Red Teaming, Governance & Production Readiness
Attack your system on schedule, run incidents like ops, satisfy the governance layer — and the checklist that says you're actually ready to ship.
Red teaming is adversarial testing done deliberately: enumerate what must never happen (leak PII, execute unauthorized actions, produce harmful content, get injected into exfiltration), then attack each systematically — role-play coercion, encodings and obfuscation, multi-turn manipulation, indirect payloads planted in documents and tool results (your aa-23 exercise, scaled). Automate the corpus: open-source tools like garak and promptfoo's red-team mode run attack libraries against your endpoints, and every successful attack becomes a permanent regression case in your eval suite — the security flywheel mirroring aa-21. Re-run on every model swap and material prompt change; resistance is version-specific.
Governance is the paperwork that keeps you shippable, and in 2026 it has teeth: the EU AI Act's obligations are phasing in (risk-tiered requirements, transparency duties), and NIST's AI Risk Management Framework is the common vocabulary US enterprises expect. The practical minimum: an inventory of where AI runs in your product with an owner per use case, a risk assessment for each (what's the worst realistic output, who's harmed, what's the blast radius), documented data flows (what enters prompts, what providers retain — your aa-23 work), human oversight at the consequential decisions, and an incident-response runbook that treats bad-output events like outages: detect, contain (kill switch per AI feature — build it before you need it), notify, post-mortem into the eval suite.
The production-readiness checklist that summarizes this course: evals in CI with a golden dataset and regression gates (M5); tracing with cost/latency/quality dashboards and drift alerts (M5); guardrails layered on input, output, and actions, failing closed (M6); least-privilege tools with approval gates on the irreversible (M6); PII minimized before the model and scrubbed from logs (M6); a canary/rollback path and a kill switch (M5); red-team results current for the model version in production; and an owner who can answer 'what does this feature do on its worst day?' If you can check every box, you're not hoping the system behaves — you're engineering it to. That's the difference this whole course has been about.