6 patterns for this issue
Team builds a custom eval harness (a handful of manually-written test prompts checked by eyeballing the output) instead of adopting an established agent/RAG evaluation framework, missing standardized metrics and automatic test-case generation.
Team tracks LLM spend via manual log scraping or spreadsheet exports instead of adopting an established gateway/observability framework, losing real-time budget enforcement and per-call cost attribution.
Team relies on ad-hoc regex or manual review for PII detection/redaction instead of adopting an established, maintained framework, missing entity types and edge cases the framework would catch by default.
System prompt instructions are the only defense against prompt injection and unsafe output, with no established guardrails/scanning framework wired in front of or behind the model call.
Team builds a bespoke retrieval pipeline (custom chunking, custom vector store glue, custom prompt assembly) from scratch instead of adopting an established RAG framework, missing built-in chunking strategies, retrieval orchestration, and evaluation tooling that ship by default.
Agent outputs, logs, and tool-call payloads are never scanned by an automated secrets/credential-detection framework, relying on manual review (or nothing) to catch API keys and tokens before they're persisted or displayed.
The recurring mechanism across every pattern here: a well-solved problem (PII detection, prompt-injection defense, cost observability, RAG pipelines, agent evaluation, secrets scanning) already has a mature, publicly available framework, but the team builds ad-hoc or custom tooling instead — missing the edge-case coverage, tested defaults, and maintenance the framework would have provided. Distinct from the many existing symptom-level patterns elsewhere in this repo (e.g., PII leakage, credential leakage) — those describe what goes wrong; these describe the upstream root cause of not adopting the tool that would have caught it.
Total: 6 patterns