Playbooks
Senior-engineer-grade how-to for production AI
Last verified: June 2026· playbook index
The CTO's first 90 days with an AI mandate
If you just got an 'add AI' mandate, the move is to sequence it: cut LLM cost and add evals in the first 30 days, standardize the AI-coding workflow in days 30–60, and ship the first agent-bearing feature in days 60–90. The wins fund the rest.
For: CTO
How to build a production MCP server
A production MCP server is auth, scoping, and audit logs — wrapped around a typed tool surface. The patterns are well-known; the 3-week timeline assumes you know which system to expose and a named internal owner.
For: Head of Platform
LLM cost optimization playbook: 7 levers, 30–60% savings
Most production AI is paying 3–10x what it should. The wins are in routing, caching, batching, prompt-cache prefixes, and RAG retrieval quality — not in switching models. A 4–6 week engagement consistently finds 30–60%.
For: VP Engineering
The AI coding golden path: a 6–10 week rollout
Your engineers are already using Claude Code, Cursor, and Copilot — in a free-for-all. Adoption is real, gains aren't compounding. The fix is a golden path: shared rules, MCP access to the top 3 internal systems, and review hooks that keep quality high. A 6–10 week engagement.
For: Head of DevEx
Prompt injection prevention: a production playbook
Prompt injection is the AI-era version of SQL injection: an attacker controls part of the model's input and uses that control to act outside the intended trust boundary. The fix is not "better prompts" — it's a layered control set: input validation, tool authorization, audit logs, and a human approval gate on high-impact actions.
For: CISO / Security Leaders
AI code supply chain risk: a compliance playbook
AI code introduces supply-chain risks that traditional AppSec tooling misses — hallucinated packages, training-data-derived snippets, license violations, and the regulatory map that didn't exist in 2024. For healthcare and finance, the playbook is to map each risk to a control, ship the scanner, and document the residual risk for the regulator.
For: CISO / Security Leaders
Productionize an AI-generated codebase (Lovable, Bolt, v0, Replit)
A weekend prototype built with Lovable, Bolt, v0, or Replit Agent often gets you 60–90% of the UI and happy-path functionality, but only 10–40% of what an enterprise customer evaluates. The gap is not 'rewrite from scratch' — it's a focused 3–8 week hardening pass on a 12-axis production-readiness rubric.
For: CTO / VP Engineering
Supabase production hardening
A Lovable or Bolt prototype on Supabase is fast to build and terrifying to ship. RLS is off on half the tables, secrets are in client code, backups are untested, and the audit log doesn't exist. This is the 4-week hardening pass that closes the gap — without rewriting the prototype.
For: Head of Platform