: Building AI teams
Related: Evaluation fundamentals | Metrics and KPIs | AI launch checklist