No single role hands you the whole surface of an AI product. Inside an enterprise I got deployment, scoped tools, real controls and a human gate. I did not get evals or cost engineering, so I built a second system alone, where I had to own those myself.
What is in the piece
Why four narrow model steps instead of one call, and why the seams between them are the only places a human gate can go.
A gate is not an eval. A gate catches errors one at a time on the way out. An eval says whether the next version is better or worse.
Four kinds of test for four kinds of mistake, each checked by the cheapest method that can catch it.
Cost as a product decision. Separate caps per axis, and the expensive model only where people actually look.
Guardrails as architecture, not as instructions to the model.
What I would flag
The enterprise pipeline shipped without an eval set. Every reviewer edit was a labelled failure I was not capturing. That is the first thing I would build.
Neither system has an input guardrail against prompt injection. The human gate and a single scoped send tool limit the blast radius; they do not close the gap.
