# Expertise — running AI in production

> The cross-cutting concerns that decide whether an AI system holds up in production, and how we address each one.

## Retrieval & grounding

Most production AI answers questions about your data, not the open web. Retrieval decides what
the model sees; grounding keeps the answer tied to it. We treat both as things to measure.
We put in place: measured retrieval, tuned indexing, grounded answers with citations, and
honest gaps (the system says so when support is not there).

## Agent orchestration

An agent plans, calls tools, and acts over many steps. The hard part is the control around it:
knowing what to do next, when to stop, and what to do when a step fails. We put in place: step
control (limits on steps, budget, time), failure recovery, reversible/gated high-stakes actions,
and visible reasoning that can be replayed.

## Guardrails & safety

The moment a system reads untrusted text it can be steered. We put in place: input handling
(untrusted input treated as data, not commands), output filtering, injection defenses, and
adversarial testing before someone else does it.

## Observability

When an AI system behaves oddly, you need to see why. We put in place: end-to-end traces across
retrieval, prompt, model, and tools; captured inputs and intermediate steps; readable signals;
and fast diagnosis so issues are investigated, not guessed at.

## Model lifecycle

Models are not fixed dependencies — providers update them and performance drifts. We put in
place: pinned model and prompt versions, benchmarked choices on your own use cases, tested
upgrades, and clear cost/latency/quality trade-offs.

## Evaluation

Evaluation is how you know whether a change made the system better or worse. Because outputs
are non-deterministic, this takes more than a unit test: shared definitions of "good", scored
datasets, and regression gates that catch problems before users do.

## Validation

AI-native, continuous checks that judge production outputs as they happen, catching failures
in real time rather than in hindsight.

## Governance

What the system is permitted to do and who answers for it: approved use cases, autonomy limits,
and human sign-off.

## Compliance

Meeting obligations specific to AI, from privacy and data residency to the EU AI Act's
documentation and evidence requirements.