A few months into any serious RAG deployment, most engineering teams tend to hit the same wall. Our AI-powered payment assistant demo worked beautifully. The pilot with twenty internal users worked beautifully. Then it goes live, someone asks a question about their medical benefits or a wire transfer that failed, the model confidently makes something up, and suddenly "chatbot" is a word nobody on the team wants to hear in a postmortem.The fix isn't a smarter prompt. It's an architecture that assumes the model will occasionally be wrong, occasionally be asked something it shouldn't answer, and occasionally need to get out of the way entirely and hand the person off to a human. Here's how I'd structure that system if I were building it today.