Most companies deploying third-party models worry about the model changing under them. Security teams have a harder version of that problem: the input isn't just uncontrolled, it's adversarial. Every email we hand our agents may have been crafted by someone trying to manipulate the exact model reasoning we're relying on. That's the question this talk answers: how do you engineer safety and reproducibility when you don't control the model, the input is actively trying to attack it, and the only thing you actually control is the harness in between? We will discuss end to end measurement schemes that ship with real products and governance built into the products that helps reduce attack surface.