FOR CTOs AND ENGINEERING TEAMS
The first agent in production is a sprint. What follows (evals on every change, guardrails, data isolation, one more channel, yesterday's edge case) is a dedicated team for as long as it runs. Here is the whole architecture, with no marketing layer on top.
ACME Cloud
Nera · assistant · online
Running in production for
None of this is a special mode for technical clients: it's the bar every assistant in production is held to. The only thing this page changes is the level of detail.
WhatsApp, in-app chat, mobile SDK, email, and the helpdesk the team already runs (Intercom, Zendesk, Pylon), where the agent joins as one more agent rather than replacing the system.
This isn't a guardrail, it's the default architecture. The model never receives another user's data, because the logic that assembles context is deterministic and doesn't depend on the model behaving.
Every integration runs through a middleware layer on the client's side. Whatever they choose not to share, StudioChat never sees: control stays with the client by design, not by promise.
Hallucinations, prompt injection and irreversible actions are validated before a reply goes out, automatically or with human review. The same guardrail that runs in production can be hosted for the security team to test instead of reading about it in a PDF.
Every instruction change is run against synthetic conversations before it ships: a judge flags what drifts from policy, and a person reviews a sample. Without this layer, changing a prompt is a deploy with no tests.
Reasoning and citations per reply, a full history of data queried and actions taken, assistant versioning with author and date. Encryption in transit and at rest, 2FA for every user, and client-configurable retention.
LLM security, agent security, client control, and infrastructure aren't the same layer: each protects something different, and the agent leaves a trail of everything it does along the way.
A language model can make the wrong call: delete something it shouldn't, invent data that doesn't exist (like a bank account number), or let spend spiral out of control. Guardrails validate what the agent is about to answer before it answers, automatically or manually, covering hallucinations and prompt injection.
Every integration goes through a middleware layer the client configures, and StudioChat can't see the data the client chooses not to share. Control stays on the client's side, by design.
The most common fear is that the agent does something and no one finds out. That's why every answer comes with its reasoning and its citations. No black box acting without leaving a trace.
The honest question isn't whether the team can build it: it almost always can. It's which part of the roadmap pays for maintaining it, every month, indefinitely.
3 to 6 months to the first agent in production.
Plus another 3 to 6 months learning what you learn from watching many clients at once.
Almost no team writes its own columnar database in order to query its logs, and yet nobody doubts they could. What gets bought isn't the capability: it's not having to carry it.
An AI-resolved ticket costs between $0.50 and $2.37, against $2.70 to $5.60 resolved by a person.
Lorikeet cost-per-ticket benchmarks, 2026.
“Joaquina resolves 70% of conversations on her own, but what we value most is the follow-up they give us as clients and the personalized attention: they adapt to whatever the team needs.”
It's assumed it will, and the system is designed around that. Guardrails validate the reply before it goes out (hallucinations, prompt injection, irreversible actions), automatically or with human review, and anything outside the defined limits is handed to a person instead of improvised. The same guardrail that runs in production can be hosted for the security team to test.
With evals: synthetic conversations run against the assistant before the change ships, an LLM-as-judge that flags drift from policy, and human sampling over real conversations. Without that layer, changing a prompt is deploying without tests.
By architecture, not by instruction. The logic deciding what information enters each conversation lives in code and is deterministic: the model never receives data that doesn't belong to that conversation, so it can't leak it no matter how creatively it's asked.
Whatever the company decides. Every integration runs through a middleware layer the client configures: what they choose not to share never arrives, and that decision stays on their side by design.
Every reply keeps its reasoning and citations, every conversation keeps the data queried and the actions taken, and every change to an assistant is versioned with author and date. The infrastructure adds encryption in transit and at rest, 2FA for every user, and client-configurable retention.
That call belongs to each team. The math usually reads like this: 3 to 6 months to the first agent in production, and about as long again to learn what comes from seeing many clients at once. An AI-resolved ticket costs $0.50 to $2.37 against $2.70 to $5.60 resolved by a person (Lorikeet, 2026), and that gap only starts counting once the system holds itself up: evals on every change, guardrails, data isolation, each new channel. Keeping that up is the product.