Exercise 6: Running It in Production

Overview

Four artifacts for Lintel, about three hours — the heaviest exercise in Part 3.

Two of these are unusual. The unit-economics model may disprove the business case, and the privacy design is written to be rejected or approved by a specific person rather than filed. Both are more valuable for that.

This exercise consumes three earlier ones. The NFR budget from Exercise 2 — two of its numbers get tested against arithmetic here, and one does not survive. The serving topology from Exercise 4, which fixes where inference runs and what it costs. And the agent design and action boundary from Exercise 5: the cost model prices the loop they bound, and the threat model attacks the surface they expose.

How to work

In order. The evaluation plan depends on the threat model (the adversarial suite is part of it), and the cost model depends on knowing what the guardrails cost.

Unit-economics model — ~50 min
Threat model with layered guardrails — ~45 min
Privacy design — ~40 min
Evaluation plan — ~45 min
Self-check — seven pass/fail items

Artifact 1 — Unit-economics model

Two pages, mostly arithmetic.

The unit, named. Cost per resolved interaction, with the denominator stated — and attempts that ended in a handoff in the numerator, not the denominator.
Four input lines, not two: regular input, cache write, cache read, output. With the multipliers labelled as assumptions and dated.
Traffic classes modelled separately — the answer path, the action path, and batched eval/refresh work.
p50 and p95, because the tail is where the ceiling breaks.
The loop arithmetic for the action path: the step cap, what it caps input volume to, and what caching repricing does to it.
The guardrail cost line — model-based checks are billed calls on top of the call they protect. Most models omit this.
The lever shortlist, ranked by ceiling, in free-wins-then-trade-offs order, with each trade-off marked blocked until an eval exists.
Governance: attribution, degradation threshold, hard stop, and who owns which number.

Then answer the question plainly: is $3.00 achievable? Show the arithmetic that settles it, including if the answer is no, and say what you would put in front of the CFO instead.

Label every figure by evidence tier. No production telemetry exists, so almost everything is an estimate — saying so is what makes the rest credible.

Artifact 2 — Threat model with layered guardrails

One table plus a page.

The table: asset · entry point · actor · impact · control · where enforced. That last column is what separates a threat model from a worry list.

Required coverage:

All four entry points, not just the user’s message: retrieved documentation, historical ticket text, and tool descriptions.
Indirect injection through ticket content, with the containment argument leading — which actions are reachable and what bounds them.
The write-surface question answered explicitly: who can add content to anything the system retrieves.
Every action checked against least privilege — credential scope per tool, narrowest authority that works.
Denial of wallet as a threat with a named control.
The five layers, each marked deterministic or probabilistic, with what each catches that the layer before it did not.
The measurement plan: adversarial suite pass rate, leakage counts, refusal appropriateness with its owner.

State the residual risk plainly. Injection is mitigated, not solved; say so in the words you would use with a compliance owner.

Artifact 3 — Privacy design

Six sections, a handful of pages, written for the person who can block you.

Data-flow description — what enters, where it rests, where it is processed, what leaves.
Purposes, per flow.
Retention table — what, where, how long, why.
The erasure table — every derived form: primary store, index, caches, traces, logs and backups, trained weights. Mark the gaps.
Residency evidence — the mechanism that proves per-request processing location, not the claim.
Controls with enforcement points, carried from Artifact 2.

The test: could Lena Fischer read this and give you a yes or a no? If she would have to ask for something, add it now.

Artifact 4 — Evaluation plan

Two pages.

The four layers, with your system sorted into them — and the deterministic controls assigned to unit tests rather than evals.
Golden dataset specification: sources, size, gold provenance per case, the four coverage groups including declines and adversarial cases, owner, refresh cadence, and set-plus-grader versioning.
Grader type per property, cheapest-that-works, with end-state checks for anything that acts.
Aggregation per property — mean where a mean is right, fail-on-any for the irreversible ones.
Judge calibration: human-labelled sample, agreement figure, different model family, known-negative tests.
Harness proving: the oracle run and the null run, before any real measurement.
Conflation rules — errors to a sidecar, truncations recorded not averaged, “no answer” distinguished from “negative answer”.
The noise-floor arithmetic for your set, and a regression trigger that clears it.
Online signals that catch what the frozen set cannot.
What happens when it triggers, automatically.

Self-check

Pass or fail.

The cost model is arithmetic with stated assumptions, not an estimate. Four input lines, labelled multipliers, evidence tier per figure.
The model shows whether $3.00 is achievable and says so plainly, including if the answer is no.
The threat model covers indirect prompt injection through ticket content, not just user input. With the write-surface question answered.
Every agent action is checked against least-privilege. Credential scope per tool.
The privacy design addresses erasure from embeddings, not just from the primary store. And from caches and traces.
The eval plan defines what “worse” means numerically and what happens when it triggers. With the noise floor computed.
Golden dataset ownership and refresh cadence are assigned. To a named person who owns the outcome.

If something failed

If your regression trigger is inside the noise floor, that is the most consequential fix available here. Compute 1/√(n·R), compare it against your trigger, and either raise the repetitions, widen the trigger, or say plainly that smaller regressions are undetectable. Leaving a trigger the measurement cannot support is worse than having none.

If the cost model has two input lines, it is wrong in both directions. Cache reads and writes are priced an order of magnitude apart and neither equals regular input.

If the privacy design stops at the primary store and the index, check the cache. Module 6’s first section made caching the largest cost lever and nobody building it for cost reasons was thinking about erasure — that tension between two pillars is the finding this artifact exists to surface.

If the threat model’s controls are mostly model-based, convert the deterministic ones. A limit check is arithmetic; asking a model whether an amount is too large is a strict downgrade.

→ It is costed, defended and measured. Next, attack your own design before anyone else does. — Exercise 7, after reading Handbook Module 7.