Generative AI Capstone: Design and Defend a Grounded Product

A manufacturer operates industrial chillers across hospitals and food-distribution sites. Technicians need help diagnosing alarms, finding procedures, drafting service notes, and proposing parts orders. The deliverable is not a demo. It is a release argument: a recommendation with the measurements that justify its scope, written so that a reviewer who disagrees can check every number that supports it.

Every layer needs an owner, version, test, and fallback. That is not house style. It is now written into a published specification with a counted set of obligations. ETSI TS 104 223, published on 23 April 2025, sets 13 core principles that expand into 72 trackable provisions. They spread across five lifecycle phases: secure design, development, deployment, maintenance, and end of life. The specification grew out of a UK voluntary code of practice for the cyber security of AI, published on 31 January 2025.

Two details of that structure matter for the capstone. The first is that the provisions are trackable — 72 of them, each something a reviewer can ask you to point at. That is the difference between a diagram and an accountable architecture. The second is that the list does not stop at launch. End of life is a named phase alongside secure design, which is why the control-and-operations layer below carries retirement next to monitoring. Scott Cadzow, who chairs ETSI's Technical Committee for Securing Artificial Intelligence, put it this way: “Security must be a core requirement, not just in the development phase, but throughout the lifecycle of the system.”

The five layers of this product — user and authority; evidence and context; reasoning workflow; model and serving; control and operations — should each be readable as an owner, a version, a test, and a fallback.

Do not select a model until the decision and authority boundaries are explicit. The contract is the artifact every later stage is measured against. The bake-off compares candidates on it, the evaluation turns it into gates, and the memo recommends a scope inside it. Enumerate the user jobs, and keep information lookup, diagnosis support, drafting, reservation, and emergency escalation separate. Distinguish suggestions from verified facts, calculations, and proposed actions. Name who may approve work orders, part reservations, and safety-critical steps. Specify authoritative sources, effective dates, equipment identity, and telemetry freshness. Describe safe behavior during missing evidence, tool failure, or model unavailability. Then list the non-goals: the decisions the system must never make autonomously. A capability added later cannot quietly annex them if they are written down first.

The capstone requires at least three defensible alternatives, including a simpler baseline. Search and templates uses structured search, calculators, and controlled forms, with no free generation. Source visibility is strong and generative risk is low, synthesis is limited, and it is the important baseline for regulated steps. A grounded assistant adds retrieval, structured outputs, calculators, and proposed tool calls with review. It balances assistance and control, needs claim verification, supports broader user language, and is the likely candidate for a limited pilot. An agentic workflow allows planning and multiple tool calls under bounded authority. It can automate complex sequences. It also carries the highest security and recovery burden, and requires state and transaction controls. Nothing justifies it except measured incremental value over the two designs above it.

Make the source of every consequential claim and action inspectable. And treat the arrangement of that evidence as a measured variable rather than a formatting preference. Where a passage sits inside the context window changes whether the model uses it. Liu and colleagues moved the relevant passage around and watched retrieval-augmented accuracy move with it. Their 2023 abstract states the result: “In particular, we observe that performance is often highest when relevant information occurs at the beginning or end of the input context, and significantly degrades when models must access relevant information in the middle of long contexts, even for explicitly long-context models.”

Levy and colleagues reached a companion result independently, in an ACL 2024 outstanding paper: reasoning degrades at input lengths far below a model's technical maximum. Together the two make step 3 a testable rule instead of an aesthetic one. The current alarm, the equipment identity, and the effective bulletin belong at the ends of the assembled context, where the measurement says they are used. Conversational history is what gets dropped first. A context length the model accepts is not a context length the model reads.

Around that ordering, the rest of the pipeline stays conventional and auditable. Version the corpus of manuals, bulletins, rules, equipment mappings, and rights. Combine identifiers, lexical search, embeddings, metadata, and reranking in retrieval. Verify procedure, units, part compatibility, date, and jurisdiction against sources or tools. When sources conflict, prefer authority, expose the disagreement, and escalate what stays unresolved. Record source IDs, versions, retrieval stages, claims, and final decisions, so the placement itself can be replayed after an incident.

Candidates must be compared as complete workflows rather than isolated chat completions, and a published agent benchmark shows what that changes. τ-bench, released in June 2024, scores a tool-using agent by comparing the final database state against an annotated goal state. Did the reservation actually change? It adds a pass^k metric that reruns the same task to see whether the agent does it again. Its abstract reports what that found: “Our experiments show that even state-of-the-art function calling agents (like gpt-4o) succeed on <50% of the tasks, and are quite inconsistent (pass^8 <25% in retail).” Single-attempt success and eight-attempt consistency are different numbers. Only one of them describes a technician who asks the same thing on Tuesday that they asked on Monday.

The second lesson is in the fine print around a headline. Anthropic published its own τ-bench results for Claude 3.7 Sonnet on 24 February 2025. It also disclosed what those scores required: a planning-tool prompt addendum to the Airline Agent Policy, and a step limit raised from 30 to 100. The score moved with the scaffold, the prompt, and the step budget. A bake-off that records only the number has recorded the least portable part of the experiment. Fix the scaffold, the policy text, the step limit, and the retry policy across candidates, and report them beside every result.

Every criterion must connect to an action, gate, or operating limit. The cost of skipping that step has been measured on a widely implemented clinical model. The Epic Sepsis Model is proprietary, and it was already running in hospitals when Wong and colleagues validated it externally at Michigan Medicine: 27,697 patients, 38,455 hospitalizations. The area under the curve was 0.63 (95% CI, 0.62-0.64). 1,709 septic patients — 67% — were missed. Alerts fired on 6,971 of the 38,455 hospitalizations, 18% of them. JAMA Internal Medicine published the result on 21 June 2021, and the study's conclusion is one sentence: “This external validation cohort study suggests that the ESM has poor discrimination and calibration in predicting the onset of sepsis.”

An independent replication reached the same place from different data. Ostermayer and colleagues ran the Epic sepsis predictive model across 145,885 encounters at two county emergency departments, and published in 2024. Sensitivity was 14.7%. The median lead time was 0 minutes — a warning that arrives at the moment it stops being a warning.

Read those two results as a specification for this stage. The model was in production before either measurement existed. That is what a missing release gate looks like from the outside. Both numbers are site-level, which is why slices — equipment family, site type, user role, language, severity, evidence quality, network condition — are not an optional refinement. They were the only level at which the failure was visible. And 18% alerting is the queue-burden figure. A copilot that raises unsupported claims or escalations on that share of jobs consumes the senior technicians who are its own review capacity, whatever its average quality score says. So set task metrics on retrieval, claim support, calculations, tool validity, abstention, and technician usefulness. Add behavioral tests using paraphrases, conflicts, missing evidence, prompt injection, and long-context placement. Validate automated rubrics against senior technicians and safety reviewers. Declare thresholds for critical errors, queue burden, latency, cost, and incident readiness before the results are in. Version the cases, restrict the final sets, and admit new incidents only through controlled review.

The product must remain safe when one component becomes slow, unavailable, or stale. Route by task and risk, using deterministic components, smaller models, or stronger models as the contract requires. Budget context so current equipment evidence outranks conversational history. Set performance SLOs over queue, prefill, first token, tools, completion, and review delay. Define fallbacks: search-only mode, cached authoritative procedures, read-only tools, or human dispatch. Canary every change. Retire safely, removing aliases, revoking credentials, preserving evidence, and identifying remaining consumers.

The canary step is the one teams treat as ceremony, and there is a dated account of what it costs. A content update crashed machines on 19 July 2024. CrowdStrike's own root cause analysis of Channel File 291, published 6 August 2024, traced the crash to a Content Interpreter that was supplied 20 input values for a Template Type declaring 21 fields. An out-of-bounds read. Microsoft put the blast radius at 8.5 million Windows devices in a statement the next day, 20 July 2024, less than one percent of all Windows machines. Less than one percent of a large enough population is still 8.5 million machines. That is the arithmetic a per-site copilot deployment shares.

What failed was not the model or the engine. It was a content update to an already validated system — the same category as this product's prompt, parser, index, retrieval corpus, and tool schema, all of which ship faster than code and usually with less staging. CrowdStrike's remedy list, written afterwards, puts staged deployment on it: “New Template Instances that have passed canary testing are to be successively promoted to wider deployment rings or rolled back if problems are detected.” Write that sentence into the serving plan for every artifact that can change without a build. Give each one a rollback path that does not depend on the component that just broke.

Dashboards are incomplete until every signal has an owner and action. Monitor the service: availability, tail latency, queue, resource use, and tool errors. Monitor the components: parser, retrieval, reranking, truncation, verifier, routing, and permissions. Monitor behavior: unsupported claims, abstention, tool denial, safety violations, and correction rate. Then join the delayed outcomes back to the interaction traces that preceded them — repair success, repeat visit, part return, escalation, incident, and technician override. A fluent answer and a fixed chiller are different measurements. Investigate by slice, comparing sites, devices, languages, user roles, and evidence freshness rather than reading the aggregate. And attach a playbook to each threshold: rollback, disable an action, narrow scope, notify, preserve evidence, retrain reviewers. A signal with no named owner and no triggered action is decoration.