Insights ·
Reliability is the product
Public markets and equity compensation can fund long-term AI research and retain the people who do it — and in the same motion, they demand quarterly growth, rapid capability releases, and competitive positioning. Safety and governance are slow, cumulative, and difficult to narrate in an earnings call. Capability is fast, demonstrable, and marketable. That asymmetry is not a moral failing; it is a structural tension every team shipping AI to production has to manage. An essay by Finn Tang, founder.
Idea and philosophy: Finn Tang. Drafted with AI assistance. A framework piece — the practices below come from what we build and hold ourselves to, not from events we report on.
The tension is structural, not personal
The same incentives that attract talent can also accelerate deployment before controls are mature. Nobody in the chain has to act in bad faith for the outcome to go wrong: the incentives point the same way for everyone involved.
Capability is…
Fast, demonstrable, and marketable. It demos well, it ships on a quarterly narrative, and it differentiates in a competitive market.
Governance is…
Slow, cumulative, and difficult to narrate in an earnings call. Its value is invisible right up until the day it is the only thing that matters.
The solution is not to reject capital markets. They genuinely help — they retain talent and fund long-term research. The solution is to institutionalise the controls the market won't narrate for you: model risk management, change management, incident response, vendor risk assessment, and board-level oversight. Boring names, on purpose. Boring is what survives contact with a quarterly calendar.
Ten practices for teams deploying AI in production
None of these are exotic. All of them are skipped, somewhere, every day, by teams under delivery pressure. In our experience the skipped ones are exactly where the incidents come from.
- 1Pin model versions. Maintain a model registry. Every deployment should be reproducible from a known state — not from whatever the vendor served that morning.
- 2Treat prompts and agent behaviour as code. Version control, CI/CD, tests, and rollback apply to prompts and agent workflows exactly as they apply to application code.
- 3Build evaluation datasets from real edge cases. Benchmarks are not your business. Evaluation sets should reflect the awkward, high-stakes inputs your customers actually send.
- 4Route by task, not by fashion. Use stable, older models for high-volume tasks; reserve frontier models for the tail where their capability pays for their unpredictability.
- 5Enforce least privilege. Sandbox all tool execution. An agent should hold the smallest set of permissions that lets it do today's job — never tomorrow's hypothetical job.
- 6Instrument everything. Latency, cost, failures, refusals, drift. If it isn't measured, it isn't operated — it's merely hoped for.
- 7Define human escalation paths. High-risk decisions need a named human owner and a way to reach them. Escalation that exists only in a policy document does not exist.
- 8Review vendor terms. Data usage, retention, and compliance terms decide where your customers' information actually lives. Read them before the integration, not after the incident.
- 9Red-team your agent workflows. Regularly, and against the workflows themselves — not just the model in isolation. Agents fail in the seams between tools.
- 10Accept that reliability is the product. Maximum intelligence is not what customers buy. Bounded, auditable, dependable behaviour is.
Architecture and governance are the foundation
The transition period of AI adoption will not be won by the strongest model alone. It will be won by systems that are reliable, auditable, bounded, and economically sustainable. Architecture, version control, security boundaries, and governance are not secondary concerns. They are the foundation.
The real risk is not that models are too intelligent. The real risk is that organisations grant them real authority faster than they build the architecture and governance to control them.
This is the standard we deliver by
Version control, least privilege, instrumentation, gates with verdicts, and a written record — the practices above are the ones we hold our own systems to before we'd hold yours to them. If you want AI output you can operate, not just admire, start with a free AI Audit.