Probabilistic applications need evaluation datasets that cover representative tasks, adversarial inputs, and known failure cases. Measure task success, groundedness, retrieval quality, refusal correctness, latency, and cost. Human review remains useful when automatic scores do not reliably reflect user value.

Treat retrieved documents and tool results as untrusted input. Prompt injection may try to override instructions or induce unauthorized actions. Enforce tool permissions and resource authorization in application code, validate arguments against narrow schemas, and require confirmation for high-impact operations.

Record model version, prompt version, retrieval version, and trace identifiers while minimizing sensitive prompt retention. Redact secrets and personal data. Canary model or prompt changes, compare evaluation results, and keep rollback paths for quality or safety regressions.