Start From the System Map, Not the Model
Before you touch an API key, draw the actual map: which systems hold the source of truth, who writes to them, and what breaks downstream when a record changes. A claims-processing program might span a CRM, a document store, a ledger, and a notification service. The AI is one node, not the center. List every system, its owner, its real rate limits, and its failure mode when it is slow rather than down. Most integration disasters come from treating a 3-second model latency as if it were the 80-millisecond database call the rest of the flow assumes. Annotate each hop with the human who currently owns that step today, because that person carries context no schema captures. Your job is to insert the model where it removes drudgery for that person, not to silently route around them. Deliver this map as a one-page diagram your team leads sign off on. If they cannot trace a record end-to-end on it, you are not ready to build, and shipping anyway just moves the confusion into production where it costs more.
Wrap Every Model Behind a Contract
Never let a downstream system call a model provider directly. Put an internal service in front of it with a stable input and output contract: defined fields, types, and an explicit schema for what 'no confident answer' looks like. This buys you three things operators need. First, you can swap providers or models without touching ten consuming teams. Second, you can validate and clamp outputs before they reach a system of record, so a malformed extraction never corrupts the ledger. Third, you get one place to log, rate-limit, and inject the kill switch you will need in Module 3. Treat the model like an unreliable network dependency, because it is one: it times out, it returns garbage occasionally, and its behavior drifts on provider updates you do not control. Your contract layer enforces a timeout, a retry budget, and a fallback path that routes to the human who used to do this work. Augmentation is built right here. The fallback is not an error state to hide; it is the design making sure a person stays in the loop when the model is unsure.