Best practices · AI
Best Practices for Building LLM Apps
FreeVendor-neutral best practices for building LLM apps and agents, checked against the OWASP Top 10 for LLM Applications 2026, the OWASP Agentic Top 10, NIST's Generative AI Profile and official provider docs. It covers prompt design, evals, prompt injection, agent permissions, cost, observability, failure handling and data privacy.
Written by Tauseef Fayyaz7 chapters, 31 practicesAbout 18 min27 quiz questionsReviewed 12 October 2026What you will learn
7 chapters · about 18 min
1Prompt design and structured outputClear prompts and machine-readable output are the foundation. These practices make model behaviour predictable enough to test and to parse.4 practices · 3 min
- 1Write specific instructions with the context a new colleague would need
- 2Use schema-enforced structured output when code reads the response
- 3Keep prompts in version control and tag every call with the prompt version
- 4Check why generation stopped before you trust the output
4 in this chapterOpen this chapter2Evals before shippingEvals are automated tests for model behaviour. Without them, every prompt or model change is a guess you only check in production.5 practices · 3 min
- 1Define measurable success criteria before you write the prompt
- 2Build the eval set from real inputs, including the awkward ones
- 3Grade automatically: code checks first, then model-graded rubrics
- 4Run a regression eval on every prompt, model or retrieval change
- 5Capture user feedback and link it to the logged call
5 in this chapterOpen this chapter3Prompt injection and the OWASP LLM Top 10Prompt injection is LLM01 in the OWASP Top 10 for LLM Applications 2026. You cannot fully prevent it with prompts, so design the app so a fooled model cannot do much harm.5 practices · 3 min
- 1Treat every document, web page, email and tool result as untrusted
- 2Enforce permissions in code, not in the system prompt
- 3Escape and validate model output before it reaches a browser, shell or database
- 4Keep secrets and other users' data out of prompts
- 5Red-team your app with injection attempts before launch
5 in this chapterOpen this chapter4Tools, agents and least privilegeExcessive agency rose to LLM03 in 2026. These practices keep an agent's power proportional to what the task really needs.5 practices · 3 min
5Cost and latencyToken costs and response times decide whether a feature is viable. Most savings come from model choice, caching and limits.4 practices · 2 min
6Observability and data privacyYou need enough logging to debug and evaluate, and enough restraint to protect the people whose data passes through. NIST's Generative AI Profile lists data privacy among the risks generative AI makes worse.4 practices · 2 min
7Failures, fallbacks and misinformationModel APIs time out, rate limit and occasionally return nonsense. Plan for each case so users get a clear answer instead of a spinner or a confident mistake.4 practices · 2 min
About this guide
Building LLM apps is easy to start and hard to finish. A demo that works on five hand-picked inputs can fail on the sixth, cost ten times what you planned, or follow instructions hidden in a web page. These best practices for building LLM apps are the habits that separate a prototype from something you can put in front of real users.
The guide is vendor-neutral. The advice applies whether you call a hosted model API, run an open-weight model, or use a framework on top. Where a provider documents a feature, such as structured outputs or prompt caching, the guide links to the official docs and describes the idea in general terms, because model names and prices change every few months.
Security follows the OWASP Top 10 for LLM Applications 2026, released in August 2026. Prompt injection is still number one, sensitive information disclosure is number two, and excessive agency rose to number three as more apps give models tools. For agents, OWASP also publishes a separate Top 10 for Agentic Applications. Risk management follows the NIST AI Risk Management Framework and its Generative AI Profile.
Start with the first two chapters, prompt design and evals. Almost every other problem, from regressions to cost, is easier to fix once you can change a prompt and measure the result in minutes.
Common questions
What is the OWASP Top 10 for LLM Applications 2026?
It is the OWASP GenAI Security Project's list of the most critical security risks for applications built on large language models, released in August 2026. Prompt injection stays at number one, sensitive information disclosure is second and excessive agency rose to third. System prompt leakage was renamed hidden context exposure.
How do I prevent prompt injection in an LLM app?
You cannot fully prevent it, so limit what a fooled model can do. Treat all external content as untrusted, enforce permissions in your tool code instead of the prompt, validate and escape model output, and require human approval for risky actions. Red-team the app and keep successful attacks as regression tests.
What are LLM evals and why do I need them?
Evals are automated tests that run your prompts over a fixed set of inputs and grade the outputs, with code checks or a model-graded rubric. They let you change a prompt or switch models and see within minutes whether quality went up or down. Without them, every change is tested only by your users.
How can I reduce the cost of an LLM app?
Use the smallest model that passes your evals, put stable content at the start of the prompt so provider caching can reuse it, and set output token limits. Add per-user quotas, batch work nobody is waiting for, and track spend per feature so you know where the money goes.
Should an AI agent be allowed to take actions without human approval?
Read-only and easily reversible actions can usually run on their own. Irreversible or high-impact actions, such as sending messages, spending money, deleting data or changing permissions, should wait for a person to approve the exact action and arguments. OWASP lists excessive agency as the third biggest LLM risk in 2026.
Sources (7)
Checked against these, last on 12 October 2026.
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Projectgenai.owasp.org/resource/owasp-genai-llm-top-10-2026/
- OWASP Top 10 for Agentic Applications, OWASP GenAI Security Projectgenai.owasp.org/resource/owasp-top-10-for-agentic-applications/
- LLM Prompt Injection Prevention Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1), NISTwww.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- Define success criteria and build evaluations, Anthropic docsplatform.claude.com/docs/en/test-and-evaluate/develop-tests
- Prompt caching, Anthropic docsplatform.claude.com/docs/en/build-with-claude/prompt-caching
- Structured model outputs, OpenAI docsdevelopers.openai.com/api/docs/guides/structured-outputs
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See all- AI agents and MCP cheat sheetTool calling, MCP servers, evals.
- GenAI app architecture cheat sheetHow a production GenAI app fits together: request flow, layers, RAG, agent loop, memory, caching, guards, evals, tracing, folder layout and launch checklist.
- AI evals cheat sheetEvals for LLM apps and agents: golden datasets, metrics, LLM-as-judge and its biases, RAG and agent metrics, offline and online evals, CI, human review, tools.
Best practices
See all- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
- Best Practices for Building AI AgentsHow to design AI agents that finish real tasks: when to use one, tool design, context and memory, control loops, MCP and agent security, and evaluating agent runs.
Checklists
See all- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
- AI Feature Launch ChecklistAn AI feature launch checklist: use case fit, evals, UX for errors, disclosure, human override, abuse filters, rate limits, cost caps, prompt privacy, monitoring and rollback.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Python AI agent with LangGraph project structureFor Python developers moving from "call a model in a loop" to an agent that can pause, resume and be debugged. It starts from the official LangGraph template (langgraph.json, a src/agent package, unit and integration tests) and grows into a customer support agent with typed state, one file per node and tool, human approval before refunds, evals that score whole trajectories, tracing, auth and a deployable server image.
Career questions
See all- How do I start learning AI agents as a software engineer?Start with one LLM API and plain code: a loop that calls the model, lets it pick a tool, runs the tool and feeds the result back. Build one small agent that does a real task end to end, add evaluation and guardrails, and only then reach for a framework. Agents are software engineering first.
- Should I learn LangGraph, CrewAI or the OpenAI Agents SDK first, or build AI agents without a framework?Build one small agent without a framework first: the tool-calling loop is about fifty lines and every framework wraps it. Then learn one framework deeply, chosen by what your project needs: LangGraph for explicit state and approvals, the OpenAI Agents SDK for quick assistants with handoffs, the Claude Agent SDK for agents that work on files.
- What is MCP, and do I need to learn it?MCP, the Model Context Protocol, is an open standard for connecting AI applications to tools and data. You do not need to study it in depth, but if you build with LLMs, writing one small MCP server takes an afternoon and teaches you how agents really use tools. Learn the concepts; skip the hype.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com