Practical AI starts with the boundary
The first decision is not which model. It is where the LLM sits relative to your system of record. We treat the model as an untrusted advisor: it proposes, your domain logic disposes.
Self-hosted or API?
| Need | Choose | |------|--------| | Strict data residency | Self-hosted (Ollama, llama.cpp) | | Frontier reasoning, low volume | API (OpenAI, Groq) | | Predictable cost at scale | Self-hosted with a gateway |
Always go through a gateway
Every model call should pass through one internal gateway that owns timeouts, retries, a token ceiling, and a cost kill-switch. Calling the SDK directly from twelve places is how you get a surprise invoice.
Human-in-the-loop by default
For anything that writes to the system of record, such as extracted invoice data or a proposed schedule, surface low-confidence outputs for review. The LLM removes the typing, not the accountability.