Skip to content
Starone

Capability

AI systems engineered for production, not for the demo

A model call is the easy part. We engineer what surrounds it: retrieval, orchestration, tools, evaluation, security, cost control and telemetry, so that an AI feature can be measured, operated and trusted.

Overview

AI engineering is the discipline of turning a model's capability into a system an organisation can depend on. The model is one component. Around it sit retrieval, orchestration, tools, guardrails, evaluation, access control, cost management and telemetry, and most of the engineering effort goes into those parts.

It matters because language models are probabilistic. The same input can produce different outputs, a fluent answer can be wrong, and behaviour shifts when a provider updates a model or when your documents change. A system built on such a component needs measured quality, bounded failure modes and a way to detect regressions before users do.

Starone treats AI as a full path: data, models, orchestration, applications, evaluation and observability. We work across LLM applications, retrieval-augmented generation, agentic workflows, document intelligence, computer vision and predictive analytics, and we choose the simplest technique that meets the requirement. Sometimes that is a gradient-boosted model or a rules engine, not an LLM.

What we engineer

Technical areas

01

LLM application architecture

An LLM application is a distributed system with a non-deterministic dependency. We separate the application layer from an orchestration layer that owns prompts, context assembly, model routing, retries, streaming and fallbacks, so that models can be swapped without rewriting product code. Inference pipelines are built with the same timeouts, queues and backpressure as any other critical path.

  • Model gateway and routing
  • Structured outputs with schema validation
  • Streaming responses
  • Fallback and retry policies
  • Prompt and semantic caching
  • Context window management
  • Batch and online inference pipelines
02

Retrieval, search and knowledge

Retrieval-augmented generation grounds answers in your own content instead of the model's training data. Quality is decided mostly upstream of the model: how documents are parsed, chunked, embedded, indexed and filtered by permission. We combine vector search with keyword search and reranking to build knowledge bases, and use knowledge graphs where questions depend on relationships between entities.

  • Embedding pipelines
  • Hybrid vector and BM25 search
  • Cross-encoder reranking
  • Chunking and metadata strategy
  • Permission-aware retrieval
  • Knowledge graphs
  • Incremental index updates
03

Agents and tool use

Agents let a model plan steps and call tools: functions with typed schemas that query systems or take actions. We design agentic workflows with explicit state, step limits, idempotent tools and human approval for consequential actions. Multi-agent systems are used when tasks separate cleanly into roles with different context or permissions, because every additional agent adds latency, cost and failure paths.

  • Tool calling with typed schemas
  • Durable workflow state
  • Planner and executor patterns
  • Multi-agent coordination
  • Human-in-the-loop approval
  • Step and budget limits
04

Prompt engineering and evaluation

Prompts are code: versioned, reviewed and tested against a dataset before release. We build evaluation sets from real tasks, score them with deterministic checks, model-graded rubrics and human review, and run them in CI so that a prompt, model or retrieval change cannot ship if it lowers quality. Hallucination is reduced by grounding, citation requirements, constrained outputs and allowing the system to decline.

  • Versioned prompt registry
  • Golden datasets and regression suites
  • LLM-as-judge calibrated against human review
  • Groundedness and citation checks
  • Retrieval recall and precision metrics
  • Online A/B evaluation
05

AI security and governance

An LLM cannot reliably tell instructions from data, so any text it reads, including retrieved documents and tool results, can attempt to redirect it. We treat model output as untrusted input, enforce authorisation outside the model and limit what each tool can do. Data leakage is controlled through permission-aware retrieval, PII redaction, tenant isolation and clear rules on what is sent to which provider.

  • Prompt injection defences
  • Least-privilege tool permissions
  • Output validation and filtering
  • PII detection and redaction
  • Tenant-isolated indexes
  • Audit logging of prompts and actions
06

Applied machine learning beyond LLMs

Many problems are better served by task-specific models. Document intelligence combines OCR, layout analysis and extraction models to turn invoices, contracts and forms into validated structured data. Computer vision covers detection, classification and inspection, and predictive analytics covers forecasting, scoring and anomaly detection on tabular and time-series data.

  • OCR and layout-aware extraction
  • Object detection and image classification
  • Forecasting and anomaly detection
  • Feature pipelines
  • Model serving and batch scoring
  • Drift monitoring

Experimentation versus production AI engineering

An experiment answers one question: whether a model can do the task at all. A notebook, a handful of examples and a prompt are enough, and success is judged by eye. That is useful work, but it proves feasibility only on the inputs its author thought of.

Production AI engineering has to establish how often the output is correct across the real distribution of inputs, what happens when the provider times out or changes the model, who may see which data, what a request costs, how long it takes at p95, and how a regression is detected and rolled back.

The gap between the two is mostly ordinary engineering applied to an unusual component. Teams that skip it tend to discover the missing parts one incident at a time.

  • Hand-picked examples become a maintained evaluation dataset with pass thresholds
  • Prompts edited in place become versioned artefacts released through CI
  • A single model call becomes a routed call with timeouts, fallbacks and caching
  • Open access to data becomes permission-aware retrieval with audit logs
  • Reading outputs by eye becomes tracing, quality sampling and cost dashboards

Architecture

Anatomy of a production AI application
  1. User

    • Web app
    • Mobile app
    • Chat interface
    • Internal tools
  2. Application Layer

    Owns identity, permissions and the user experience

    • Session handling
    • Access control
    • Response streaming
    • Feedback capture
  3. AI Orchestration Layer

    Where prompts, tools and policy are versioned and tested

    • Prompt management
    • Tool calling
    • Guardrails
    • Model routing
  4. Models / Agents

    • Hosted LLMs
    • Self-hosted models
    • Task agents
    • Embedding models
  5. Knowledge & Data Layer

    Retrieval respects the caller's permissions

    • Vector index
    • Document store
    • Relational data
    • Semantic cache
  6. Enterprise Systems / APIs

    • ERP and CRM
    • Identity provider
    • Internal APIs
    • Document repositories
  7. Infrastructure & Observability

    Traces, cost and quality measured per request

    • Kubernetes
    • GPU and API capacity
    • Tracing and evaluation
    • Cost monitoring
The layers between a user and a model in a production AI system. Most of the engineering effort sits in orchestration, knowledge, integration and observability, not in the model call itself.

The layered architecture of a production AI system

A production AI system is easier to reason about as layers. A user interacts with the application layer. The application calls an AI orchestration layer, which invokes models and agents. Those draw on a knowledge and data layer and act through enterprise systems and APIs, with infrastructure and observability underneath all of it.

Connecting an application directly to an LLM API collapses these layers into one function call. It works until the system needs something the call cannot provide: grounding in private data, per-user permissions, a cheaper model for simple requests, a record of why an answer was given, or protection against a document that contains instructions. Each of those belongs to a specific layer, and adding them later means restructuring the application.

The same path can be read as a lifecycle: data, models, orchestration, applications, evaluation, observability. Data quality bounds what retrieval can return, evaluation decides what may be released, and observability feeds real failures back into the evaluation set.

  • Application layer: identity, sessions, business rules, UI and streaming
  • AI orchestration layer: prompt assembly, routing, tool execution, guardrails and caching
  • Models and agents: hosted or self-hosted LLMs, embedding models and task-specific models
  • Knowledge and data layer: vector indexes, search, knowledge graphs, source documents and features
  • Enterprise systems and APIs: the systems of record that tools read from and write to
  • Infrastructure and observability: compute, queues, secrets, tracing, evaluation and cost telemetry

Retrieval, context and hallucination

A model answers from whatever is in its context window. Context management is therefore a design problem: which instructions, retrieved passages, conversation history and tool results go in, in what order, and what is summarised or dropped as a conversation grows. More context is not better. Irrelevant passages lower answer quality and raise cost and latency.

Most hallucination in enterprise systems is a retrieval failure: the right passage was never retrieved, so the model filled the gap. We measure retrieval separately from generation, use hybrid search and reranking to improve recall, require citations to retrieved sources, and instruct the system to say when the sources do not contain an answer. For outputs that feed other systems, schema-constrained generation and validation replace free text.

Embeddings capture similarity of meaning, which suits semantic search and questions answered by a single passage. Questions that span entities and relationships, such as which contracts reference a superseded policy, are better served by a knowledge graph or a structured query, and a well-designed system routes between them.

Cost, latency and observability

Inference cost scales with tokens and model size; latency scales with output length and the number of sequential model calls. The main levers are routing simple requests to smaller models, caching stable prompt prefixes and repeated answers, trimming context, batching offline work, and streaming so the user sees the first tokens quickly. An agent that makes ten sequential calls will be slow whatever the model, so parallel tool calls and fewer steps matter more than a faster endpoint.

Model observability extends tracing to the AI path. Each request records the prompt version, retrieved documents, tool calls, model, token counts, latency and outcome, with sensitive content redacted. On top of traces we sample outputs for automated and human quality scoring, track user feedback, and alert on drift in quality, cost per request and refusal rate. Without this, a provider-side model change or a degraded index stays invisible until someone complains.

How we engineer it

Our approach

We start from the task and its acceptable error rate, then build the smallest system that can be measured against it.

  1. 01

    Define the task and the quality bar

    Specify what the system must do, what a wrong answer costs and which decisions stay with a person. This sets the accuracy, latency and cost targets that everything else is measured against.

  2. 02

    Assess and prepare the data

    Audit the source content: formats, freshness, ownership, permissions and gaps. Build ingestion, parsing and embedding pipelines with the access model carried through as metadata.

  3. 03

    Build the evaluation set first

    Assemble representative inputs with expected outcomes before tuning prompts. The dataset becomes the regression suite and grows with every production failure.

  4. 04

    Engineer the orchestration layer

    Implement retrieval, prompt assembly, routing, tool calling and guardrails behind a stable internal API, with timeouts, fallbacks and structured outputs.

  5. 05

    Harden for security and failure

    Threat-model the system for prompt injection, data leakage and tool misuse. Test with adversarial inputs and enforce authorisation outside the model.

  6. 06

    Release, observe and iterate

    Roll out behind flags to a limited audience, trace every request, sample quality and feed failures back into evaluation. Prompt and model changes ship through the same pipeline as code.

Trade-offs

Decisions that shape the design

The questions we work through with your team before committing to an architecture.

Should we use RAG, fine-tuning or both?
Use RAG when the system needs knowledge that changes, must be cited or is subject to access control; updating an index is cheaper and more auditable than retraining. Fine-tune when you need consistent format, tone or task behaviour that prompting cannot achieve, or want a smaller model to match a larger one on a narrow task. They address different problems and are often combined: a tuned model for behaviour, retrieval for facts.
Hosted model APIs or self-hosted open-weight models?
Hosted APIs give access to the strongest general models with no capacity planning, and suit most workloads. Self-host when data cannot leave your environment, when volume is high and steady enough that dedicated GPUs cost less than per-token pricing, or when you need control over model versions. Self-hosting brings GPU operations, serving optimisation and upgrade work, so decide on residency, volume and team capacity.
One capable model for everything, or routing across several?
Start with one model to reduce variables. Introduce routing when traffic shows a clear split between simple and hard requests, or when latency or cost targets are missed. Routing adds an evaluation burden, because every model on every route needs its own quality measurement.
A deterministic workflow or an autonomous agent?
If the steps are known in advance, encode them as a workflow with model calls at specific points; it is cheaper, faster and testable. Use an agent when the path depends on what is discovered along the way, as in investigation or research across several systems. Give it bounded tools, a step budget and approval gates for anything irreversible.
A dedicated vector database or vector search in the existing database?
pgvector in PostgreSQL, or the vector features of OpenSearch, are sufficient for many corpora and keep transactions, filters and permissions in one place. Choose a dedicated engine such as Qdrant or Milvus when the index is very large, query volume is high, or you need advanced filtering and quantisation. Migrating later is manageable if embedding and retrieval sit behind an interface.
When does a single agent become a multi-agent system?
Split when roles need different tools, permissions or context that should not be shared in one prompt, for example a researcher with read access and an executor with write access. Do not split merely to mirror an organisation chart. Coordination between agents multiplies token use and makes failures harder to trace.

Production readiness

What makes it production-ready

How it is secured

Authorisation is enforced in the retrieval and tool layers, never by asking the model to behave. Inputs, retrieved content and outputs are treated as untrusted, tools run with least privilege, and sensitive data is redacted before it reaches a provider or a log.

How it scales

Orchestration services are stateless and scale horizontally, and long-running agent work moves to queues with durable state. Provider rate limits are handled with token-aware throttling, backoff and fallback models, and indexes are sharded or replicated as the corpus grows.

How it is monitored

Every request produces a trace covering retrieval, tool calls, model, tokens, latency and cost, tied to a prompt version. Quality is sampled continuously against rubrics, and alerts fire on drift in accuracy, latency or spend.

How it is deployed

Prompts, model configuration and retrieval settings are versioned and promoted through CI with evaluation gates. Changes release behind feature flags or to a canary cohort, and rollback is a configuration change.

How it integrates

Tools wrap existing APIs with typed schemas, idempotency keys and explicit permission scopes, using open conventions such as the Model Context Protocol where they fit. The AI layer exposes its own versioned API, so web, mobile and back-office systems consume it like any other service.

Technologies

Chosen to fit the workload and your existing estate.

  • Python
  • TypeScript
  • PostgreSQL with pgvector
  • Qdrant
  • OpenSearch
  • Neo4j
  • LangGraph
  • Temporal
  • vLLM
  • PyTorch
  • Redis
  • Kubernetes
  • OpenTelemetry
  • Langfuse

From zero to production

The engineering lifecycle

  1. 01

    Idea

  2. 02

    Discovery

  3. 03

    System architecture

  4. 04

    UX / product design

  5. 05

    Application engineering

  6. 06

    AI / data layer

  7. 07

    Cloud infrastructure

  8. 08

    Security

  9. 09

    QA & performance

  10. 10

    Deployment

  11. 11

    Observability

  12. 12

    Continuous evolution

FAQ

Common questions

Do we need to train our own model?

Rarely. Most enterprise use cases are met by an existing model combined with retrieval, well-tested prompts and evaluation. Training or fine-tuning becomes worthwhile for narrow tasks with plenty of labelled data, strict latency or cost limits, or behaviour that prompting cannot make consistent.

How do you stop the system from making things up?

Hallucination cannot be eliminated, only reduced and detected. We ground answers in retrieved sources, require citations, constrain output formats, let the system decline when evidence is missing, and measure groundedness on an evaluation set so the residual rate is known and not assumed.

Can our data stay within our environment or region?

That depends on the provider terms and deployment option chosen, and we design for the constraint. Options include endpoints with suitable data-handling and residency terms, redaction of sensitive fields before a request leaves, or self-hosted open-weight models inside your own environment.

How do you know when an AI feature is ready to release?

When it meets the thresholds agreed on the evaluation set for quality, latency and cost, has passed adversarial testing, and has tracing and rollback in place. Readiness is a measured gate, not a judgement made from a demo.

What happens when the model provider releases a new version?

The new version is run against the regression suite before any traffic moves. Because model access sits behind a gateway with pinned versions, the switch is a configuration change that can be canaried and reversed.

Have a system that needs to work in production?

Tell us what you are building. An engineer will read it and reply within two working days.