Start with a bounded job
Choose a task with an observable input and outcome: classify a request, retrieve an approved policy, prepare a draft or call a controlled tool. Broad instructions such as 'answer anything about the company' make evaluation impossible and push hidden policy decisions into a model prompt.
Control knowledge and action separately
Retrieval should show which source supported an answer and what happens when evidence is missing. Tool access requires its own authorization, validation and idempotency. A fluent model response must never be treated as proof that an external action succeeded.
Evaluate representative failure
Build a set of normal, ambiguous, adversarial and incomplete conversations. Measure task completion, unsupported claims, safe refusal, handoff quality, latency and cost. Re-run evaluation when models, prompts, sources or tools change.
Operate with a human path
Users need a clear route to a person when confidence or authorization is insufficient. Preserve relevant context during handoff without exposing unnecessary data. Logs, monitoring and a kill switch are operational requirements, not polish added after launch.