Advanced

Deployment, Monitoring, and Knowledge Transfer

The FDAE production deployment checklist, what monitoring means for LLM systems, the self-sufficiency test, and how to run a handoff that sticks six months after you leave.

✍️ AI School Editorial Team · Lilly Tech Systems 📅 Published Jul 2, 2026 · Reviewed Jul 2, 2026

The Production-Ready Bar

The gap between a prototype that demos well and a system that runs reliably in production is larger than most customers expect and smaller than most enterprise IT teams fear. The FDAE’s job is to close that gap specifically, not to either over-promise (“this is production-ready”) or over-qualify (“there are so many things to fix before we can ship”).

The production-ready bar for an FDAE engagement is not the same as the production-ready bar for a system that must handle millions of users. It is calibrated to the scale and risk of the specific customer workflow. For a system processing 50 documents per day with a human reviewer checking outputs, the bar is significantly lower than for an automated system making consequential decisions at scale.

Secrets are in environment variables, not in code. API keys, database credentials, and service tokens must be stored in environment variables or a secrets manager, not hardcoded in the repository. This is non-negotiable before any production deployment.
All external calls have timeouts and retry logic. LLM API calls fail. Networks have transient errors. Every external call needs a timeout (prevent hanging), a retry with backoff (handle transient failures), and a failure path that surfaces the error rather than silently returning nothing.
Inputs are validated before reaching the model. Empty inputs, inputs exceeding the context limit, and inputs of unexpected types should be caught at the boundary and return a useful error, not trigger an API call that fails in an opaque way.
Outputs are validated before being used. If the system expects JSON output, parse it and validate the schema before passing results downstream. A model that returns malformed JSON on rare inputs should not bring down the workflow.
Every consequential action has a human review step. For decisions that affect customers, financial transactions, or compliance-relevant records, the AI output should be surfaced for human review before taking effect. The NIST AI Risk Management Framework provides a structured approach to identifying which AI decisions require human oversight based on risk level.
There is a rollback procedure. Document how to disable or revert to the previous workflow if the AI system causes problems. The rollback procedure should be testable and known to the customer team before go-live.

Monitoring LLM Systems in Production

Monitoring for LLM systems is different from monitoring for traditional software. Traditional software either works or it does not. LLM systems can produce outputs that are syntactically valid but semantically wrong - correct JSON with incorrect content. Monitoring must account for this.

The three layers of monitoring for a production LLM system:

LayerWhat to monitorSignal that something is wrong
InfrastructureAPI latency, error rate, cost per callLatency spikes, 5xx error rate above baseline, cost anomaly
Output qualitySchema validation pass rate, null output rate, user correction rateValidation failures above 2%, rising correction frequency
Business outcomeWorkflow completion rate, time saved, cases escalated to manual reviewManual review rate rising - model is degrading on real-world inputs

Build the output quality layer into the system from day one, not as an afterthought. A logging wrapper that records each input, the raw model output, the parsed result, and whether validation passed takes a day to build and provides the data you need for every future debugging and improvement conversation. The OpenAI platform documentation and Anthropic API documentation both cover usage logging, rate limits, and token accounting that inform the infrastructure monitoring layer.

💡
Prompt drift: LLM provider model updates can change output behavior without changing the API contract. A prompt that worked correctly in May may produce subtly different outputs in September after a model update. Build a regression test suite of 20-30 golden examples - known inputs with expected outputs - and run it after any model version change. The OWASP Top 10 for Large Language Model Applications documents prompt injection and other model-level risks that monitoring should be designed to detect.

The Self-Sufficiency Test

The self-sufficiency test is the final gate of an FDAE engagement. It answers the question: can this team operate, troubleshoot, and extend this system without calling us? If the answer is yes, the handoff is complete. If the answer is no, the engagement is not finished.

Run the self-sufficiency test in a structured session with the customer team, three to five business days before the official end of the engagement - early enough to address gaps before you leave. The test has four components:

1
Break it and fix it. Introduce a deliberate failure (wrong API key, malformed input, network timeout simulation) and ask the team to diagnose and fix it without your help. If they can, you have transferred operational knowledge. If they cannot, run the diagnosis together and repeat the exercise the next day.
2
Modify it. Ask the team to make a specific change to the system without your involvement - update a prompt, add a new output field, change a routing rule. Watch them do it. The goal is not to test whether they can code; it is to confirm they understand the system well enough to modify it safely.
3
Explain it. Ask the designated maintainer to explain the system to a colleague who was not involved in the engagement. The explanation should be accurate, at the right level of abstraction, and not require your correction. This confirms knowledge transfer, not just system access.
4
Escalate it. Give the team a scenario that exceeds their capability - a problem that genuinely requires outside help. Confirm they know who to call, what information to gather before calling, and what the escalation path is. Self-sufficiency does not mean knowing everything; it means knowing the limits and having a plan for when those limits are reached.

The Handoff Package

The handoff package is the artifact that makes the self-sufficiency test passable six months after you leave. It is not optional. Without it, the institutional knowledge built over the engagement evaporates when the team turns over or when a problem surfaces that no one remembers how you handled.

The minimum viable handoff package for an FDAE engagement:

What goes in the handoff package:
  • System overview (one page): what the system does, what it does not do, and where the edge cases are
  • Architecture diagram: data flow from input to output, all integration points labeled with owner and failure mode
  • Runbook: how to restart, how to deploy changes, how to roll back, who to call for each external dependency
  • Prompt documentation: the current prompt(s), the reasoning behind key design decisions, what to test when modifying
  • Known limitations: documented failure modes with specific examples and the mitigation or manual fallback for each
  • Next-step roadmap: what would make the system better, in priority order, as inputs for the follow-on engagement
💡
Compliance documentation: For deployments in regulated industries, the handoff package should include a record of the data handling decisions made during the engagement - what data was sent to external APIs, what DPAs were confirmed, and what controls were implemented. The EU AI Act (Regulation 2024/1689) imposes documentation and transparency obligations for AI systems in high-risk categories deployed within the EU; confirm applicability with the customer’s legal team as part of the engagement.

Ready to Go Deeper?

Live instructor-led courses from our partners. Affiliate disclosure.