Practical notes from the engineers who build agents, copilots and AI products.
Cover MFA, secrets management, dependency scanning, backups, least privilege, logging and a disclosure policy before chasing certifications. A small team can put every one of these in place in a few weeks with the tooling it already pays for, and the same controls become the evidence a SOC 2 auditor asks for later.
Row- and column-level security tied to the user's role must be enforced at execution time, never left to the prompt. The user's identity flows from sign-in to the database session or to filters the compiler injects, masks hide sensitive fields, and negative tests prove no phrasing can reach rows outside the role.
AI-assisted documentation reads the code and produces reviewable docs for modules nobody documented, with your team validating. The model traces entry points, data flows and business rules, drafts module summaries and diagrams, flags what it cannot infer, and the people who run the system correct and approve each page.
Real-time ranking uses a feature store so a shopper's actions this session change what they see within seconds. Real time personalisation needs a streaming event path, an online feature store, a fast candidate generator and a lightweight ranker, with a nightly batch model kept underneath for the long-term profile.
React Native shares logic with a JavaScript web stack and one team; Flutter and native win only for specific graphics or platform needs. For most business apps the deciding factors are who will maintain the code, what the web product is built in, and which platform features you truly need, not benchmark scores.
Version prompts, run them against a golden set on every change and block releases on regression, exactly as you would with code. Prompts edited in place with no test are the most common reason an AI feature that worked in April is worse in June. Here is the workflow, tooling and eval design that make changes safe.
Clinical assistants retrieve and summarise notes and protocols inside the hospital's environment, with clinicians deciding. The model runs on hospital-controlled infrastructure, every answer cites its source, access follows the clinician's existing rights, and nothing enters the record unsigned.
Banks run open-weight models and retrieval inside their own environment with SSO, audit logs and no data egress. Model, index, prompts and logs live on infrastructure the bank controls, so customer data never crosses the perimeter and every answer traces back to who asked, what was retrieved and what was returned.
pgvector covers most workloads inside Postgres; move to Pinecone, Qdrant or Weaviate when scale or filtering demands a dedicated store. The honest vector database comparison is not about benchmarks but about corpus size, filter complexity, tenancy, operations and who owns the data. Here is how we decide.