For platform teams and regulated organizations — multi-tenant, governance, compliance, audit
MCP went from emerging standard to genuine substrate in 2025. The use cases that have actually shipped on it are more interesting than the broad-platform-narrative version. Worth being specific about which ones to track and why.
Decisions as Code specifies the standard. OPA Gatekeeper enforces it. Constraint templates as the policy definition layer. Required tags, model version pinning, namespace quotas, network policies for AI workloads. The 'specify, then verify' loop, finally complete.
Every platform starts with traceability as a goal. Most lose it by month six. The predictable failure modes, log-format drift, ID-namespace collisions, the 'we'll add structured logging later' debt, the asymmetric incentive to write logs but never read them. What survives, and why.
Argo Workflows for the long-running, branching, fan-out AI ops pipelines that don't fit a CI runner. RAG indexing jobs, fine-tuning runs, eval suite execution. WorkflowTemplates as the Decisions as Code surface, same pipeline shape, different inputs per project.
DSPy is the framework that's most-likely to look obvious in retrospect. The practitioners running it in production have learned things the documentation doesn't cover. Worth the field report.
Most teams treat HIPAA as a feature you bolt on at the end. The teams who've actually shipped under it know it shapes the data model, the audit log, the auth model, and the deletion semantics, before you draw a single arrow on the diagram.
The discourse keeps pushing toward agents that operate alone. The discipline pushes back: bounded autonomy is the right target. Full autonomy is a category error, it's never what production wants. The right target is 'as much rope as you've earned, no more.'
The headline cases get the attention. The everyday reality of AI in legal practice in late 2025 is more mundane and more interesting, discovery review, transcript synthesis, brief assistance. The shape of what's working is worth understanding.
If your self-service form has eighty-nine questions on it, you haven't designed a decision surface, you've handed off a configuration job. The five-not-eighty-nine test: can the business owner read the surface in five minutes and know what they're choosing? Here's how to apply it.
Three quarters of incident debugging time used to come from not knowing what the AI did. Logging every tool call into a queryable store changed that, small infrastructure investment, outsized return.
Most of the AI conversation centers on the largest models. The interesting work in 2025 happens at the small end of the spectrum, where a handful of 1-8B-class models are doing more useful daily work than the marketing acknowledges.
The legal framework for treating accumulated organizational knowledge as a real asset is older than the AI conversation and incomplete in ways the AI conversation makes more visible. Worth pulling on the thread.
