Learning path
How to build with AI models responsibly: the vocabulary and moving parts, JSON and tokens, scripting a test run, the security risks from OWASP, and real lessons from working with an AI agent.
This path is for IT people who want to build with AI models, not just chat with them: wiring a model into a script or a helpdesk tool, grounding it in your own documents, and knowing where it can go wrong.
It starts with how to think about AI at work, covers the moving parts and the data formats model APIs use, practises the scripting you need to test a model against real cases, and finishes with the security work that comes with it.
AI should help you do the work, not do it blindly on your behalf.
Tokens, context, RAG, tools, agents and evals on one sheet. Keep it open.
How to ask, how to check what comes back, and what never to paste in.
Model APIs send and receive JSON, and structured output is only useful once you have validated it.
Pipelines, agent settings and deployment files are usually YAML.
See what a token claims about who is calling, and why decoding is not verifying.
The cheapest test of an answer: does it look like a ticket number, a date or an IP address?
Running a prompt over every case in a test set is a loop like this one.
Keep every test run's output so you can compare it after a change.
Searching logs of requests and answers for errors and refusals.
What leaves your organisation, what counts as untrusted input, and how many privileged identities you now run.
Prompt injection is still injection: the same untrusted-input thinking applies.
Two weeks of working alongside an AI agent: most of the problems were in how it was set up.
AI needs a policy, a risk assessment and a review, like any other system.
