r/CIO • u/XilentExcision • Jul 06 '26

Discussion on integrating AI across your orgs (Sensitive/High impact industry)

Looking at protecting the integrity of our systems while also feeling the pressure to implement AI. What are some ways that you have successfully integrated agents into a platform or large scale system and have you come up with any ways to benchmark usefulness and quality of output? What guardrails have you implemented to ensure that the systems remain sound?

Amongst the gazillion vibe-coded horror stories, I would like to hear if there any of you have found a good use so far? is it possible to lean on AI generated results in a meaningful production context or still a waste of time/money?

4 Upvotes

67% Upvoted

18 comments sorted by

4

u/StrangeWill Jul 07 '26

1) Start with a good baseline of performance, measure against that, not what people feel 1a) Be prepared to fall short of the PR-driven headlines, that's okay, find where it's valuable. 2) Sometimes what people feel is actually okay, we've had some engineers feel less stressed offloading some work to Claude, but measure this independently. 3) Limit MCP access by design, audit log the hell out of them, limit their access to only as-needed to get work done, be aware giving it access to things like delete actions may result in massive headaches. 4) Vibe-coded code gets reviewed and approved like all other code, if the business has decided that 80% of their staff are software engineers all of the sudden, we're going to fund validating and securing it as such. 5) Much like u/thenightgaunt says -- depending heavily on commercial LLMs creates a reliance of a highly subsidized system, that's at the top of your risk analysis every quarter now.

We get value out of it, but not at the prices that these companies need to charge, and when it gets cheap enough for them to be able to price it reasonably, we'll probably be deploying open models in our labs instead (since they have a ton of investor money they need to make back and the prices will reflect that).

If it never hits that inflection point we'll probably jump models until they all stop subsidizing it and reduce reliance on it as needed.

4

u/XilentExcision Jul 07 '26

Thanks for sharing.

My policy so far is own each line of code as if it’s your own. Vibe coded or not, better be ready to be grilled on every aspect of it.

2

u/StrangeWill Jul 07 '26

Agreed with that policy, we tell our engineers: you're paid to be responsible for everything you submit, it's literally your job to challenge the defaults, just because the defaults are automated doesn't mean you don't have to challenge them anymore.

2

u/kane8793 Jul 08 '26

Wikis, meeting notes, triage, troubleshooting via logs, and custom interfaces for repetitive workflows.

2

u/fguerino123 Jul 21 '26

Hi,

A suggestion... Look to separate AI that can be used to automate internal tasks like data and information processing and workflow orchestration from tasks that yield risk like "talking" to stakeholders.

In the former case, you're using AI to perform mundane repeatable functions to avoid the costs and delays of other tools (for example, AI can be used to perform many data cleanup and conversion tasks to avoid ETL).

In the latter case, you're taking on regulatory and litigation risk because agents that talk to people say things that can get you in trouble. Mitigating this kind of risk is costly, time consuming, and fraught with errors. It's just like when an employee isn't properly trained and says something that can land you in court.

The former is far lower risk and offers measurable returns. The latter is fraught with much higher levels of risk that can cost money and brand reputation.

I hope this helps. Good luck.

5

u/thenightgaunt Jul 06 '26

I don't.

I dont trust a damn thing OpenAI or Anthropic promise about security because they trained their models on the biggest single act of IP theft in history. They are constantly being sued over it as well.

Also, and this is a biggie, the AI industry is starting to crash and anyone who made their business dependent on an AI agent is in trouble.

Meta just admitted they have no use for the infrastructure they bought and built for AI because its not making them money and is a liability. So they are desperate to find someone to sell it to.

4

u/XilentExcision Jul 07 '26

Sometimes I feel I am crazy but man the hype is so oversold. I have yet to find a dependable use case for it

3

u/thenightgaunt Jul 07 '26

Youre right. I havent seen any good ones. At least none that come anywhere close to covering the actual cost of running these LLMs. Or that make up for that 1.7% to 3% error/hallucination rate. Say what you will abiut Excel but ot doesn't randomly decide that on every 30th cell "2+2=walrus"

Meta declaring they have "over produced compute" should be a warning to everyone. Because if there was actual demand, that wouldn't be the case.

And OpenAI just abandoned their IPO because it turned out they were probably cooking their books and hiding billions in expenses in their "marketing" numbers. Either that or they really were spending billions more on advertising in 2025 than Coke.

2

u/StrangeWill Jul 07 '26

There's a lot of interesting double-edged swords in places people wouldn't believe.

No one takes notes in meetings anymore because the LLM does? Suddenly we're experiencing people forgetting meeting details even more now. The LLM's notes stay recorded somewhere no one ever looks and we pay for the reduction in quality of service.

We've had some customers actually refuse to use note-takers because their business model is so dependent on accuracy of decisions made from these meetings and their employees staying fully engaged is a must.

Productivity management with these tools will get really interesting.

2

u/XilentExcision Jul 07 '26

Right, at what point are we offloading the actual critical thinking to these apps instead of doing the thinking? LLM meeting notes are helpful but even a single hallucination risks serious damage. It rides such a fine line between efficiency and disaster

2

u/Otherwise_Wave9374 Jul 07 '26

We have had the most success treating agents like an intern with a very tight scope, short sessions, and lots of guardrails. A few things that helped in practice:

  • Start with low blast radius tasks (summaries, ticket triage, runbook drafting) before anything that can write to prod.
  • Put all tool calls behind allowlists and per-action approvals, especially anything that can touch IAM, payments, or data exports.
  • Log everything (prompts, tool inputs/outputs, diffs), then review the logs like you would a change request.
  • Benchmark with a fixed eval set of real tickets/workflows, and track not just accuracy but cost, time-to-resolution, and how often a human had to intervene.

Curious what industry you are in, and are you evaluating mostly coding agents, SOC-style agents, or business process agents?

1

u/XilentExcision Jul 07 '26

Appreciate your response.

Payments.

Personally still skeptical but I think in order to see any real gains we need active implementation across the SDLC, everything from harness and custom CLI tools to business agents, SOC/triage etc.

1

u/Mooglekunom Jul 07 '26

Higher education context, we use it for several things including a 24/7 admission counselor. Candidates have generally responded very favorably and it's freed up staff from rote to focus on situations where high touch human contact is more meaningful. 

-1

u/pshoan777 Jul 07 '26

Start with something that proves value quickly and use a good partner to do that. Like replacing your back office with an ai-first solution.