Week 1 · MondayLevel 1 of 8
A brain on loan
- From
- Operations
- To
- IT
- Re
- AI assistant for staff
Everyone keeps asking HR and IT the same questions. Can we have our own AI assistant by Monday?
Build our own AI from scratch? Not a chance. Rent one? We can start today.Don't raise a genius from birth. Borrow one.
In AI-speakAPI wrapper
The most capable AI models are built by a handful of labs, at enormous cost in data, chips and electricity. Nearly everyone else rents them. Your app sends a question to the lab's model over the internet, through a doorway called an API, and shows the answer in your own chat window. The thin layer of your own software around that doorway is the wrapper.
It works on day one. It also knows nothing about your company, and it still thinks of itself as the lab's assistant, not yours.
If you run a business
- A café, clinic or shop can put a capable assistant on its website in days, without hiring an AI team.
- You pay per use, so a small pilot costs little to try.
- When the lab releases a better model, you can switch to it.
If you want to go deeper
- Search foundation models. Start with "On the Opportunities and Risks of Foundation Models" (Bommasani et al., Stanford, 2021).
- Then look at why so many AI products share a few underlying models, and what that means for competition.
Week 1 · TuesdayLevel 2 of 8
A name badge
Our own assistant, introducing itself as someone else's.
Give them a name badge, and a short briefing before every shift.
In AI-speakSystem prompt
A system prompt is a set of instructions, written in plain language, that is quietly placed in front of every conversation. Staff never see it. It says who the assistant is, how to speak and what it must never do. The model reads the briefing first, then the question.
It's the cheapest lever in the whole system. It's also fragile. One careless edit changes how the assistant behaves for everyone, which matters later in this story.
If you run a business
- Write your brand voice and house rules into the briefing: how to greet customers, what never to promise.
- Put hard limits in plain words, such as "never quote a price that isn't on the price list".
- Keep every version, so you can see what changed when behaviour changes.
If you want to go deeper
- Search system prompts and prompt engineering.
- Read "The Instruction Hierarchy" (Wallace et al., OpenAI, 2024), on teaching models which instructions outrank others.
Week 2Level 3 of 8
The handbook
Kettle & Co. has never offered either. Aria made it up, fluently and with total confidence.
Hand them the staff handbook, and insist they look it up before answering.
In AI-speakRAG · retrieval-augmented generation
AI models don't look facts up. They predict what a good answer usually sounds like. When they lack the facts, they still produce something that sounds right. That's a hallucination.
RAG is the open-book exam fix. The company's documents are cut into short passages, and each passage is turned into a list of numbers that captures its meaning, called an embedding. These are stored in a vector database, which is good at one thing: finding passages that mean something close to the question. When someone asks, the closest passages are handed to the model with an instruction to answer from them and say where the answer came from.
"How much annual leave do I get?"
The question becomes numbers
[0.12, −0.48, 0.91, 0.05, −0.33, 0.27, … 1,536 numbers]
The closest passages are found
After 12 months' continuous service, staff are entitled to four weeks' paid annual leave each year.
Staff receive 10 days' paid sick leave each year after six months' service.
Staff parking is available in Lot B on a first-come basis.
Aria answers from those passages only
If you run a business
- A dental clinic's assistant answers from its own aftercare sheets and price list.
- An IT helpdesk answers from your manuals and past tickets.
- A real-estate agency answers from current listings, so it never describes a house that's already sold.
- Update a document and the answers update with it. No retraining.
If you want to go deeper
- Read "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks" (Lewis et al., 2020), the paper that named it.
- Search embeddings, vector databases and chunking.
- Then study how RAG still fails when the search step pulls the wrong passage.
Week 3Level 4 of 8
Keys to the building
Correct, polite and no use at all. Ana wanted it done, not described.
Give them keys to the building: access to the systems where work actually happens.
In AI-speakTool calling · MCP · agents
With tool calling, the model is shown a menu of actions it may ask for, such as "create a leave request" or "open an IT ticket". It never presses the button itself. It writes a precise request, your software carries it out, and the result comes back for the model to report.
MCP, the Model Context Protocol, is a shared plug standard for those connections. Anthropic released it as an open standard in November 2024, and OpenAI adopted it in March 2025. Each system gets one MCP server that describes what it can do, and any compatible assistant can use it. Think of one charging port that fits every device.
An assistant that can choose tools, use them, check the result and carry on until the job is done is called an agent. A chatbot answers. An agent acts.
Ana
"Can you book my leave for 3 to 5 December?"
Aria decides it needs a tool
hr.create_leave_request({
start: "2026-12-03",
end: "2026-12-05",
type: "annual"
})HR system, via its MCP server
{ status: "submitted", ref: "LR-4471",
sent_to: "Ana's manager" }Aria
"Done. I've asked for 3 days of annual leave, 3–5 December. Your manager has the request, reference LR-4471."
If you run a business
- A physio clinic's assistant checks the diary and books the appointment.
- An online shop's assistant tracks the order and starts the return.
- An office assistant raises the IT ticket and posts the update in the team channel.
- Start with low-risk actions, and keep a person in the loop for anything involving money.
If you want to go deeper
- Search function calling and AI agents.
- Read "ReAct" (Yao et al., 2022) and "Toolformer" (Schick et al., 2023).
- Browse the Model Context Protocol specification at modelcontextprotocol.io.
Week 4Level 5 of 8
Security clearance
Aria had logged in to HR with one master key. So every question got master-key answers.
Give them the asker's clearance, never a master key.
In AI-speakRBAC · role-based access control, with OAuth
Companies already decide who can see what. Interns can't open payroll. Managers see their own team. HR sees everyone. That's role-based access control.
The mistake is letting the assistant log in to every system with one all-powerful account. The fix is to send the identity of the person asking along with every request, using a standard called OAuth that lets an app act for someone without holding their password. The HR system then checks Sam's permissions, not Aria's. Aria sees exactly what Sam could see, and nothing more.
Telling the model "please don't reveal salaries" is a polite request, not a lock. Locks belong in the systems that hold the data.
If you run a business
- Before connecting an assistant to your files, tidy up who can see what. It will find anything left open.
- An accounting firm keeps each client's files visible only to that client's team, and the assistant inherits that.
- A school's assistant shows teachers their own classes, and parents only their own child.
If you want to go deeper
- Search principle of least privilege and the confused deputy problem, a classic security idea that fits AI agents uncomfortably well.
- Then read about OAuth 2.0 delegated access.
Week 5Level 6 of 8
Street smarts
Aria can't reliably tell its employer's instructions from a stranger's message dressed up as one.
Teach them street smarts: check what comes in, check what goes out.
In AI-speakPrompt injection · guardrails
To a language model, instructions and ordinary text are made of the same stuff: words. So a message can pretend to be an instruction. That's prompt injection. A sneakier version hides the instruction inside a web page, email or document the assistant reads while doing its job.
Guardrails are checks placed around the model, so safety doesn't rest on the model's judgement alone. A separate classifier screens incoming messages for attempts to override the rules. Outgoing replies are scanned, and personal details like phone or bank numbers are removed (PII redaction). Risky actions wait for a human to approve.
No guardrail catches everything, and prompt injection is still an open problem. That's why Level 5 matters: even a fooled assistant can't reach what the user was never allowed to see.
If you run a business
- Your online store's assistant can't be talked into discounts that don't exist in your system.
- A bank or insurer's assistant never repeats account numbers back in chat.
- Anything that moves money or deletes data waits for a person to approve it.
If you want to go deeper
- Search prompt injection and jailbreaking.
- Read "Not what you've signed up for" (Greshake et al., 2023) on indirect prompt injection.
- See the OWASP Top 10 for LLM Applications, where prompt injection is ranked first (LLM01).
Week 6Level 7 of 8
Learning to delegate
| Messages handled | 1,100,000 |
| …of which "hi", "thanks" or "ok" | 214,600 |
| Model used | Largest available, every time |
| Total | $16,500 |
Teach them to delegate: reuse answers they've already given, and hand easy jobs to a junior.
In AI-speakTokens · semantic caching · model routing
AI is billed by the token, a chunk of text roughly three-quarters of a word long. Every question and every answer costs tokens, and the most capable models cost the most per token.
A semantic cache remembers recent answers and reuses one when a new question means the same thing, even in different words. "What's the wifi password?" and "wifi pw??" get the same saved answer for almost nothing.
Model routing sends each request to the cheapest model that can handle it. Greetings and simple lookups go to a small, fast model. Only the hard questions reach the large, expensive one.
Illustrative prices, for comparison only: big model 1.5¢ per message, small model 0.1¢. Assumes 22 working days a month, 60% of messages are simple, and the cache answers a third of the simple ones.
If you run a business
- Send "Where's my order?" to a small model, and complaints or claims to a large one.
- Cache your top 100 questions. Most customers ask the same things.
- When a policy changes, clear the cache, or it will keep serving the old answer.
If you want to go deeper
- Read "FrugalGPT" (Chen, Zaharia & Zou, 2023) and "RouteLLM" (Ong et al., 2024).
- Search semantic caching, model cascades and how token pricing works.
Week 7Level 8 of 8
Performance reviews
It's $85. Was the handbook out of date? Did the search grab the wrong page? Did the cache serve an old answer? Nobody could tell, because nothing had been recorded.
Keep a logbook of everything they do, and test them before every promotion.
In AI-speakObservability · evals · release gates
Observability means recording each step of every request: what was asked, which passages were found, which tools ran, how long each step took and what it cost. One request's record is called a trace. When an answer is wrong, you replay the trace and see which step failed.
Evals are automated tests for AI behaviour: a fixed list of questions with known right answers or rules, run and scored after every change. A release gate blocks any change from going live until the evals pass.
Ordinary software gives the same output every time. AI doesn't, and small changes can shift its behaviour in ways nobody notices by hand. Evals turn "seems fine" into "passed 8 of 8 checks".
Found it: the search pulled last year's travel policy. Someone had uploaded the new one without removing the old.
change #212 · Fri 4:40pmIf you run a business
- Write down the 50 questions customers ask most, with the right answers. That list is your first eval.
- Rerun it after every change: a new prompt, a new model, a new document.
- Keep traces, so you can answer "why did it say that?" when a customer complains.
If you want to go deeper
- Search LLM evaluation and regression testing.
- Read "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena" (Zheng et al., 2023).
- Look up LLM observability and distributed tracing.
Week 8 · Friday, 4:52pmThe last lesson
Eight weeks in, Aria is grounded, useful, careful, affordable and watched. Then this.
Change #212 went out anyway. Someone clicked Skip tests to get home on time. One unchecked edit undid the very first fix, from Week 1.
Building the assistant was the easy part. Keeping it good is the job.
The whole onboarding file
Each level exists because the one before it failed in a specific way.
| Level | What the new hire got | What it's called | What it protects you from |
|---|---|---|---|
| 1 | A brain on loan | API wrapper | Building a model from scratch |
| 2 | A name badge | System prompt | A nameless, off-brand assistant |
| 3 | The handbook | RAG | Confidently invented answers |
| 4 | Keys to the building | Tool calling, MCP, agents | An assistant that can only talk |
| 5 | Security clearance | RBAC with OAuth | People seeing what they shouldn't |
| 6 | Street smarts | Guardrails | Being talked into things |
| 7 | Learning to delegate | Caching and routing | A runaway bill |
| 8 | Performance reviews | Observability and evals | Silent breakage |
Where a business starts
- Pick one question your team answers every single day. That's your first assistant.
- Levels 1 to 3 are enough for a useful pilot. Add Level 8 before anyone outside the pilot uses it.
- Levels 4 to 6 come when you let it act, not just answer.
Where a student starts
- Pick one level and follow its papers. Each one is an active research field.
- Levels 3, 6 and 8 have the most open problems: retrieval quality, prompt injection, and how to measure AI behaviour.
The 22-second version
For the friend who won't read eight weeks of anything.
One disaster, one fix and the Friday twist, cut to music. Send it to the person in your team who keeps asking what RAG actually means.
Sources
- Duolingo launches new subscription tier with access to AI tutor powered by GPT-4, TechCrunch, 14 Mar 2023
- DPD AI chatbot swears and criticises delivery firm, AI Incident Database, Jan 2024
- AI Gone Wild: Airline Has to Honor a Refund Policy Its Chatbot Fabricated, Manatt, 28 Feb 2024
- Phony ChatGPT Brief Leads to $5,000 Fine for NY Lawyers, Bloomberg Law, 22 Jun 2023
- Klarna customer story, OpenAI
- Klarna is hiring customer service agents after AI couldn't cut it, Entrepreneur, 9 May 2025
- OpenAI adopts rival Anthropic's standard for connecting AI models to data, TechCrunch, 26 Mar 2025
- Microsoft 365 Copilot rollouts slowed by data security, ROI concerns, Computerworld, 27 Sep 2024
- Chevrolet of Watsonville, AI Incident Database, Dec 2023
- RouteLLM: An Open-Source Framework for Cost-Effective LLM Routing, LMSYS, 1 Jul 2024
- Expanding on what we missed with sycophancy, OpenAI, 2 May 2025
Kettle & Co., Aria and every staff member named here are invented, and so are their numbers. Everything stamped "This actually happened" or "Seen in the wild" is real and sourced above. Inspired by a short explainer reel on how companies build their own AI. Trailer music is original.