A team is two weeks from launching a customer-facing agent that handles billing inquiries, plan changes, and account updates. They've built a rough version and tested it informally. Their VP says: "You've listed six things you want to do before launch — a test suite, an eval rubric, approval gates on high-stakes actions, prompt-injection guardrails, cost tracking, and confidence-based fallback to humans. We don't have time to do all six. Pick the two we absolutely have to do."
What's the most defensible pick?
Why did you pick that answer? Two or three sentences. The act of articulating it is what builds the judgment — not the click that follows.
**Pre-launch priority should be set by risk asymmetry, not by what's easiest or most-discussed.** The cost of approval gates and confidence-based fallback being absent is a customer-facing incident — wrong action taken, wrong information confidently delivered, brand damage that takes years to repair. The cost of test suites and eval rubrics being absent is slower iteration, which is recoverable. Cost tracking is recoverable. Prompt injection is real but typically less catastrophic for a billing/account agent than for an action-taking one (the gates pick up the worst of it). When forced to pick, pick the safety layers; the quality layers can be added in week 3.
Test suites and eval rubrics are valuable, but they tell you whether the system is working — they don't prevent the system from doing damage when it isn't. A measured-and-broken system is still broken. Safety layers prevent the damage; measurement layers detect it after the fact.
Prompt injection is a real risk, but for a billing-and-account agent the more concrete failure modes are unauthorized actions and confident wrong answers — which approval gates and confidence-based fallback address directly. Cost tracking is operational, not safety-critical. "Most-discussed" isn't the same as "highest-risk for this product."
Picking based on convenience is exactly how teams ship the things that don't prevent the worst outcomes. The forcing question — "we can only do two" — should make you confront the risk-asymmetry question directly: which two prevent the most catastrophic outcomes?