Batch APIs offer a real, substantial discount from most providers. The catch is they trade latency for cost, and applying that tradeoff to the wrong request type is a straightforward user-facing regression."

Prompt caching (provider-side) was covered earlier in this blog. A broader survey of caching layers across an agentic pipeline — where each actually saves money, and where caching risks serving stale results — closes the picture out."

The dashboard from the previous post makes cost visible to humans checking it. Anomaly detection is what catches a spike nobody happened to be looking at the dashboard for, in the hours it matters most."

The cost-attribution infrastructure from earlier in this blog gives you the data. A dashboard nobody checks doesn't change any behavior. The difference is designing for the specific questions engineers actually have."

The earlier on-call runbook post covered quality-regression incidents. A security breach — a successful injection, a compromised MCP server, exploited insider-threat-adjacent access — needs a distinct response path with different priorities."

The OWASP Top 10 for LLM Applications is about how a model gets manipulated. The newer OWASP Top 10 for Agentic Applications is about what happens once that manipulation is handed autonomy. Here's the distinction and what it means for anything you're running in production.

Traditional insider-threat modeling assumes a malicious or careless human with direct system access. An agentic system adds a new insider-threat surface — an agent's own tool access, invoked on a legitimate user's behalf but with more reach than that user might realize."

Connecting an agent to a third-party MCP server is a supply-chain trust decision with the same shape as adding any external dependency, and it deserves the same rigor — which it often doesn't get, because it feels like configuration rather than a dependency."

This blog has covered layered defense for guardrails generally and jailbreaks specifically. Prompt injection — particularly the indirect kind arriving through retrieved content — deserves its own worked-through layered defense, since it's the threat category that shows up most in practice.

The guardrail red-teaming post from earlier in this blog covered the exercise itself. Scaling it means answering a different question — how often, who runs it, and how findings actually drive prioritized fixes rather than a report that sits unread.