Protect data, cost, and operations

An AI feature spreads data into more places than you think. Inventory what enters prompts, embeddings, vectors, gateway logs, Agent state, D1, and provider systems. Write the list down. A user’s message can end up in five of those stores from one request, each with its own retention and access rules.

Then shrink the list. Minimize it, separate tenants, redact logs, and set retention rules. The cheapest data to protect is data you never sent: if the task needs an order summary, send the summary, not the customer record.

Cap cost before the call

Set budgets and rate limits — and enforce them before the model call, not after. This site’s AI endpoint checks a per-visitor counter and a global daily counter in KV, and only then calls the model:

const globalCount = await bumpCounter(env, `global:${today}`)
if (globalCount > 300) {
  return fallbackResponse()
}
const result = await env.AI.run(model, input, { gateway: { id: 'flaviocopes' } })

With the checks in front, the worst-case daily spend is a number you chose, not a number an attacker chose. A cheap model does not protect you from a script sending a million requests.

Observe every boundary

Track model usage, gateway requests, Vectorize operations, Agent instances, tool outcomes, latency, and errors with one request identity. One ID stitched through Worker logs, gateway logs, and tool audit records is what turns “a user says it charged twice” into a searchable trace. Turn on Workers observability so the logs persist:

{
  "observability": {
    "enabled": true,
    "logs": { "enabled": true }
  }
}

Redaction applies here too — log the outcome and the request ID, not the prompt body, unless you have decided that store may hold user content.

Keep the off switch

Keep feature flags or kill switches for generation and tools, plus a non-AI path for critical work. When the model misbehaves in production, you want one config change that disables generation while the rest of the product keeps working. If a critical flow only works through the agent, an outage at the provider becomes an outage of your business.

Finish by writing the runbook for leaked prompt data, runaway spend, bad model release, poisoned index, and dangerous tool behavior. For each: how you detect it, the first containment action, and who decides. Five scenarios, one page each, written before the incident — because during one, nobody writes well.