Playbooks
Senior-engineer-grade how-to for production AI
Last verified: June 2026· playbook index
The CTO's first 90 days with an AI mandate
If you just got an 'add AI' mandate, the move is to sequence it: cut LLM cost and add evals in the first 30 days, standardize the AI-coding workflow in days 30–60, and ship the first agent-bearing feature in days 60–90. The wins fund the rest.
For: CTO
How to build a production MCP server
A production MCP server is auth, scoping, and audit logs — wrapped around a typed tool surface. The patterns are well-known; the 3-week timeline assumes you know which system to expose and a named internal owner.
For: Head of Platform
LLM cost optimization playbook: 7 levers, in order
Production LLM spend usually grows faster than anyone can see inside it. The wins are in routing, caching, batching, prompt-cache prefixes, and RAG retrieval quality — not in switching models. Size each lever against your own baseline before you promise a number.
For: VP Engineering
The AI coding golden path: a 6–10 week rollout
Your engineers are already using Claude Code, Cursor, and Copilot — in a free-for-all. Adoption is real, gains aren't compounding. The fix is a golden path: shared rules, MCP access to the top 3 internal systems, and review hooks that keep quality high. A 6–10 week engagement.
For: Head of DevEx
Prompt injection prevention: a production playbook
Prompt injection is the AI-era version of SQL injection: an attacker controls part of the model's input and uses that control to act outside the intended trust boundary. The fix is not "better prompts" — it's a layered control set: input validation, tool authorization, audit logs, and a human approval gate on high-impact actions.
For: CISO / Security Leaders
AI code supply chain risk: a compliance playbook
AI code introduces supply-chain risks that traditional AppSec tooling misses — hallucinated packages, training-data-derived snippets, license violations, and the regulatory map that didn't exist in 2024. For healthcare and finance, the playbook is to map each risk to a control, ship the scanner, and document the residual risk for the regulator.
For: CISO / Security Leaders
Productionize an AI-generated codebase (Lovable, Bolt, v0, Replit)
A weekend prototype built with Lovable, Bolt, v0, or Replit Agent often gets you 60–90% of the UI and happy-path functionality, but only 10–40% of what an enterprise customer evaluates. The gap is not 'rewrite from scratch' — it's a focused 3–8 week hardening pass on a 12-axis production-readiness rubric.
For: CTO / VP Engineering
Supabase production hardening
A Lovable or Bolt prototype on Supabase is fast to build and terrifying to ship. RLS is off on half the tables, secrets are in client code, backups are untested, and the audit log doesn't exist. This is the 4-week hardening pass that closes the gap — without rewriting the prototype.
For: Head of Platform
Playbook, guide, or engagement — which you want
The three formats on this site answer different questions and it is worth knowing which one you are in. A guide explains a problem well enough for you to make a decision about it: the mechanism, the trade-offs, where the approach stops working. A playbook assumes the decision is made and gives you the sequence — what happens in which week, what gets produced, what has to be true before the next phase starts. An engagement is us running the playbook with you.
These are written at the level of detail we would hand a senior engineer joining the work, which means they are genuinely runnable without us. That is deliberate and the commercial logic is straightforward: a team that can run the MCP server playbook themselves was never going to be a good client for that particular piece of work, and a team that reads it and decides they would rather not spend six weeks on it now knows exactly what they are buying. Both outcomes are better than a brochure.
What a playbook cannot do is make the judgement calls. The sequencing here is right in general and the interesting decisions are local — which module to start with, whether your test suite is trustworthy enough to refactor behind, whether the security review will accept this design. Those are the parts where an engagement earns its money, and each playbook is explicit about which of its steps are mechanical and which need someone with scar tissue.
Every one carries the date it was last reviewed, and the review is substantive rather than cosmetic. Where our own practice has changed — because a technique stopped working, or a better one arrived — the playbook changes with it, and where nothing has moved we leave the date alone rather than refresh it to look current.