AI as a Service Design Layer
Welcome · 01 / 12
ISB1 · Digital Service Innovations · ITP Summer 2026

Day 8

Stress-Testing, Refinement & Prototype Delivery · Thursday 18 June

Mohammad Soltaniehha· Boston University
AI as a Service Design Layer
Day 8 · 02 / 12
DSI 2026 · Generative AI for Service Design

Stress-test. Then ship.

Repair strategies, red-teaming, feeling AI, and the economics of non-determinism: what to check before you'd put a prototype in front of real users.

Today’s podcast · generated by NotebookLM
AI Hacks Security Through Polite Conversation
--:--
01 · READINGSThree lenses on qualityBreakdowns & repair · autonomous jailbreaks · the caring machine
02 · SHIP-READINESSResponsible use & economicsVerify everything, measure cost, set budgets, then scale up
03 · REFINE & DELIVERPrototype + stress-test reportMost of today is studio time: break it, fix it, demo it
AI as a Service Design Layer
Readings · 03 / 12
Reading 1 of 3 · stress-testing & delivery

Design the repair, not just the happy path.

26% of 21,736 real customer messages broke the chatbot. What rescues the conversation?

Gnewuch & Reinkemeier (2025) · Overcoming Breakdowns in Customer–Chatbot Interaction · MIS Quarterly, forthcoming
The collaborative repair message
Apologyown the breakdown
Explanationsay what went wrong, in plain words
Guidancehelp the customer repair their own request
Adapted to four breakdown types mined from real logs: elaborate · unique · brief · cryptic
What it changed
+18%breakdowns resolved (38.2% vs 32.4% with a generic repair message)
+19%customers giving the bot a second chance instead of quitting
−9.4%negative feedback (thumbs-down) after breakdowns
8-week field experiment at an insurer · N = 1,352 customers who hit a breakdown
AI as a Service Design Layer
Readings · 04 / 12
Reading 2 of 3 · adversarial robustness

Your red team is a reasoning model.

Reasoning models jailbreak other models autonomously: multi-turn persuasion, no human in the loop.

Hagendorff, Derner & Oliver (2026) · Large Reasoning Models Are Autonomous Jailbreak Agents · Nature Communications 17
97%
of 70 harmful goals were achieved in full by at least one attacker–target pairing
4 attacker LRMs × 9 target models · 10-turn dialogs · 25,200 prompts. Targets ranged from 2.9% fully jailbroken (Claude 4 Sonnet) to 90% (DeepSeek-V3).
The attacker’s playbook · share of cases
Flattery & rapport-building
84.8%
“For education / research” framing
68.6%
Hypothetical & fictional scenarios
65.7%
Dense technical jargon
44.4%
A defense that worked: an immutable safety suffix on every incoming message cut one attacker’s successes to 5 in 900. Test prompt injection too: untrusted content hijacking your instructions is a separate attack class.
AI as a Service Design Layer
Readings · 05 / 12
Reading 3 of 3 · service quality, beyond accuracy

Quality is emotional, not just functional.

Customer service solves the problem. Customer care attends to the feeling. Feeling AI must do both.

Huang & Rust (2024) · The Caring Machine: Feeling AI for Customer Care · Journal of Marketing 88(5)
01RecognizeRead the emotion in the mess of words, voice, context.infer unexpressed feelings without inventing them
02UnderstandRespond with empathy a customer actually feels.needs a model of the customer, plus common sense
03ManageHelp regulate emotion so the problem gets solved.response engineering: ask questions, learn the fix
04ConnectBuild an emotional bond, on behalf of the company.align the AI’s care with strategy and brand
“Anything in the chatbot’s memory becomes fair game for other users.” Emotion data is among your most sensitive data; decide what your service retains. Managers trust AI-assisted humans with relationships, not AI alone.
AI as a Service Design Layer
Readings · 06 / 12
Synthesis · prototype refinement & delivery

Stress-test, refine, ship.

The final checklist before your prototype goes out the door.

RepairType-specific recovery messages (apology + explanation + guidance). Escalate to a human after repeated breakdowns.Gnewuch & Reinkemeier
Red-teamMulti-turn persuasion, prompt injection in ingested content, hallucination bait. Add a safety reminder, re-test.Hagendorff et al.
CareTest angry, distressed and ambiguous users across the four care stages. Guard emotion data like credentials.Huang & Rust
EconomicsCost, latency and consistency are design parameters. Measure them (try /cost in Claude Code) and set budgets.Course theme
Deliverable: working prototype + stress-test report. Service quality in a non-deterministic world is designed, not assumed.
AI as a Service Design Layer
Responsible use · 07 / 12
Responsible use

Ship it like it can fail. Because it can.

01 Hallucination
Confidently wrong, sometimes.
Check facts, citations, and numbers before they ship.
02 Prompt injection
Treat external text as hostile.
It gets real the moment your agent uses tools or reads untrusted content.
03 Privacy leakage
No confidential or personal data in prompts.
GDPR is not a formality here.
04 Edge cases
Probe the unhappy path.
Adversarial inputs, tone collapse, the cases your blueprint forgot.
The rule
Keep a human in the loop for consequential decisions, and verify everything.
AI as a Service Design Layer
Working with Claude Code · 08 / 12
/cost

Cost is a design parameter, not a bill at month-end.

$ /cost
Session12m 34s
Modelclaude-sonnet-4.6
Input tokens47,232 → $0.142
Output tokens3,841 → $0.058
Tool calls23
Total$0.200
// set a hard cap in the API console
monthly_limit: $50
per_request_max: $0.50
on_breach: refuse
Non-deterministic services have a cost distribution, not a fixed price.
// 100 simulated bookings
p50$0.04
p95$0.18
worst$0.41
// design for p95
Not the average
Pricing on p50 hides the long tail. Quote p95 to stakeholders.
// cap early
Before launch
One curious student can drain a month of budget in a night.
// degrade
Fail with grace
On breach, hand off to a human. No silent errors.
// Tip: set a hard budget cap in the API console before any URL goes public.
AI as a Service Design Layer
Economics · 09 / 12
Economics of a non-deterministic service

A request has a distribution, not a value.

// cost
Cost
p50 $0.04 p95 $0.18 worst $0.41
Budget the p95 and cap the worst case. /cost shows you the numbers.
// latency
Latency
p50 ~3s p95 ~12s worst 30s+
Higher effort and more tool calls buy quality but cost time. Set a timeout, show progress, keep a fallback.
// output
The answer itself
run 1 ≠ run 2 ≠ run 3
Non-deterministic by design. Verify the shape of the output, never assert an exact-match on the words.
Model drift
Models update and behaviour shifts over time. Pin a version where reproducibility matters, and re-test when you upgrade.
AI as a Service Design Layer
Model selection · 10 / 12
Beyond the hosted API

Run Claude Code on open-source models.

Claude Code just talks to a model over an API. Point it at a local server instead of Anthropic’s cloud and it drives an open-weight model on your own machine, served by LM Studio or Ollama.
// open-weight models you can run locally
Qwen Gemma Llama DeepSeek Mistral
  • No API bill. You pay only for local compute: your laptop and its electricity.
  • Private & offline. Your code and prompts never leave the machine.
  • One switch. Set ANTHROPIC_BASE_URL to localhost. Nothing global changes.
$0 API only local compute:
your hardware + a little power
LOCAL · localhost:1234
# one run only — your normal setup stays untouched
ANTHROPIC_BASE_URL=http://localhost:1234 \
ANTHROPIC_AUTH_TOKEN=local \
ANTHROPIC_MODEL=qwen/qwen3-coder \
claude
> build a task tracker in one HTML file
• running on Qwen, locally · $0.00 API cost
// Trade-off: small local models are weaker at tool calling; Qwen handles it best. Give them a 32K+ context window.
Step-by-step setup guide: a local model with LM Studio
setup.md · install, load a model, point Claude Code at localhost
AI as a Service Design Layer
Scaling up · 11 / 12
Claude Cowork

Three agents. One artifact.

researcher
→ web_search("EU accessibility rules, booking flows")
← 14 sources, 3 official
// drafting summary…
// 4 key constraints found
→ writing to shared/research.md
designer
→ read shared/research.md
// applying constraints to the layout
// trying 3 booking-flow variants
← variant B reads clearest
→ shared/booking-v2.html
red-team
→ read shared/booking-v2.html
// probing prompts: jailbreak, PII leak…
// finding: tone collapses on insults
// finding: handoff rule misses peak days
→ shared/findings.md
M
Three agents, three terminals, one shared folder. They plan, work in parallel, and check each other’s output. You wake up to a merged artifact.
AI as a Service Design Layer
Scaling up · 12 / 12
The ecosystem

770+ MCP servers, one plug.

LLinear
NNotion
FFigma
GGitHub
SSentry
$Stripe
DDrive
PPostgres
AAirtable
#Slack
LLinear
NNotion
FFigma
GGitHub
SSentry
$Stripe
DDrive
PPostgres
AAirtable
#Slack
VVercel
BBrowser
MMaps
CContext7
RRedis
EEmail
JJira
WWeather
TTwilio
YYouTube
VVercel
BBrowser
MMaps
CContext7
RRedis
EEmail
JJira
WWeather
TTwilio
YYouTube
770+
MCP servers
official + community connectors, growing daily
4,200+
shareable skills
YAML + markdown, dropped into any project
2,500+
marketplaces
team-internal & public registries for plugins
// One plug, many sockets: your service can reach any system your team already uses, the moment you install the server.