LLMOps — LLM in production
Building a prototype is easy. Running a reliable, cheap and safe LLM product for thousands of users is real engineering. Here's how to do it right.
What LLMOps is
LLMOps (Large Language Model Operations) is the set of practices for running and maintaining LLM products in production — the equivalent of DevOps/MLOps, but adapted to the unique challenges of language models: non-deterministic output, variable cost, hallucinations, and dependence on a third-party API.
The difference from a prototype: a prototype needs to work once, on your machine. A production product needs to work a million times — reliably, quickly, cheaply and safely — even when the provider's API goes down, even when a user tries to break it, and even when volume spikes 10x.
LLMOps = everything needed to turn a clever prototype into a product you can rely on: versioning, monitoring, reliability, cost and security.
The lifecycle of an LLM product
LLMOps is a loop, not a straight line:
- Development: prompt, RAG, agent — with evals from day one.
- Testing: the evals run in CI. A change doesn't pass if quality drops.
- Deployment: a controlled rollout (staging → canary → production).
- Monitoring: Observability on real traffic — quality, cost, latency, errors.
- Improvement: production failures become new eval cases, and back to step 1.
Versioning — prompts and models
In the LLM world, the prompt is code — it affects behavior just like logic. So:
- Prompts in git, not pasted into code or a DB without history. Every change goes through review and evals.
- Pin the model version. Don't use an alias that shifts under you — specify an explicit version (e.g.
claude-opus-4-8), because a model upgrade can change behavior without you knowing. - Centralized config. Model, temperature, prompt and parameters in one place you can change without a deploy.
- A/B and rollback. Infrastructure to run two prompt/model versions in parallel and roll back immediately if something breaks.
Reliability and model routing
You depend on a third-party API. Plan for failures:
- Retries with backoff: transient errors and rate limits happen. Retry with increasing delay.
- Fallback model: if the primary provider goes down or is slow — automatically switch to an alternative model/provider.
- Timeouts: don't let a request hang the system. Set a timeout and handle it.
- Model routing: route by complexity — a cheap model (Haiku/mini/Flash) for most calls, premium only for complexity. Saves money and load.
- Circuit breaker: if a provider keeps failing, "cut it off" temporarily instead of continuing to retry.
Cost, latency and caching
LLM cost can quietly explode. Control it:
- Prompt caching: providers let you cache the fixed part of the prompt (system, fixed context) — significant savings on repeated calls.
- Semantic caching: if a similar question was already answered — return the cached answer instead of a new call.
- Streaming: stream the response to the user to improve perceived latency.
- Budgets and limits: set cost ceilings and alerts. See the cost-reduction guide.
- Measure cost per request/user — to know what's really expensive and optimize correctly.
Pre-production checklist
- ✅ Evals run in CI and block regressions
- ✅ Prompts in git with review; model version pinned
- ✅ Guardrails and prompt-injection defense
- ✅ Retries, timeouts and a fallback model
- ✅ Observability: logging, metrics and tracing
- ✅ Cost control: caching, budget and alerts
- ✅ Validation of every output before downstream use
- ✅ A rollback plan and incident response
Treat the LLM system like any critical production service: measurable, reproducible, fault-tolerant and secure. The AI "magic" doesn't exempt you from good engineering — it demands it more.
Next step
Go deeper on the critical production components: monitoring, evals and safety.