From prototype to production

Working prototype ≠ shippable product. Before an agent touches a client, a paying customer, or any system you can't easily roll back, run through this checklist.

The five questions before any AI touches production

1. What happens when it's wrong? Reversible? Auditable? Small blast radius?
2. Who reviews before it goes out? Draft-only, human-in-the-loop, or fully autonomous?
3. What data is it seeing? PII, client contracts, internal financials — is that OK with the model provider's data policy?
4. How will you know it degrades? Metrics, eval sets, spot checks.
5. What's the monthly ceiling? Rate limits, spend caps, kill switches.

Cost — the ranges to expect (2026)

Practical rules: prove it on the smart, expensive model. Then downgrade. Cache long system prompts (both OpenAI and Anthropic support prompt caching — huge savings). Set hard spend caps in the provider dashboard.

Evals: the professional version of "did it work?"

An eval is a fixed set of inputs, expected outputs, and a scoring function. You run it whenever you change a prompt or model.

TypeScript · a tiny evalconst examples = [
  { email: "Hi, saw your work…", expect: "NEW_LEAD" },
  { email: "Invoice still open…", expect: "EXISTING_CLIENT" },
  { email: "Growth Marketing Intern…", expect: "SPAM" },
  // …grow to at least 30–50 real examples
];

let right = 0;
for (const ex of examples) {
  const got = await classify(ex.email);
  if (got === ex.expect) right++;
  else console.log(`MISS: ${ex.email.slice(0,40)}… expected ${ex.expect} got ${got}`);
}
console.log(`Accuracy: ${right}/${examples.length}`);

Run this before every prompt tweak. If accuracy drops from 94% to 91%, you'll know immediately — instead of finding out from a confused client.

Guardrails

Three layers, in order of impact:

• Prompt-level: "Refuse if the input isn't an RFP." "Never send email; only draft."
• Code-level: Validate outputs (schema check, regex, plausibility). Reject impossible values. Rate-limit destructive tool calls.
• Human-level: Require confirmation before publishing, sending, or spending. Log everything; audit weekly.

Data & privacy

• Read the provider's data policy. OpenAI, Anthropic, and Google all offer "zero data retention" tiers for API usage. Their consumer chat products (ChatGPT, Claude.ai) may train on your data by default — disable that in settings.
• Redact before you send. Strip SSNs, credit cards, medical records before they hit any model. Use regex or a purpose-built tool.
• Use enterprise / BAA tiers for anything covered by HIPAA, FERPA, or DOJ / state privacy laws.
• Prefer on-your-infra models (Cloudflare Workers AI, Llama on your GPU) for genuinely sensitive data.

The ship-it checklist

What to build next

You've got the mental model. You've got the patterns. You've got the code. Real skill comes from shipping. In order of impact for most small businesses:

1. Lead Radar — the agent from Module 8. Automates weekly opportunity discovery. Ship it Monday.
2. Inbound-lead flow — the flow from Module 5. Classifies, tags, drafts replies. Wire it up in n8n or a Worker.
3. Knowledge-base RAG — index your last 20 proposals, contracts, estimates, or FAQs. Query it during every new project.
4. Domain-specific co-pilot — a Cloudflare Worker that takes an input (URL, document, image) and returns a structured audit or analysis. Great as an offering, upsell, or lead magnet.
5. Estimator chatbot — the Cloudflare Agents SDK example. Put it on your marketing site as a qualification / lead magnet.