Evals And Observability medium
A health-adjacent assistant serves 5M requests per day. Engineers want prompt and output logs for debugging, and legal is worried about storing sensitive user text. Which logging policy best balances both concerns?
- A Fully log a small sample plus all errors and flagged sessions, redact PII before storage, and keep the content under a short retention window.
- B Log every prompt and output in full but encrypted at rest, since encryption by itself satisfies privacy requirements and maximizes debug coverage.
- C Log only metadata such as token counts, latency, and status codes, since prompt content is rarely needed to debug quality issues in LLM apps.
- D Log every request in full but hash the user ID, since removing the direct identifier makes prompt contents anonymous and safe to retain.
Answer: A. Fully log a small sample plus all errors and flagged sessions, redact PII before storage, and keep the content under a short retention window.
**Sampled logging with redaction** keeps enough real content to debug failures while limiting both the volume of sensitive text and the storage cost. The tradeoff is that rare issues outside the sample may need targeted capture. Hashing the user ID (D) is tempting, but prompts themselves often contain names, conditions, and other identifiers. Metadata-only logging (C) is the right choice when content cannot legally be stored at all, at the cost of much harder quality debugging.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- In one release, a RAG assistant got a new embedding model and a new chunking strategy, and the end-to-end judge score dropped 6 points. The team only tracks the end-to-end score and has spent a week tweaking the generation prompt with no recovery. What is the best next step?
- Over two months, your team iterated through 40 prompt versions, each tuned against the same 150-case golden set. The offline score rose from 72 to 91. Online task completion and retry rate have not changed. What is the most likely problem, and what is the fix?
- A prompt change produced an impressive answer in a live demo for leadership. The PM wants to ship it today. What should you do?
- You plan to replace human graders with an LLM judge for your answer-quality eval. Before trusting its scores in a CI gate, what should you do first?
- After you swap to a smaller model, p95 latency falls from 900 ms to 350 ms and the ops dashboard is all green. Leadership asks whether answer quality is still fine. What is the right response?
- Your CI gate fails any prompt change that drops the score 3 or more points on a 100-point rubric over 60 cases. Production generates at temperature 0.7. Running the eval twice on the same commit gives scores that differ by up to 4 points, and engineers have started rerunning failed gates until they pass. How do you fix the gate?