Engagements that had to hold under load.

The team had shipped three model-backed features in a year. Each made sense alone. Together they shared no cache, no routing policy, and no cost owner.

We mapped every call path, introduced a shared serving layer with semantic cache and model routing, and put evals on the quality bar the product already promised customers.

Finance got attribution. Engineering got a paved path for the next feature. The copilots stayed.

Hallucinated citations are not a model problem; they are a system problem. The pipeline rewarded fluency and hid misses.

We introduced a gold set from real matters, citation verification, and a refusal path that was allowed to say 'not in the corpus.' Retrieval and chunking were redesigned against that bar.

Partners started using it. Support tickets about 'the AI made something up' dropped off the weekly review.

Shadow AI spend was showing up in six cost centers. Security had no inventory. Each team was solving tool use, auth, and tracing from scratch.

We defined a thin platform: identity, tool gateway, tracing, evals, and a starter runtime. Divisions kept product logic. The platform kept the dangerous parts.

An engineer on the inside now owns it. We left the RFC, the paved-path docs, and a working control plane.