YTYK You think you know

GenAI

GenAI in production

The parts that are the same whichever provider you picked

Tokens, context, retrieval, fine-tuning, evals, guardrails and agents — what each one actually does, and the confusions that cost the most money. No model names, no prices, no context-window sizes appear in this topic. Those change every few weeks and would make every card wrong by Christmas. Everything here is the layer underneath: true across providers, and still true after the next release.

Start the map 6 pillars · 18 cards · about 27 minutes end to end

The map

Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.

  1. How the thing behaves

    Tokens, context and sampling — the three mechanics every surprise traces back to.

  2. Making it do your thing

    Three levers that are routinely used for each other's jobs.

  3. Retrieval

    RAG is a search problem wearing a generation costume.

  4. Knowing whether it works

    The part teams skip, and the reason nobody can tell if a change helped.

  5. Guardrails

    What they catch, what they cannot, and the class of attack nobody has solved.

  6. Agents

    What changes when the model can act, and when not to let it.

Apply it

One scenario per sitting, about ten minutes. No marking scheme that pretends to be objective — a rubric you are invited to argue with.

Read against OWASP Top 10 for Large Language Model Applications, 2025, NIST AI 600-1 — Generative AI Profile (AI RMF), Lewis et al., Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (arXiv:2005.11401), Hu et al., LoRA: Low-Rank Adaptation of Large Language Models (arXiv:2106.09685) on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.

The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.